cloudsploit icon indicating copy to clipboard operation
cloudsploit copied to clipboard

CloudTrail Global Services Logging Duplicated plugin false positive

Open ralish opened this issue 5 years ago • 0 comments

The CloudTrail Global Services Logging Duplicated plugin incorrectly reports failure when evaluating a multi-region trail. AWS recommends multi-region trails over single-region trails for most configurations, as they have several benefits over traditional single-region trails. Multi-region trails can be identified in the output returned by DescribeTrails by the IsMultiRegionTrail property being set to true.

The issue is a multi-region trail with global service event logging enabled will have the IncludeGlobalServiceEvents property set to true for all trails belonging to the multi-region trail. For a single multi-region trail, this should not be considered a failure result.

ralish avatar Mar 20 '21 04:03 ralish