AWS CloudTrail trail | Mondoo Docs

aws.cloudtrail.trail MQL resource for querying AWS infrastructure with cnquery and cnspec.

AWSPrivate Resource

AWS CloudTrail trail

Min version: 5.15.0Defaults: name region

Relationships

AWS

5 resources · 6 relationships·Click to select, expand fields to see properties.

Field	Type	Description
`arn`required	string	ARN of the trail
`cloudWatchLogsLogGroupArn`required	string	Group for logs endpoint to assume when writing to log group
`cloudWatchLogsRoleArn`required	string	Role for logs endpoint to assume when writing to log group
`eventSelectors`	[]dict	Settings for the trail's configured event selectors
`includeGlobalServiceEvents`required	int	Whether API calls from global services are included
`isMultiRegionTrail`required	int	Whether the trail exists in multiple regions (false if single region)
`isOrganizationTrail`required	int	Whether the trail is an organization trail (logs events for management and member accounts of the organization)
`kmsKey`	aws.kms.key	KMS key used to encrypt the logs
`logFileValidationEnabled`required	int	Whether log file validation is enabled
`logGroup`	aws.cloudwatch.loggroup	Log group where trail files are delivered
`name`required	string	Name of the trail
`region`required	string	Region in which the trail was created (home region)
`s3bucket`	aws.s3.bucket	S3 bucket where trail files are delivered
`snsTopicARN`required	string	ARN of the SNS topic that the trail uses to send notifications
`status`	dict	JSON list of information about the trail