Prisma Cloud Remediation - AWS CloudTrail is not Enabled on the Account

AWS Cloudtrail is a service which provides event history of your AWS account activity, including actions taken through the AWS Management Console, AWS SDKs, command line tools, and other AWS services. To remediate Prisma Cloud Alert "CloudTrail is not enabled on the account", this playbook creates an S3 bucket to host Cloudtrail logs and enable Cloudtrail (includes all region events and global service events).

Prisma Cloud by Palo Alto Networks · 10 tasks · 2 inputs · 0 outputs

Inputs

  • AutoEnableCloudTrail — The following resources will be created: - S3 bucket cloudtrail-<account_id> - Cloudtrail cloudtrail-<account_id> Type 'Yes' to auto-enable CloudTrail.
  • CloudTrailRegion — S3 bucket and (global) Cloudtrail will be created on this region

Commands used

aws-cloudtrail-create-trail aws-cloudtrail-start-logging aws-s3-create-bucket aws-s3-put-bucket-policy

Flowchart

yes yes yes Start Start Create S3 bucket for Cloudtrail - aws-s3-create-bucket Create S3 bucket for Clou... aws-s3-create-bucket Allow Cloudtrail to write to S3 bucket - aws-s3-put-bucket-policy Allow Cloudtrail to write... aws-s3-put-bucket-policy Create Cloudtrail - aws-cloudtrail-create-trail Create Cloudtrail aws-cloudtrail-create-trail Done Done Enable CloudTrail Automatically? Enable CloudTrail Automat... Manually enable CloudTrail Manually enable CloudTrail Is AWS S3 integration enabled? Is AWS S3 integration ena... Is AWS - CloudTrail integration enabled? Is AWS - CloudTrail integ... Enable Cloudtrail - aws-cloudtrail-start-logging Enable Cloudtrail aws-cloudtrail-start-logging