Verification
Static-verifiedPassed: validated and lint-clean (provider-schema-validated for AWS/Azure/GCP; Terraform-language lint elsewhere).
Conformance
- Static validation (fmt · validate · tflint)
- Security scan pending (Checkov)
- Plan tests (mocked: validation rules · outputs)
Provenance
- SHA-256 checksum
- Signature (pending)
Functional
- Live test pending (no cloud run yet)
Last verified 2026-09-12 · how we verify
Use it from the registry
terraform · opentofumodule "cloudtrail" {
source = "www.iac-bazaar.com/iac-bazaar/aws-cloudtrail/aws"
version = "1.0.0"
}Needs a registry token from /account/tokens. The module itself is free; the account is what identifies you. Full setup: registry docs.
Inputs & outputs
Create a free account to read this module's contract
The declared contract - every input name, type, default and description, plus every output - is shown to signed-in accounts, not to anonymous visitors.
A free account sees the contract of every module in the catalogue. There is no subscription and nothing to buy - the modules are free to download, and they run under Vizier.
Documentation
aws-cloudtrail
CloudTrail with a hardened destination bucket, log file validation, optional
KMS encryption, optional CloudWatch Logs delivery and opt-in data events. Works
with Terraform and OpenTofu (>= 1.6), AWS provider >= 6.0, < 7.0.
Secure defaults:
- Log file validation is always on and has no switch. Without it CloudTrail writes objects and nothing proves they are the ones it wrote; the digest files are what let you demonstrate a gap or a modification afterwards
- Multi-region by default: a single-region trail records nothing about the regions an attacker gets to choose instead
- The bucket blocks public access, versions objects, encrypts at rest, denies
non-TLS access, and is not
force_destroy- an audit trail that the same mistake can delete is not an audit trail - The bucket policy pins
aws:SourceArnto this trail, so another account that knows the bucket name cannot write into it - Data events are opt-in and validated: they bill per event, and S3 object reads on a busy bucket can dwarf the management events
Verification
Static validation runs tofu fmt, init, validate, tflint and checkov.
This module has not yet had a live test, so it is published as statically
validated with its live test pending and does not carry the live-tested mark.
Usage code & full reference need an account
The complete copy-paste usage, the full input/output reference, and operational notes are free with an account - shown here and bundled in the download. Sign in and this section fills in.
- Usage
- What the security scan reports, and what it means
Related modules
aws-cloudwatch
A self-contained CloudWatch observability bundle - an encrypted log group with retention, a metric alarm, and a dashboard - that stands up from just a name and points at any real metric.
aws-security-lake
Organization security logs normalised to OCSF in S3, with the storage-class transitions that decide what it costs, optional replication, and subscribers whose external id is validated as the confused-deputy guard it is.