Trail status: validation on, multi-region on, and the regions and accounts it covers.
Workflows · Audit logging
Turn on log file validation and read the trail back.
Close CC7.2: turn on CloudTrail log file validation and multi-region coverage under written policy, read the trail back, and keep the receipt. Deixic never deletes or shortens a log.
Example workflow. Execution requires a configured tool with provider permissions for this action; see the connection’s operation reference or bring your company tool to the demo.
Agent request
Enable log file validation and multi-region coverage on the organization trail
A trail that skips a region or accepts altered files keeps CC7.2 failing; a change that adds log categories adds storage cost.
- Identity
- logging-agent · Security engineering
- Target
- aws/organization-trail
- Cost
- Recorded agent cost
- Evidence
- Current trail status, regions covered, and retention against policy
SOC 2 CC7.2
Low-risk: runs within written policy.
The trail configuration before and after, the regions and accounts covered, retention against the policy section, and the re-run of the CC7.2 test.
Policy decision
Log validation and longer retention run within written policy. Log categories that add storage cost require the Security owner.
Security owner
The action waits until this owner approves or denies it.
Tool call resumes
AWS applies the trail settings, Deixic reads the trail back, and the receipt attaches to the CC7.2 test.
Tool call stays blocked
The trail stays as it is and the cost-bearing log categories go to the Security owner.
Execution order
The agent request stops before the connected tool runs.
- 01Logging agent requests the trail change
- 02Deixic checks the trail, retention, cost, and policy
- 03The change runs within policy, or the Security owner decides
- 04Connected AWS account returns the trail result
- 05Deixic reads the trail back and attaches the receipt to CC7.2
Activity history keeps the request, decision, cost, and result.
Keep the procedure for the next request.
Keep the policy and decision history, save the steps and evidence as a skill, and test changes on real sessions; an approval stays specific to its request.