Check CloudTrail Is Enabled and Logging in Every AWS Region

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ReadTrailCoverage",
      "Effect": "Allow",
      "Action": [
        "ec2:DescribeRegions",
        "cloudtrail:DescribeTrails",
        "cloudtrail:GetTrailStatus",
        "cloudtrail:GetEventSelectors"
      ],
      "Resource": "*"
    }
  ]
}

// check-cloudtrail-enabled-in-all-regions.ts
// Reports, for every enabled Region, whether at least one CloudTrail trail is logging there and
// records all read and write management events. Also lists each trail's multi-Region, organization
// and log file validation settings and its latest S3 delivery error. Read-only: it changes nothing.
// Usage: npx tsx check-cloudtrail-enabled-in-all-regions.ts [--regions=us-east-1,eu-west-1]
import { EC2Client, DescribeRegionsCommand } from "@aws-sdk/client-ec2";
import {
  CloudTrailClient,
  DescribeTrailsCommand,
  GetEventSelectorsCommand,
  GetTrailStatusCommand,
  type GetEventSelectorsCommandOutput,
} from "@aws-sdk/client-cloudtrail";

const regionArg = process.argv.slice(2).find((a) => a.startsWith("--regions="))?.split("=")[1];

type Mgmt = "all" | "partial" | "none" | "unknown";
interface TrailInfo { arn: string; name: string; home: string; multi: boolean; org: boolean; validation: boolean; mgmt: Mgmt }
interface RegionRow { Region: string; Trails: string; Logging: string; Management: string; Verdict: string }
interface TrailRow { Trail: string; Home: string; MultiRegion: boolean; Org: boolean; Validation: boolean; Management: Mgmt; LastDeliveryError: string }

async function listRegions(): Promise<string[]> {
  if (regionArg) return regionArg.split(",").map((r) => r.trim()).filter(Boolean);
  const out = await new EC2Client({}).send(new DescribeRegionsCommand({})); // enabled Regions only
  return (out.Regions ?? []).map((r) => r.RegionName ?? "").filter(Boolean).sort();
}

// "all" = read and write management events with no excluded event sources.
function managementCoverage(sel: GetEventSelectorsCommandOutput): Mgmt {
  let found: Mgmt = "none";
  if (sel.AdvancedEventSelectors?.length) {
    for (const s of sel.AdvancedEventSelectors) {
      const fields = s.FieldSelectors ?? [];
      if (!fields.find((f) => f.Field === "eventCategory")?.Equals?.includes("Management")) continue;
      const readOnlyFilter = fields.some((f) => f.Field === "readOnly");
      const excludesSources = fields.some((f) => f.Field === "eventSource" && (f.NotEquals?.length ?? 0) > 0);
      if (!readOnlyFilter && !excludesSources) return "all";
      found = "partial";
    }
    return found;
  }
  for (const s of sel.EventSelectors ?? []) {
    if (!s.IncludeManagementEvents) continue;
    if (s.ReadWriteType === "All" && !(s.ExcludeManagementEventSources?.length)) return "all";
    found = "partial";
  }
  return found;
}

const selectorCache = new Map<string, Mgmt>();
async function selectorsFor(arn: string, home: string): Promise<Mgmt> {
  const cached = selectorCache.get(arn);
  if (cached) return cached;
  let result: Mgmt;
  try {
    // Event selectors are read in the trail's home Region, by ARN (required for organization trails).
    result = managementCoverage(await new CloudTrailClient({ region: home }).send(new GetEventSelectorsCommand({ TrailName: arn })));
  } catch {
    result = "unknown";
  }
  selectorCache.set(arn, result);
  return result;
}

async function main(): Promise<void> {
  const regionRows: RegionRow[] = [];
  const trails = new Map<string, TrailInfo & { lastError: string }>();

  for (const region of await listRegions()) {
    const ct = new CloudTrailClient({ region });
    try {
      // includeShadowTrails returns multi-Region and organization trails that were created elsewhere.
      const list = (await ct.send(new DescribeTrailsCommand({ includeShadowTrails: true }))).trailList ?? [];
      const names: string[] = [];
      let logging = false;
      let fullMgmt = false;
      let unreadable = false;
      for (const t of list) {
        const arn = t.TrailARN ?? "";
        const home = t.HomeRegion ?? region;
        const status = await ct.send(new GetTrailStatusCommand({ Name: arn })); // status as seen in this Region
        const mgmt = await selectorsFor(arn, home);
        names.push(t.Name ?? arn);
        if (status.IsLogging) {
          logging = true;
          if (mgmt === "all") fullMgmt = true;
          if (mgmt === "unknown") unreadable = true;
        }
        if (!trails.has(arn)) {
          trails.set(arn, {
            arn, name: t.Name ?? "", home, mgmt,
            multi: t.IsMultiRegionTrail === true,
            org: t.IsOrganizationTrail === true,
            validation: t.LogFileValidationEnabled === true,
            lastError: status.LatestDeliveryError ?? "",
          });
        }
      }
      const verdict = !list.length ? "NO TRAIL"
        : !logging ? "TRAILS EXIST BUT NONE LOGGING"
        : fullMgmt ? "ok"
        : unreadable ? "logging; check selectors in the home account"
        : "logging, but not all management events";
      const management = fullMgmt ? "read+write" : unreadable ? "unknown" : "incomplete";
      regionRows.push({ Region: region, Trails: names.join(", ") || "-", Logging: logging ? "yes" : "NO", Management: management, Verdict: verdict });
    } catch (err) {
      regionRows.push({ Region: region, Trails: "?", Logging: "?", Management: "?", Verdict: `error: ${err instanceof Error ? err.name : String(err)}` });
    }
  }

  console.table(regionRows);
  const trailRows: TrailRow[] = [...trails.values()].map((t) => ({
    Trail: t.name, Home: t.home, MultiRegion: t.multi, Org: t.org, Validation: t.validation, Management: t.mgmt, LastDeliveryError: t.lastError || "-",
  }));
  console.table(trailRows);

  const gaps = regionRows.filter((r) => r.Verdict !== "ok");
  const noValidation = trailRows.filter((t) => !t.Validation).length;
  console.log(`${regionRows.length} Regions checked; ${gaps.length} without a logging trail that records all management events.`);
  if (noValidation) console.log(`${noValidation} trail(s) without log file validation.`);
  console.log("Read-only: nothing was changed.");
  if (gaps.length) process.exitCode = 2; // lets a CI job or cron wrapper fail on a gap
}

main().catch((err) => {
  console.error(err);
  process.exit(1);
});

npm install @aws-sdk/client-cloudtrail @aws-sdk/client-ec2
npm install --save-dev tsx typescript

# Every enabled Region
AWS_PROFILE=readonly npx tsx check-cloudtrail-enabled-in-all-regions.ts

# A few Regions, failing the shell step if any has a gap
AWS_PROFILE=readonly npx tsx check-cloudtrail-enabled-in-all-regions.ts --regions=us-east-1,eu-west-1 || echo "CloudTrail gap found"

┌─────────┬──────────────────┬────────────────┬─────────┬──────────────┬──────────────────────────────────────────┐
│ (index) │ Region           │ Trails         │ Logging │ Management   │ Verdict                                  │
├─────────┼──────────────────┼────────────────┼─────────┼──────────────┼──────────────────────────────────────────┤
│ 0       │ 'ap-southeast-2' │ '-'            │ 'NO'    │ 'incomplete' │ 'NO TRAIL'                               │
│ 1       │ 'eu-west-1'      │ 'eu-app-trail' │ 'yes'   │ 'incomplete' │ 'logging, but not all management events' │
│ 2       │ 'us-east-1'      │ 'main-trail'   │ 'yes'   │ 'read+write' │ 'ok'                                     │
│ 3       │ 'us-west-2'      │ '-'            │ 'NO'    │ 'incomplete' │ 'NO TRAIL'                               │
└─────────┴──────────────────┴────────────────┴─────────┴──────────────┴──────────────────────────────────────────┘
┌─────────┬────────────────┬─────────────┬─────────────┬───────┬────────────┬────────────┬───────────────────┐
│ (index) │ Trail          │ Home        │ MultiRegion │ Org   │ Validation │ Management │ LastDeliveryError │
├─────────┼────────────────┼─────────────┼─────────────┼───────┼────────────┼────────────┼───────────────────┤
│ 0       │ 'main-trail'   │ 'us-east-1' │ false       │ false │ true       │ 'all'      │ '-'               │
│ 1       │ 'eu-app-trail' │ 'eu-west-1' │ false       │ false │ false      │ 'partial'  │ 'AccessDenied'    │
└─────────┴────────────────┴─────────────┴─────────────┴───────┴────────────┴────────────┴───────────────────┘
4 Regions checked; 3 without a logging trail that records all management events.
1 trail(s) without log file validation.
Read-only: nothing was changed.