# AWS Config compliance results proving the audit trail exists and is protected — CloudTrail enabled and multi-region so management events are captured account-wide, log-file validation on so records are tamper-evident, and SSE-KMS encryption on so the logs themselves are protected at rest

> FedRAMP Consolidated Rules for 2026 v2026.07.14.01 · updated 2026-07-14
> Canonical page: /collect/config-cloudtrail-audit-logging

Recipe id: `config-cloudtrail-audit-logging` · cadence continuous · partial

> **Authored opinion.** AWS overlay v3.0.0, written
> against dataset 2026.07.14.01. The upstream
> FedRAMP rules name none of these tools; this mapping is ours.

## What it proves

- KSI `KSI-MLA-OSM`
- KSI `KSI-MLA-LET`
- control `au-2`
- control `au-9`
- control `au-12`

## Collection

Kind: `config-rule`

```sh
# cloudtrail-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name cloudtrail-enabled --compliance-types NON_COMPLIANT
# multi-region-cloudtrail-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name multi-region-cloudtrail-enabled --compliance-types NON_COMPLIANT
# cloud-trail-log-file-validation-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name cloud-trail-log-file-validation-enabled --compliance-types NON_COMPLIANT
# cloud-trail-encryption-enabled
aws configservice get-compliance-details-by-config-rule --config-rule-name cloud-trail-encryption-enabled --compliance-types NON_COMPLIANT
# configuration-recorder-status
aws configservice describe-configuration-recorder-status
# cloudtrail-enabled-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names cloudtrail-enabled
# multi-region-cloudtrail-enabled-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names multi-region-cloudtrail-enabled
# cloud-trail-log-file-validation-enabled-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names cloud-trail-log-file-validation-enabled
# cloud-trail-encryption-enabled-evaluation-status
aws configservice describe-config-rule-evaluation-status --config-rule-names cloud-trail-encryption-enabled
# describe-regions
aws ec2 describe-regions --query 'Regions[].RegionName' --output text
# list-accounts
aws organizations list-accounts --query 'Accounts[].Id' --output text
```

## Expected output

Four EvaluationResults arrays; empty NON_COMPLIANT sets mean a trail is enabled, at least one trail is multi-region, log-file validation (SHA-256 signed digest) is on, and the trail delivers SSE-KMS-encrypted logs. Managed rule identifiers: CLOUD_TRAIL_ENABLED (rule name cloudtrail-enabled), MULTI_REGION_CLOUD_TRAIL_ENABLED (rule name multi-region-cloudtrail-enabled), CLOUD_TRAIL_LOG_FILE_VALIDATION_ENABLED, CLOUD_TRAIL_ENCRYPTION_ENABLED Plus describe-configuration-recorder-status showing recording=true and, per rule, describe-config-rule-evaluation-status showing FirstEvaluationStarted=true with a LastSuccessfulEvaluationTime — the proof the empty set was produced by a check that ran.

## Assertions

- {"field":"cloudtrail-enabled.EvaluationResults","op":"count_eq","value":0,"controls":["au-2","au-12"],"description":"A CloudTrail trail is enabled, so audit records are generated at all."}
- {"field":"multi-region-cloudtrail-enabled.EvaluationResults","op":"count_eq","value":0,"controls":["au-2"],"description":"At least one trail is multi-region, so the record covers management events account-wide rather than in one Region."}
- {"field":"cloud-trail-log-file-validation-enabled.EvaluationResults","op":"count_eq","value":0,"controls":["au-9"],"description":"Log-file validation is on, so delivered logs carry a signed digest and tampering is detectable."}
- {"field":"cloud-trail-encryption-enabled.EvaluationResults","op":"count_eq","value":0,"controls":["au-9"],"description":"The trail delivers SSE-KMS-encrypted logs, protecting the audit information at rest."}
- {"field":"configuration-recorder-status.ConfigurationRecordersStatus[].recording","op":"eq","value":true,"controls":["au-2","au-9","au-12"],"description":"The configuration recorder is on — without it an empty NON_COMPLIANT set is indistinguishable from a recorder that never ran."}
- {"field":"cloudtrail-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["au-2","au-9","au-12"],"description":"cloudtrail-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"cloudtrail-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["au-2","au-9","au-12"],"description":"cloudtrail-enabled has a successful evaluation on record."}
- {"field":"multi-region-cloudtrail-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["au-2","au-9","au-12"],"description":"multi-region-cloudtrail-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"multi-region-cloudtrail-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["au-2","au-9","au-12"],"description":"multi-region-cloudtrail-enabled has a successful evaluation on record."}
- {"field":"cloud-trail-log-file-validation-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["au-2","au-9","au-12"],"description":"cloud-trail-log-file-validation-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"cloud-trail-log-file-validation-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["au-2","au-9","au-12"],"description":"cloud-trail-log-file-validation-enabled has a successful evaluation on record."}
- {"field":"cloud-trail-encryption-enabled-evaluation-status.ConfigRulesEvaluationStatus[].FirstEvaluationStarted","op":"eq","value":true,"controls":["au-2","au-9","au-12"],"description":"cloud-trail-encryption-enabled has evaluated at least once; a deployed-but-never-evaluated rule also returns an empty result."}
- {"field":"cloud-trail-encryption-enabled-evaluation-status.ConfigRulesEvaluationStatus[].LastSuccessfulEvaluationTime","op":"exists","controls":["au-2","au-9","au-12"],"description":"cloud-trail-encryption-enabled has a successful evaluation on record."}

## GovCloud

AWS Config, CloudTrail, and all four managed rules are available in AWS GovCloud (US); trail, bucket, and KMS key ARNs use partition arn:aws-us-gov

## Notes

Together these prove audit-record generation (AU-02/AU-12) and protection of the audit information — integrity via log-file validation and confidentiality via SSE-KMS (AU-09). This is the trail's existence and protection, not review of its contents: pair with the log-review/alerting recipe (MLA) for AU-06. Pass the S3/CloudWatch parameters to CLOUD_TRAIL_ENABLED to assert delivery to your specific log destination. A trail existing proves generation, not content — AU-03 is not claimed, because no Config rule reads record content. AU-02's organization-defined event types and AU-12's component list (OS, container and application audit are components) are SSP parameters a human compares this output against, and AU-09's protection from unauthorized access and deletion needs the log bucket's policy, Object Lock and MFA-delete posture, which is not collected here.

## References

- {"title":"AWS Config managed rule: cloudtrail-enabled (CLOUD_TRAIL_ENABLED)","url":"https://docs.aws.amazon.com/config/latest/developerguide/cloudtrail-enabled.html"}
- {"title":"AWS Config managed rule: multi-region-cloudtrail-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/multi-region-cloudtrail-enabled.html"}
- {"title":"AWS Config managed rule: cloud-trail-log-file-validation-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/cloud-trail-log-file-validation-enabled.html"}
- {"title":"AWS Config managed rule: cloud-trail-encryption-enabled","url":"https://docs.aws.amazon.com/config/latest/developerguide/cloud-trail-encryption-enabled.html"}