AWS Config compliance results proving the audit trail exists and is protected — CloudTrail enabled and multi-region so management events are captured account-wide, log-file validation on so records are tamper-evident, and SSE-KMS encryption on so the logs themselves are protected at rest
The API supplies the facts, but a human judgement against a documented baseline turns them into evidence.
Fetch
$ aws configservice get-compliance-details-by-config-rule --config-rule-name cloudtrail-enabled --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name multi-region-cloudtrail-enabled --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name cloud-trail-log-file-validation-enabled --compliance-types NON_COMPLIANT$ aws configservice get-compliance-details-by-config-rule --config-rule-name cloud-trail-encryption-enabled --compliance-types NON_COMPLIANT$ aws configservice describe-configuration-recorder-status$ aws configservice describe-config-rule-evaluation-status --config-rule-names cloudtrail-enabled$ aws configservice describe-config-rule-evaluation-status --config-rule-names multi-region-cloudtrail-enabled$ aws configservice describe-config-rule-evaluation-status --config-rule-names cloud-trail-log-file-validation-enabled$ aws configservice describe-config-rule-evaluation-status --config-rule-names cloud-trail-encryption-enabled$ aws ec2 describe-regions --query 'Regions[].RegionName' --output text$ aws organizations list-accounts --query 'Accounts[].Id' --output textExpected output
Four EvaluationResults arrays; empty NON_COMPLIANT sets mean a trail is enabled, at least one trail is multi-region, log-file validation (SHA-256 signed digest) is on, and the trail delivers SSE-KMS-encrypted logs. Managed rule identifiers: CLOUD_TRAIL_ENABLED (rule name cloudtrail-enabled), MULTI_REGION_CLOUD_TRAIL_ENABLED (rule name multi-region-cloudtrail-enabled), CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED, CLOUD_TRAIL_ENCRYPTION_ENABLED Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran.
Assertions — what makes it a pass
| Field | Must be | For | Proves |
|---|---|---|---|
| cloudtrail-enabled.EvaluationResults | count_eq 0A CloudTrail trail is enabled, so audit records are generated at all. | every row | AU-02AU-12 |
| multi-region-cloudtrail-enabled.EvaluationResults | count_eq 0At least one trail is multi-region, so the record covers management events account-wide rather than in one Region. | every row | AU-02 |
| cloud-trail-log-file-validation-enabled.EvaluationResults | count_eq 0Log-file validation is on, so delivered logs carry a signed digest and tampering is detectable. | every row | AU-09 |
| cloud-trail-encryption-enabled.EvaluationResults | count_eq 0The trail delivers SSE-KMS-encrypted logs, protecting the audit information at rest. | every row | AU-09 |
| configuration-recorder-status.ConfigurationRecordersStatus[].recording | eq trueThe configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran. | every row | AU-02AU-09AU-12 |
| cloudtrail-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted | eq truecloudtrail-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result. | every row | AU-02AU-09AU-12 |
| cloudtrail-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime | existscloudtrail-enabled has a successful evaluation on record. | every row | AU-02AU-09AU-12 |
| multi-region-cloudtrail-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted | eq truemulti-region-cloudtrail-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result. | every row | AU-02AU-09AU-12 |
| multi-region-cloudtrail-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime | existsmulti-region-cloudtrail-enabled has a successful evaluation on record. | every row | AU-02AU-09AU-12 |
| cloud-trail-log-file-validation-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted | eq truecloud-trail-log-file-validation-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result. | every row | AU-02AU-09AU-12 |
| cloud-trail-log-file-validation-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime | existscloud-trail-log-file-validation-enabled has a successful evaluation on record. | every row | AU-02AU-09AU-12 |
| cloud-trail-encryption-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted | eq truecloud-trail-encryption-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result. | every row | AU-02AU-09AU-12 |
| cloud-trail-encryption-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime | existscloud-trail-encryption-enabled has a successful evaluation on record. | every row | AU-02AU-09AU-12 |
Authored opinion, like the commands. Units live in the operator name — max-age-days is days, and nothing here is converted for you.
Map — what it proves
- recipe3
- recipe— an authored recipe collects evidence for this control
- KSI only— a Key Security Indicator reaches it, but no recipe is authored yet
- orphan— no Key Security Indicator reaches it — a person writes it up instead
What else these families can fetch:AU 11/27 →
GovCloud
AWS Config, CloudTrail, and all four managed rules are available in AWS GovCloud (US); trail, bucket, and KMS key ARNs use partition arn:aws-us-gov
Notes & assertions
Together these prove audit-record generation (AU-02/AU-12) and protection of the audit information — integrity via log-file validation and confidentiality via SSE-KMS (AU-09). This is the trail's existence and protection, not review of its contents: pair with the log-review/alerting recipe (MLA) for AU-06. Pass the S3/CloudWatch parameters to CLOUD_TRAIL_ENABLED to assert delivery to your specific log destination. A trail existing proves generation, not content — AU-03 is not claimed, because no Config rule reads record content. AU-02's organization-defined event types and AU-12's component list (OS, container and application audit are components) are SSP parameters a human compares this output against, and AU-09's protection from unauthorized access and deletion needs the log bucket's policy, Object Lock and MFA-delete posture, which is not collected here.
References
- AWS Config managed rule: cloudtrail-enabled (CLOUD_TRAIL_ENABLED) https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-enabled.html
- AWS Config managed rule: multi-region-cloudtrail-enabled https://docs.aws.amazon.com/config/latest/developerguide/multi-region-cloudtrail-enabled.html
- AWS Config managed rule: cloud-trail-log-file-validation-enabled https://docs.aws.amazon.com/config/latest/developerguide/cloud-trail-log-file-validation-enabled.html
- AWS Config managed rule: cloud-trail-encryption-enabled https://docs.aws.amazon.com/config/latest/developerguide/cloud-trail-encryption-enabled.html
This AWS mapping is authored opinion (overlay v3.0.0), versioned separately from the dataset and written against ruleset 2026.07.14.01. The upstream FedRAMP dataset names none of these tools.
The Monitoring, Logging, and Auditing run (7)
- automatable
- partial — needs judgement
- narrative — no API proves this
Every authored recipe filed under MLA, in the order the plan works them. The mark says how much of the evidence the command produces on its own.
- partialAWS Config compliance results proving the audit trail exists and is protected — CloudTrail enabled and multi-region so management events are captured account-wide, log-file validation on so records are tamper-evident, and SSE-KMS encryption on so the logs themselves are protected at restyou are herecontinuousconfig-cloudtrail-audit-loggingAWS Config · AWS CloudTrail · AWS KMS
- partialAWS Config compliance results proving continuous security monitoring is switched on account-wide — GuardDuty threat detection enabled (optionally centralized to a delegated admin) and Security Hub aggregating control findingscontinuousconfig-threat-monitoring-enabledAWS Config · Amazon GuardDuty · AWS Security Hub
- partialThe metric filters that turn audit log events into metrics, the alarms built on them, and Config's confirmation that those alarms actually notify someone — the automated-mechanism half of audit reviewweeklycloudwatch-log-review-alertingAmazon CloudWatch Logs · Amazon CloudWatch · AWS Config
- partialHow long audit records are kept, how much space they occupy, and whether the pipeline that delivers them is currently failing — retention settings on every log group and log bucket, the storage they consume, and the trail's own delivery-error fieldsdailyaudit-log-retention-and-delivery-failureAmazon CloudWatch Logs · Amazon S3 · AWS CloudTrail · AWS Config · Amazon CloudWatch
- partialWhat each instance's clock is actually locked to and how far off it is right now — the chrony daemon's reference source, offset and leap status collected fleet-wide through Run Command — together with the configured time source in chrony.conf and the UTC time stamps CloudTrail already writes on every audit recorddailyclock-synchronization-and-timestampsAmazon EC2 · AWS Systems Manager · AWS CloudTrail
- partialA demonstration run against the live log estate that audit records can be reduced, sorted and searched on demand by event criteria — the standing saved queries, the query that ran, and the report it returnedquarterlyaudit-reduction-and-report-generationAmazon CloudWatch Logs · AWS CloudTrail · Amazon Athena · Amazon S3
- partialFor each artifact actually running in the boundary, the cryptographic answer to whether it came from the build this provider claims built it: the signed provenance statement, the certificate identifying the workflow that produced it, and the transparency-log timestamps that make the signature checkable later. Collected alongside the two things that decide whether that answer can be trusted at all — the version of the verifying client, and the record of which deployed artifacts were submitted for verification in the first place.on-changebuild-provenance-attestation-verificationGitHub artifact attestations