# CloudTrail Not Enabled

> ZopNight checks 2 account-level CloudTrail facts (whether any trail is currently logging, and whether a multi-region trail exists), and fires when either confirmed flag reports a gap. The wording changes with the evidence: "not logging" is only ever claimed when logging is confirmed off, never inferred.

Source: https://zop.dev/integrations/aws/recommendations/cloudtrail-not-enabled
Updated: 2026-08-19

---

## Two gaps, three different findings

CloudTrail posture is not a single yes/no. The discoverer stamps two booleans per account:
`logging_enabled` (some trail is actively recording) and `multi_region_enabled` (a
multi-region trail exists). The rule ORs the gaps but words each combination honestly. No
active trail is the worst case: nothing is being recorded anywhere. Logging confirmed on but
single-region gets the narrower message: activity in every other region goes unaudited. And
when only the multi-region flag is present and false, the finding says exactly that, without
claiming logging is off. A finding that overstates its evidence teaches people to distrust the
whole list.

## When the rule stays silent

Both flags absent means the probe failed or the account is unknown, so the rule abstains rather
than firing on a phantom zero. A present flag that reads true clears its own dimension, and an
account with both true produces nothing. The rule therefore proves what it reports for the
dimensions it has evidence on, and says nothing where it has none.

## What an unlogged region costs you in practice

An attacker who gains credentials does not politely stay in your primary region. Spinning up
miners in ap-southeast-1 or exfiltrating from a region you never use is standard playbook
precisely because single-region trails were common for years. A multi-region trail closes that
blind spot for management events at one stroke, and organization trails extend the same
posture across every member account.

## Inspect your own trails

```bash
aws cloudtrail describe-trails \
  --query 'trailList[].[Name,IsMultiRegionTrail,HomeRegion]' --output table
aws cloudtrail get-trail-status --name <trail-name> --query 'IsLogging'
```

## Setting it up properly the first time

Create one multi-region trail, enable management read and write events, and store logs in an
S3 bucket with versioning and encryption so the audit trail cannot be silently rewritten.
CloudTrail's [first copy of management events is free](https://aws.amazon.com/cloudtrail/pricing/); the S3 storage is the main recurring
cost and is modest at management-event volume. Data events for S3 objects and Lambda are the
expensive tier; enable them selectively where compliance actually requires them rather than
account-wide by default.