Avoid IAM Policies Granting Full CloudTrail Access
Why this matters
Granting full access to AWS CloudTrail through IAM policies (e.g., via cloudtrail:*) can compromise the integrity of your audit trail. Overly permissive access allows users to:
Disable or delete audit logs
Conceal unauthorized activity
Bypass critical forensic capabilities in the event of a breach
To preserve accountability, restrict access to CloudTrail operations, especially write actions, and limit permissions to specific use cases such as read-only log analysis.
What this check does
This Auto Check evaluates your IAM policies and flags any that:
Include the wildcard permission cloudtrail:*
Allow sensitive actions like DeleteTrail, StopLogging, or UpdateTrail
Lack sufficient constraints on affected resources
The check fails if policies with unrestricted CloudTrail access are attached to any identities (users, groups, or roles).
How to fix it
Identify and replace IAM policies that grant unrestricted access to CloudTrail.
From the AWS Console
Log in to the IAM Console.
Go to Policies and search for entries containing cloudtrail:*.
Review the policy for dangerous actions like DeleteTrail, StopLogging, or overly broad permissions.
Detach the policy from any attached identities.
If not required, delete the policy.
Create a new policy that:
Grants only the needed actions (e.g., cloudtrail:DescribeTrails, cloudtrail:LookupEvents)
Applies to specific trails or resources
Enforces read-only access where appropriate
Using AWS CLI
# Identify affected entities
aws iam list-entities-for-policy --policy-arn <policy_arn>
# Detach from a user
aws iam detach-user-policy --user-name <user_name> --policy-arn <policy_arn>
# Detach from a group
aws iam detach-group-policy --group-name <group_name> --policy-arn <policy_arn>
# Detach from a role
aws iam detach-role-policy --role-name <role_name> --policy-arn <policy_arn>
Exceptions
If specific roles require temporary CloudTrail access (e.g., for diagnostics or audits):
Grant access through tightly scoped break-glass roles
Enforce conditions such as MFA authentication or limited session duration
Monitor usage through CloudTrail itself to detect suspicious actions