{ "api_version": "1", "kind": "dse_post", "self": "https://update.dsesecurity.com/api/v1/posts/run-cloudtrail-integrity-validation-instead-of-only-collecting-digest-files/", "item": { "id": "https://update.dsesecurity.com/updates/run-cloudtrail-integrity-validation-instead-of-only-collecting-digest-files/", "slug": "run-cloudtrail-integrity-validation-instead-of-only-collecting-digest-files", "url": "https://update.dsesecurity.com/updates/run-cloudtrail-integrity-validation-instead-of-only-collecting-digest-files/", "alternate_urls": { "markdown": "https://update.dsesecurity.com/updates/run-cloudtrail-integrity-validation-instead-of-only-collecting-digest-files.md", "json": "https://update.dsesecurity.com/api/v1/posts/run-cloudtrail-integrity-validation-instead-of-only-collecting-digest-files/" }, "title": "Run CloudTrail integrity validation instead of only collecting digest files", "summary": "Enabling digest delivery and validating retained logs are separate operations.", "format": { "slug": "guide", "name": "Guide" }, "priority": { "slug": "info", "name": "Information" }, "featured": false, "image": { "theme": "cyber-defense", "label": "Cyber defense", "alt": "Layered glass and metal cyber-defense structure with controlled blue and gold signal paths.", "card_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-card.webp?v=1.8.20", "hero_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-hero.webp?v=1.8.20", "social_url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 2400, "height": 1350 }, "topics": [ { "slug": "cybersecurity", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "slug": "it", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "author": { "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team", "type": "Organization" }, "publisher": { "name": "Detection Systems & Engineering", "url": "https://dsesecurity.com/" }, "published_at": "2026-10-20T18:13:42+00:00", "modified_at": "2026-10-20T18:34:29+00:00", "reviewed_on": "2026-10-20", "reading_minutes": 2, "word_count": 258, "potentially_affected": "This concerns evidence of CloudTrail file integrity after delivery, rather than proof that every desired event was selected for logging.", "dse_recommendation": "DSE recommends assigning an owner to run validation over defined investigation or retention periods.", "primary_source": { "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html", "published_on": null, "authority": "docs.aws.amazon.com" }, "publishing_principles": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usage_info": "https://update.dsesecurity.com/usage/", "copyright_notice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "content_html": "

Enabling digest delivery and validating retained logs are separate operations.

\n

Source facts

\n

When CloudTrail log integrity validation is enabled, it delivers signed digest files containing log-file hashes. AWS explicitly states that enabling this feature does not validate the files. The AWS CLI validates logs at their original delivery location; moved logs require an appropriate custom validation approach.

\n

Source: AWS Documentation.

\n

Applicability

\n

This concerns evidence of CloudTrail file integrity after delivery, rather than proof that every desired event was selected for logging.

\n

DSE recommendation

\n

DSE recommends assigning an owner to run validation over defined investigation or retention periods. Preserve the log and digest relationship and document the original delivery path before moving files. Retain validation results with the covered dates and locations. Keep event coverage review separate from integrity validation so a successful file check is not used to imply that unselected activity was recorded. Define how failures, missing files and inaccessible locations are escalated to the audit owner. Define the precise interval a validation record is meant to cover, and require the reviewer to distinguish a failed check from an interval that was never checked. Keep access to the evidence location part of the procedure rather than assuming the investigator already has it.

\n

Verification

\n

Proposed verification: validate an approved test interval at the original delivery location and inspect the reported results. In an isolated copy, rehearse how missing or altered evidence would be reported by the chosen procedure. Record the actual coverage and outcome without claiming that digest presence alone proves validation.

\n

Official reference

\n

AWS Documentation. Reviewed October 20, 2026.

", "content_text": "Enabling digest delivery and validating retained logs are separate operations.\nSource facts\nWhen CloudTrail log integrity validation is enabled, it delivers signed digest files containing log-file hashes. AWS explicitly states that enabling this feature does not validate the files. The AWS CLI validates logs at their original delivery location; moved logs require an appropriate custom validation approach.\nSource: AWS Documentation.\nApplicability\nThis concerns evidence of CloudTrail file integrity after delivery, rather than proof that every desired event was selected for logging.\nDSE recommendation\nDSE recommends assigning an owner to run validation over defined investigation or retention periods. Preserve the log and digest relationship and document the original delivery path before moving files. Retain validation results with the covered dates and locations. Keep event coverage review separate from integrity validation so a successful file check is not used to imply that unselected activity was recorded. Define how failures, missing files and inaccessible locations are escalated to the audit owner. Define the precise interval a validation record is meant to cover, and require the reviewer to distinguish a failed check from an interval that was never checked. Keep access to the evidence location part of the procedure rather than assuming the investigator already has it.\nVerification\nProposed verification: validate an approved test interval at the original delivery location and inspect the reported results. In an isolated copy, rehearse how missing or altered evidence would be reported by the chosen procedure. Record the actual coverage and outcome without claiming that digest presence alone proves validation.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "content_markdown": "Enabling digest delivery and validating retained logs are separate operations.\n\n## Source facts\n\nWhen CloudTrail log integrity validation is enabled, it delivers signed digest files containing log-file hashes. AWS explicitly states that enabling this feature does not validate the files. The AWS CLI validates logs at their original delivery location; moved logs require an appropriate custom validation approach.\n\nSource: [AWS Documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html).\n\n## Applicability\n\nThis concerns evidence of CloudTrail file integrity after delivery, rather than proof that every desired event was selected for logging.\n\n## DSE recommendation\n\nDSE recommends assigning an owner to run validation over defined investigation or retention periods. Preserve the log and digest relationship and document the original delivery path before moving files. Retain validation results with the covered dates and locations. Keep event coverage review separate from integrity validation so a successful file check is not used to imply that unselected activity was recorded. Define how failures, missing files and inaccessible locations are escalated to the audit owner. Define the precise interval a validation record is meant to cover, and require the reviewer to distinguish a failed check from an interval that was never checked. Keep access to the evidence location part of the procedure rather than assuming the investigator already has it.\n\n## Verification\n\nProposed verification: validate an approved test interval at the original delivery location and inspect the reported results. In an isolated copy, rehearse how missing or altered evidence would be reported by the chosen procedure. Record the actual coverage and outcome without claiming that digest presence alone proves validation.\n\n## Official reference\n\n[AWS Documentation](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html). Reviewed October 20, 2026." }, "json_ld": { "@context": "https://schema.org", "@graph": [ { "@type": "Organization", "@id": "https://dsesecurity.com/#organization", "name": "Detection Systems & Engineering", "alternateName": "DSE Security", "url": "https://dsesecurity.com/", "logo": { "@type": "ImageObject", "url": "https://update.dsesecurity.com/assets/dse-logo-20260812.png?v=1.8.20" } }, { "@type": "Organization", "@id": "https://update.dsesecurity.com/#editorial-team", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/", "parentOrganization": { "@id": "https://dsesecurity.com/#organization" } }, { "@type": "WebSite", "@id": "https://update.dsesecurity.com/#website", "name": "DSE Updates", "alternateName": "DSE Security Knowledge Hub", "url": "https://update.dsesecurity.com/", "inLanguage": "en-US", "publisher": { "@id": "https://dsesecurity.com/#organization" }, "potentialAction": { "@type": "SearchAction", "target": { "@type": "EntryPoint", "urlTemplate": "https://update.dsesecurity.com/?q={search_term_string}" }, "query-input": "required name=search_term_string" } }, { "@type": "WebPage", "@id": "https://update.dsesecurity.com/updates/run-cloudtrail-integrity-validation-instead-of-only-collecting-digest-files/", "url": "https://update.dsesecurity.com/updates/run-cloudtrail-integrity-validation-instead-of-only-collecting-digest-files/", "isPartOf": { "@id": "https://update.dsesecurity.com/#website" }, "lastReviewed": "2026-10-20" }, { "@type": "BreadcrumbList", "@id": "https://update.dsesecurity.com/updates/run-cloudtrail-integrity-validation-instead-of-only-collecting-digest-files/#breadcrumbs", "itemListElement": [ { "@type": "ListItem", "position": 1, "name": "DSE Updates", "item": "https://update.dsesecurity.com/" }, { "@type": "ListItem", "position": 2, "name": "Cybersecurity", "item": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "ListItem", "position": 3, "name": "Run CloudTrail integrity validation instead of only collecting digest files", "item": "https://update.dsesecurity.com/updates/run-cloudtrail-integrity-validation-instead-of-only-collecting-digest-files/" } ] }, { "@type": [ "Article", "TechArticle" ], "@id": "https://update.dsesecurity.com/updates/run-cloudtrail-integrity-validation-instead-of-only-collecting-digest-files/#article", "identifier": "https://update.dsesecurity.com/updates/run-cloudtrail-integrity-validation-instead-of-only-collecting-digest-files/", "url": "https://update.dsesecurity.com/updates/run-cloudtrail-integrity-validation-instead-of-only-collecting-digest-files/", "headline": "Run CloudTrail integrity validation instead of only collecting digest files", "description": "Enabling digest delivery and validating retained logs are separate operations.", "abstract": "Enabling digest delivery and validating retained logs are separate operations.", "articleBody": "Enabling digest delivery and validating retained logs are separate operations.\nSource facts\nWhen CloudTrail log integrity validation is enabled, it delivers signed digest files containing log-file hashes. AWS explicitly states that enabling this feature does not validate the files. The AWS CLI validates logs at their original delivery location; moved logs require an appropriate custom validation approach.\nSource: AWS Documentation.\nApplicability\nThis concerns evidence of CloudTrail file integrity after delivery, rather than proof that every desired event was selected for logging.\nDSE recommendation\nDSE recommends assigning an owner to run validation over defined investigation or retention periods. Preserve the log and digest relationship and document the original delivery path before moving files. Retain validation results with the covered dates and locations. Keep event coverage review separate from integrity validation so a successful file check is not used to imply that unselected activity was recorded. Define how failures, missing files and inaccessible locations are escalated to the audit owner. Define the precise interval a validation record is meant to cover, and require the reviewer to distinguish a failed check from an interval that was never checked. Keep access to the evidence location part of the procedure rather than assuming the investigator already has it.\nVerification\nProposed verification: validate an approved test interval at the original delivery location and inspect the reported results. In an isolated copy, rehearse how missing or altered evidence would be reported by the chosen procedure. Record the actual coverage and outcome without claiming that digest presence alone proves validation.\nOfficial reference\nAWS Documentation. Reviewed October 20, 2026.", "datePublished": "2026-10-20T18:13:42+00:00", "dateModified": "2026-10-20T18:34:29+00:00", "mainEntityOfPage": { "@id": "https://update.dsesecurity.com/updates/run-cloudtrail-integrity-validation-instead-of-only-collecting-digest-files/" }, "inLanguage": "en-US", "isAccessibleForFree": true, "author": { "@type": "Organization", "name": "DSE Security Editorial Team", "url": "https://update.dsesecurity.com/#editorial-team" }, "publisher": { "@id": "https://dsesecurity.com/#organization" }, "image": { "@type": "ImageObject", "@id": "https://update.dsesecurity.com/updates/run-cloudtrail-integrity-validation-instead-of-only-collecting-digest-files/#primaryimage", "url": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "contentUrl": "https://update.dsesecurity.com/assets/editorial/cyber-defense-social-v2.jpg?v=1.8.20", "width": 1200, "height": 630, "caption": "Run CloudTrail integrity validation instead of only collecting digest files" }, "articleSection": [ "Cybersecurity", "IT" ], "keywords": [ "Cybersecurity", "IT", "Guide", "Information priority" ], "genre": "Guide", "about": [ { "@type": "Thing", "name": "Cybersecurity", "url": "https://update.dsesecurity.com/topic/cybersecurity/" }, { "@type": "Thing", "name": "IT", "url": "https://update.dsesecurity.com/topic/it/" } ], "wordCount": 258, "timeRequired": "PT2M", "publishingPrinciples": "https://update.dsesecurity.com/updates/dse-updates-editorial-methodology/", "usageInfo": "https://update.dsesecurity.com/usage/", "copyrightHolder": { "@id": "https://dsesecurity.com/#organization" }, "copyrightNotice": "Copyright © 2026 Detection Systems & Engineering. All rights reserved.", "citation": { "@type": "CreativeWork", "name": "AWS Documentation", "url": "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-validation-intro.html" } } ] } }