cloudsploit
cloudsploit copied to clipboard
CloudTrail Global Services Logging Duplicated plugin false positive
The CloudTrail Global Services Logging Duplicated plugin incorrectly reports failure when evaluating a multi-region trail. AWS recommends multi-region trails over single-region trails for most configurations, as they have several benefits over traditional single-region trails. Multi-region trails can be identified in the output returned by DescribeTrails by the IsMultiRegionTrail property being set to true.
The issue is a multi-region trail with global service event logging enabled will have the IncludeGlobalServiceEvents property set to true for all trails belonging to the multi-region trail. For a single multi-region trail, this should not be considered a failure result.