From 369716b76e5e8a0e0c6d4594c3332a47149bc2c7 Mon Sep 17 00:00:00 2001 From: jeffreynglw <39067350+jeffreynglw@users.noreply.github.com> Date: Mon, 11 Nov 2024 15:03:42 -0800 Subject: [PATCH] fix(LINK-3391): Update policy_compliance.md --- docs/resources/policy_compliance.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/docs/resources/policy_compliance.md b/docs/resources/policy_compliance.md index a486b002..6b6dc5f6 100644 --- a/docs/resources/policy_compliance.md +++ b/docs/resources/policy_compliance.md @@ -48,7 +48,7 @@ resource "lacework_policy_compliance" "example" { severity = "High" description = "CloudTrail log file validation creates a digitally signed digest\nfile containing a hash of each log that CloudTrail writes to S3. These digest\nfiles can be used to determine whether a log file was changed, deleted, or unchanged\nafter CloudTrail delivered the log. It is recommended that file validation be\nenabled on all CloudTrails." remediation = "Perform the following to enable log file validation on a given trail:\nFrom Console:\n1. Sign in to the AWS Management Console and open the IAM console at (https://console.aws.amazon.com/cloudtrail)\n2. Click on Trails on the left navigation pane\n3. Click on target trail\n4. Within the S3 section click on the edit icon (pencil)\n5. Click Advanced\n6. Click on the Yes radio button in section Enable log file validation\n7. Click Save\nFrom Command Line:\naws cloudtrail update-trail --name --enable-log-file-validation\nNote that periodic validation of logs using these digests can be performed by running the following command:\naws cloudtrail validate-logs --trail-arn --start-time --end-time " - tags = ["security:compliance", "domain:AWS", "subdomain:Configuration"] + tags = ["security:compliance"] alerting_enabled = false } ```