Topic starter
01/08/2026 10:50 pm
TL;DR: Attackers can impair AWS CloudTrail without using StopLogging or DeleteTrail by narrowing selectors, halting ingestion, disabling Insights, removing resource policies, and breaking federation, according to Abstract Security’s research. The lesson is that logging governance must treat configuration abuse as an active attack path, not a maintenance event.
Editorial analysis by NHI Mgmt Group, based on content published by Abstract Security: “Disabling CloudTrail Without StopLogging or DeleteTrail”.
Key questions
Q: What breaks when CloudTrail selectors are narrowed instead of logging being stopped?
A: The trail can remain visibly active while key management events, write operations, or selected data sources fall outside recording scope.
Q: Why do CloudTrail ingestion and federation changes create investigation risk?
A: Ingestion stoppage cuts off new evidence at the lake layer, while federation removal breaks the common query path responders use to search that evidence.
Q: What are the signs that CloudTrail logging governance is failing?
A: Look for reduced event scope, empty Insight selectors, ingestion status changes, disabled federation, deleted resource policies, or delegated admin removal.
Practitioner guidance
- Lock down CloudTrail management permissions Restrict who can call PutEventSelectors, StopEventDataStoreIngestion, DisableFederation, DeleteResourcePolicy, and related administrative APIs.
- Alert on log-scope reduction as an incident Create detections for management-event exclusion, read-only selector changes, empty InsightSelectors, removed data resources, and any decrease in CloudTrail Lake ingestion or federation.
- Correlate chained CloudTrail changes Look for UpdateEventDataStore, DisableFederation, DeleteEventDataStore, and PutEventSelectors from the same principal or account in a short sequence.
Bottom line: Attackers do not need StopLogging or DeleteTrail to blind CloudTrail, because selector, ingestion, federation, and policy changes can reduce evidence while the service still appears active.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
01/08/2026 10:58 pm
CloudTrail integrity is a control-plane governance problem, not a logging checkbox. The article shows that attackers do not need the obvious stop or delete actions to suppress evidence. They can shape the scope, delivery, and queryability of logs through ordinary AWS APIs, which means logging must be governed as an active privilege boundary.
A question worth separating out:
Q: How should organisations govern CloudTrail access in AWS Organizations?
A: Centralise control over trail configuration, federation, and delegated administration in a very small set of privileged identities, then monitor every change to those roles and resource policies. Organisation-wide logging only works when the identities that manage it are tightly controlled and independently observed.
👉 Read our full editorial: CloudTrail blinding without StopLogging shows a logging governance gap