attack_technique: T1562.008
display_name: 'Impair Defenses: Disable Cloud Logs'
atomic_tests:
- name: AWS CloudTrail Changes
  auto_generated_guid: 9c10dc6b-20bd-403a-8e67-50ef7d07ed4e
  description: |
    Creates a new cloudTrail in AWS, Upon successful creation it will Update,Stop and Delete the cloudTrail
  supported_platforms:
  - iaas:aws
  input_arguments:
    cloudtrail_name:
      description: Name of the cloudTrail
      type: String
      default: "redatomictesttrail"
    s3_bucket_name:
      description: Name of the bucket
      type: String
      default: "redatomic-test"
    region:
      description: Name of the region
      type: String
      default: "us-east-1"
  dependencies:
    - description: |
        Check if ~/.aws/credentials file has a default stanza is configured
      prereq_command: |
        cat ~/.aws/credentials | grep "default"
        aws s3api create-bucket --bucket #{s3_bucket_name} --region #{region}
        aws s3api put-bucket-policy --bucket #{s3_bucket_name} --policy file://$PathToAtomicsFolder/T1562.008/src/policy.json
      get_prereq_command: |
        echo Please install the aws-cli and configure your AWS defult profile using: aws configure
  executor:
    command: |
       aws cloudtrail create-trail --name #{cloudtrail_name} --s3-bucket-name #{s3_bucket_name} --region #{region}
       aws cloudtrail update-trail --name #{cloudtrail_name} --s3-bucket-name #{s3_bucket_name}  --is-multi-region-trail --region #{region}
       aws cloudtrail stop-logging --name #{cloudtrail_name} --region #{region}
       aws cloudtrail delete-trail --name #{cloudtrail_name} --region #{region}
    cleanup_command: |   
       aws s3 rb s3://#{s3_bucket_name} --force 
    name: sh
    elevation_required: false
