Run CloudTrail integrity validation instead of only collecting digest files

Enabling digest delivery and validating retained logs are separate operations.

Source facts

When CloudTrail log integrity validation is enabled, it delivers signed digest files containing log-file hashes. AWS explicitly states that enabling this feature does not validate the files. The AWS CLI validates logs at their original delivery location; moved logs require an appropriate custom validation approach.

Source: AWS Documentation.

Applicability

This concerns evidence of CloudTrail file integrity after delivery, rather than proof that every desired event was selected for logging.

DSE recommendation

DSE recommends assigning an owner to run validation over defined investigation or retention periods. Preserve the log and digest relationship and document the original delivery path before moving files. Retain validation results with the covered dates and locations. Keep event coverage review separate from integrity validation so a successful file check is not used to imply that unselected activity was recorded. Define how failures, missing files and inaccessible locations are escalated to the audit owner. Define the precise interval a validation record is meant to cover, and require the reviewer to distinguish a failed check from an interval that was never checked. Keep access to the evidence location part of the procedure rather than assuming the investigator already has it.

Verification

Proposed verification: validate an approved test interval at the original delivery location and inspect the reported results. In an isolated copy, rehearse how missing or altered evidence would be reported by the chosen procedure. Record the actual coverage and outcome without claiming that digest presence alone proves validation.

Official reference

AWS Documentation. Reviewed October 20, 2026.