---
title: cloudtrail
---

# cloudtrail

## Checks


- [enable-all-regions](enable-all-regions) Cloudtrail should be enabled in all regions regardless of where your AWS resources are generally homed

- [enable-at-rest-encryption](enable-at-rest-encryption) Cloudtrail should be encrypted at rest to secure access to sensitive trail data

- [enable-log-validation](enable-log-validation) Cloudtrail log validation should be enabled to prevent tampering of log data



