prowler-cloud 5.14.2__py3-none-any.whl → 5.15.0__py3-none-any.whl

prowler/providers/alibabacloud/models.py

@@ -0,0 +1,266 @@
+from datetime import datetime
+from typing import Optional
+
+from alibabacloud_actiontrail20200706.client import Client as ActionTrailClient
+from alibabacloud_cs20151215.client import Client as CSClient
+from alibabacloud_ecs20140526.client import Client as EcsClient
+from alibabacloud_oss20190517.client import Client as OssClient
+from alibabacloud_ram20150501.client import Client as RamClient
+from alibabacloud_rds20140815.client import Client as RdsClient
+from alibabacloud_sas20181203.client import Client as SasClient
+from alibabacloud_sls20201230.client import Client as SlsClient
+from alibabacloud_tea_openapi import models as open_api_models
+from alibabacloud_vpc20160428.client import Client as VpcClient
+from pydantic.v1 import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.providers.alibabacloud.config import (
+    ALIBABACLOUD_DEFAULT_REGION,
+    ALIBABACLOUD_SDK_CONNECT_TIMEOUT,
+    ALIBABACLOUD_SDK_READ_TIMEOUT,
+)
+from prowler.providers.common.models import ProviderOutputOptions
+
+
+class AlibabaCloudCallerIdentity(BaseModel):
+    """
+    AlibabaCloudCallerIdentity stores the caller identity information from STS GetCallerIdentity.
+
+    Attributes:
+        account_id: The Alibaba Cloud account ID
+        principal_id: The principal ID (user ID or root account ID)
+        arn: The ARN-like identifier for the identity
+        identity_type: The type of identity (e.g., "RamUser", "Root")
+    """
+
+    account_id: str
+    principal_id: str
+    arn: str
+    identity_type: str = ""
+
+
+class AlibabaCloudIdentityInfo(BaseModel):
+    """
+    AlibabaCloudIdentityInfo stores the Alibaba Cloud account identity information.
+
+    Attributes:
+        account_id: The Alibaba Cloud account ID
+        account_name: The Alibaba Cloud account name (if available)
+        user_id: The RAM user ID or root account ID
+        user_name: The RAM user name or "root" for root account
+        identity_arn: The ARN-like identifier for the identity
+        profile: The profile name used for authentication
+        profile_region: The default region from the profile
+        audited_regions: Set of regions to be audited
+        is_root: Whether this is the root account (True) or a RAM user (False)
+    """
+
+    account_id: str
+    account_name: str
+    user_id: str
+    user_name: str
+    identity_arn: str
+    profile: str
+    profile_region: str
+    audited_regions: set[str]
+    is_root: bool = False
+
+
+class AlibabaCloudCredentials(BaseModel):
+    """
+    AlibabaCloudCredentials stores the Alibaba Cloud credentials.
+
+    Attributes:
+        access_key_id: The Access Key ID
+        access_key_secret: The Access Key Secret
+        security_token: The Security Token (for STS temporary credentials)
+        expiration: The expiration time for temporary credentials
+    """
+
+    access_key_id: str
+    access_key_secret: str
+    security_token: Optional[str] = None
+    expiration: Optional[datetime] = None
+
+
+class AlibabaCloudAssumeRoleInfo(BaseModel):
+    """
+    AlibabaCloudAssumeRoleInfo stores the information for assuming a RAM role.
+
+    Attributes:
+        role_arn: The ARN of the role to assume
+        role_session_name: The session name for the assumed role
+        session_duration: The duration of the assumed role session (in seconds)
+        external_id: The external ID for role assumption
+        region: The region for STS endpoint
+    """
+
+    role_arn: str
+    role_session_name: str
+    session_duration: int
+    external_id: Optional[str] = None
+    region: str = "cn-hangzhou"
+
+
+class AlibabaCloudRegion(BaseModel):
+    """
+    AlibabaCloudRegion stores information about an Alibaba Cloud region.
+
+    Attributes:
+        region_id: The region identifier (e.g., cn-hangzhou, cn-shanghai)
+        region_name: The human-readable region name
+        region_endpoint: The API endpoint for the region
+    """
+
+    region_id: str
+    region_name: str
+    region_endpoint: Optional[str] = None
+
+
+class AlibabaCloudSession:
+    """
+    AlibabaCloudSession stores the Alibaba Cloud session and credentials.
+
+    This class provides methods to get credentials and create service clients.
+    """
+
+    def __init__(self, cred_client):
+        """
+        Initialize the Alibaba Cloud session.
+
+        Args:
+            cred_client: The Alibaba Cloud credentials client
+        """
+        self.cred_client = cred_client
+        self._credentials = None
+
+    def get_credentials(self):
+        """
+        Get the Alibaba Cloud credentials.
+
+        Returns:
+            AlibabaCloudCredentials object
+        """
+        if self._credentials is None:
+            cred = self.cred_client.get_credential()
+            self._credentials = AlibabaCloudCredentials(
+                access_key_id=cred.get_access_key_id(),
+                access_key_secret=cred.get_access_key_secret(),
+                security_token=cred.get_security_token(),
+            )
+        return self._credentials
+
+    def client(self, service: str, region: str = None):
+        """
+        Create a service client for the given service and region.
+
+        Args:
+            service: The service name (e.g., 'ram')
+            region: The region (optional, some services are global)
+
+        Returns:
+            A client instance for the specified service
+        """
+
+        # Get credentials
+        cred = self.get_credentials()
+
+        # Create client configuration with timeout settings
+        config = open_api_models.Config(
+            access_key_id=cred.access_key_id,
+            access_key_secret=cred.access_key_secret,
+            read_timeout=ALIBABACLOUD_SDK_READ_TIMEOUT
+            * 1000,  # Convert to milliseconds
+            connect_timeout=ALIBABACLOUD_SDK_CONNECT_TIMEOUT
+            * 1000,  # Convert to milliseconds
+        )
+        if cred.security_token:
+            config.security_token = cred.security_token
+
+        # Set endpoint based on service
+        if service == "ram":
+            config.endpoint = "ram.aliyuncs.com"
+            return RamClient(config)
+        elif service == "vpc":
+            # VPC endpoint is regional: vpc.{region}.aliyuncs.com
+            if region:
+                config.endpoint = f"vpc.{region}.aliyuncs.com"
+            else:
+                config.endpoint = f"vpc.{ALIBABACLOUD_DEFAULT_REGION}.aliyuncs.com"
+            return VpcClient(config)
+        elif service == "ecs":
+            # ECS endpoint is regional: ecs.{region}.aliyuncs.com
+            if region:
+                config.endpoint = f"ecs.{region}.aliyuncs.com"
+            else:
+                config.endpoint = f"ecs.{ALIBABACLOUD_DEFAULT_REGION}.aliyuncs.com"
+            return EcsClient(config)
+        elif service == "sas" or service == "securitycenter":
+            # SAS (Security Center) endpoint is regional: sas.{region}.aliyuncs.com
+            if region:
+                config.endpoint = f"sas.{region}.aliyuncs.com"
+            else:
+                config.endpoint = f"sas.{ALIBABACLOUD_DEFAULT_REGION}.aliyuncs.com"
+            return SasClient(config)
+        elif service == "oss":
+            if region:
+                config.endpoint = f"oss-{region}.aliyuncs.com"
+                config.region_id = region
+            else:
+                config.endpoint = f"oss-{ALIBABACLOUD_DEFAULT_REGION}.aliyuncs.com"
+                config.region_id = ALIBABACLOUD_DEFAULT_REGION
+            return OssClient(config)
+        elif service == "actiontrail":
+            # ActionTrail endpoint is regional: actiontrail.{region}.aliyuncs.com
+            if region:
+                config.endpoint = f"actiontrail.{region}.aliyuncs.com"
+            else:
+                config.endpoint = (
+                    f"actiontrail.{ALIBABACLOUD_DEFAULT_REGION}.aliyuncs.com"
+                )
+            return ActionTrailClient(config)
+        elif service == "cs":
+            if region:
+                config.endpoint = f"cs.{region}.aliyuncs.com"
+            else:
+                config.endpoint = f"cs.{ALIBABACLOUD_DEFAULT_REGION}.aliyuncs.com"
+            return CSClient(config)
+        elif service == "rds":
+            if region:
+                config.endpoint = f"rds.{region}.aliyuncs.com"
+            else:
+                config.endpoint = f"rds.{ALIBABACLOUD_DEFAULT_REGION}.aliyuncs.com"
+            return RdsClient(config)
+        elif service == "sls":
+            if region:
+                config.endpoint = f"{region}.log.aliyuncs.com"
+            else:
+                config.endpoint = f"{ALIBABACLOUD_DEFAULT_REGION}.log.aliyuncs.com"
+            return SlsClient(config)
+        else:
+            # For other services, implement as needed
+            logger.warning(f"Service {service} not yet implemented")
+            return None
+
+
+class AlibabaCloudOutputOptions(ProviderOutputOptions):
+    """
+    AlibabaCloudOutputOptions extends ProviderOutputOptions for Alibaba Cloud specific output options.
+    """
+
+    def __init__(self, arguments, bulk_checks_metadata, identity):
+        # Call parent class init
+        super().__init__(arguments, bulk_checks_metadata)
+
+        # Set default output filename if not provided
+        if (
+            not hasattr(arguments, "output_filename")
+            or arguments.output_filename is None
+        ):
+            from prowler.config.config import output_file_timestamp
+
+            self.output_filename = (
+                f"prowler-output-{identity.account_id}-{output_file_timestamp}"
+            )
+        else:
+            self.output_filename = arguments.output_filename

prowler/providers/alibabacloud/services/actiontrail/actiontrail_client.py

@@ -0,0 +1,6 @@
+from prowler.providers.alibabacloud.services.actiontrail.actiontrail_service import (
+    ActionTrail,
+)
+from prowler.providers.common.provider import Provider
+
+actiontrail_client = ActionTrail(Provider.get_global_provider())

prowler/providers/alibabacloud/services/actiontrail/actiontrail_multi_region_enabled/actiontrail_multi_region_enabled.metadata.json

@@ -0,0 +1,39 @@
+{
+  "Provider": "alibabacloud",
+  "CheckID": "actiontrail_multi_region_enabled",
+  "CheckTitle": "ActionTrail are configured to export copies of all Log entries",
+  "CheckType": [
+    "Unusual logon",
+    "Cloud threat detection"
+  ],
+  "ServiceName": "actiontrail",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "acs:actiontrail::account-id:trail",
+  "Severity": "critical",
+  "ResourceType": "AlibabaCloudActionTrail",
+  "Description": "**ActionTrail** is a web service that records API calls for your account and delivers log files to you.\n\nThe recorded information includes the identity of the API caller, the time of the API call, the source IP address of the API caller, the request parameters, and the response elements returned by the Alibaba Cloud service. ActionTrail provides a history of API calls for an account, including API calls made via the Management Console, SDKs, and command line tools.",
+  "Risk": "The API call history produced by ActionTrail enables **security analysis**, **resource change tracking**, and **compliance auditing**.\n\nEnsuring that a **multi-region trail** exists will detect unexpected activities occurring in otherwise unused regions. Global Service Logging should be enabled by default to capture events generated on Alibaba Cloud global services, ensuring the recording of management operations performed on all resources in an Alibaba Cloud account.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://www.alibabacloud.com/help/doc-detail/28829.htm",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ActionTrail/enable-multi-region-trails.html"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "aliyun actiontrail CreateTrail --Name <trail_name> --OssBucketName <oss_bucket_for_actiontrail> --RoleName aliyunactiontraildefaultrole --SlsProjectArn <sls_project_arn_for_actiontrail> --SlsWriteRoleArn <sls_role_arn_for_actiontrail> --EventRW <api_type_for_actiontrail>",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": "resource \"alicloud_actiontrail_trail\" \"example\" {\n  trail_name         = \"multi-region-trail\"\n  trail_region       = \"All\"\n  sls_project_arn    = \"acs:log:cn-hangzhou:123456789:project/actiontrail-project\"\n  sls_write_role_arn = data.alicloud_ram_roles.actiontrail.roles.0.arn\n}"
+    },
+    "Recommendation": {
+      "Text": "1. Log on to the **ActionTrail Console**\n2. Click on **Trails** in the left navigation pane\n3. Click **Add new trail**\n4. Enter a trail name in the `Trail name` box\n5. Set **Yes** for `Apply Trail to All Regions`\n6. Specify an OSS bucket name in the `OSS bucket` box\n7. Specify an SLS project name in the `SLS project` box\n8. Click **Create**",
+      "Url": "https://hub.prowler.com/check/actiontrail_multi_region_enabled"
+    }
+  },
+  "Categories": [
+    "logging"
+  ],
+  "DependsOn": [],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/alibabacloud/services/actiontrail/actiontrail_multi_region_enabled/actiontrail_multi_region_enabled.py

@@ -0,0 +1,81 @@
+from prowler.lib.check.models import Check, CheckReportAlibabaCloud
+from prowler.providers.alibabacloud.services.actiontrail.actiontrail_client import (
+    actiontrail_client,
+)
+
+
+class actiontrail_multi_region_enabled(Check):
+    """Check if ActionTrail is configured to export copies of all log entries."""
+
+    def execute(self) -> list[CheckReportAlibabaCloud]:
+        findings = []
+
+        # Check if there's at least one multi-region trail that is enabled
+        multi_region_trails = []
+        for trail in actiontrail_client.trails.values():
+            if trail.trail_region == "All" and trail.status == "Enable":
+                multi_region_trails.append(trail)
+
+        # Create a single report for the overall check
+        report = CheckReportAlibabaCloud(metadata=self.metadata(), resource={})
+        report.region = actiontrail_client.region
+        report.resource_id = actiontrail_client.audited_account
+        report.resource_arn = (
+            f"acs:actiontrail::{actiontrail_client.audited_account}:trail"
+        )
+
+        if multi_region_trails:
+            # At least one multi-region trail is enabled
+            trail_names = [trail.name for trail in multi_region_trails]
+            report.status = "PASS"
+            report.status_extended = (
+                f"ActionTrail is configured with {len(multi_region_trails)} multi-region trail(s) "
+                f"that are enabled: {', '.join(trail_names)}. "
+                "These trails export copies of all log entries across all regions."
+            )
+        else:
+            # Check if there are any trails at all
+            if actiontrail_client.trails:
+                # There are trails but none are multi-region or enabled
+                enabled_trails = [
+                    t
+                    for t in actiontrail_client.trails.values()
+                    if t.status == "Enable"
+                ]
+                multi_region_trails_disabled = [
+                    t
+                    for t in actiontrail_client.trails.values()
+                    if t.trail_region == "All" and t.status != "Enable"
+                ]
+
+                if enabled_trails and not multi_region_trails_disabled:
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"ActionTrail has {len(enabled_trails)} enabled trail(s), but none are configured "
+                        "for multi-region logging (TrailRegion is not set to 'All'). "
+                        "Multi-region trails are required to capture events from all regions."
+                    )
+                elif multi_region_trails_disabled:
+                    trail_names = [t.name for t in multi_region_trails_disabled]
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        f"ActionTrail has multi-region trail(s) but they are disabled: {', '.join(trail_names)}. "
+                        "Enable the multi-region trail(s) to export copies of all log entries."
+                    )
+                else:
+                    report.status = "FAIL"
+                    report.status_extended = (
+                        "ActionTrail has trails configured, but none are enabled or configured for multi-region logging. "
+                        "At least one trail with TrailRegion set to 'All' and Status set to 'Enable' is required."
+                    )
+            else:
+                # No trails configured at all
+                report.status = "FAIL"
+                report.status_extended = (
+                    "ActionTrail is not configured. No trails exist. "
+                    "Create at least one multi-region trail (TrailRegion='All') and enable it "
+                    "to export copies of all log entries across all regions."
+                )
+
+        findings.append(report)
+        return findings

prowler/providers/alibabacloud/services/actiontrail/actiontrail_oss_bucket_not_publicly_accessible/actiontrail_oss_bucket_not_publicly_accessible.metadata.json

@@ -0,0 +1,40 @@
+{
+  "Provider": "alibabacloud",
+  "CheckID": "actiontrail_oss_bucket_not_publicly_accessible",
+  "CheckTitle": "The OSS used to store ActionTrail logs is not publicly accessible",
+  "CheckType": [
+    "Sensitive file tampering"
+  ],
+  "ServiceName": "actiontrail",
+  "SubServiceName": "",
+  "ResourceIdTemplate": "acs:oss::account-id:bucket-name",
+  "Severity": "critical",
+  "ResourceType": "AlibabaCloudOSSBucket",
+  "Description": "**ActionTrail** logs a record of every API call made in your Alibaba Cloud account. These log files are stored in an **OSS bucket**.\n\nIt is recommended that the **Access Control List (ACL)** of the OSS bucket, which ActionTrail logs to, prevents public access to the ActionTrail logs.",
+  "Risk": "Allowing **public access** to ActionTrail log content may aid an adversary in identifying weaknesses in the affected account's use or configuration.\n\nExposed audit logs can reveal sensitive information about your infrastructure, API usage patterns, and security configurations.",
+  "RelatedUrl": "",
+  "AdditionalURLs": [
+    "https://help.aliyun.com/document_detail/31954.html",
+    "https://www.trendmicro.com/cloudoneconformity/knowledge-base/alibaba-cloud/AlibabaCloud-ActionTrail/trail-bucket-publicly-accessible.html"
+  ],
+  "Remediation": {
+    "Code": {
+      "CLI": "ossutil set-acl oss://<bucketName> private -b",
+      "NativeIaC": "",
+      "Other": "",
+      "Terraform": "resource \"alicloud_oss_bucket_public_access_block\" \"actiontrail\" {\n  bucket              = alicloud_oss_bucket.actiontrail.bucket\n  block_public_access = true\n}"
+    },
+    "Recommendation": {
+      "Text": "1. Log on to the **OSS Console**\n2. Right-click on the bucket and select **Basic Settings**\n3. In the Access Control List pane, click **Configure**\n4. The Bucket ACL tab shows three types of grants: `Private`, `Public Read`, `Public Read/Write`\n5. Ensure **Private** is set for the bucket\n6. Click **Save** to save the ACL",
+      "Url": "https://hub.prowler.com/check/actiontrail_oss_bucket_not_publicly_accessible"
+    }
+  },
+  "Categories": [
+    "logging"
+  ],
+  "DependsOn": [
+    "oss_bucket_not_publicly_accessible"
+  ],
+  "RelatedTo": [],
+  "Notes": ""
+}

prowler/providers/alibabacloud/services/actiontrail/actiontrail_oss_bucket_not_publicly_accessible/actiontrail_oss_bucket_not_publicly_accessible.py

@@ -0,0 +1,119 @@
+from prowler.lib.check.models import Check, CheckReportAlibabaCloud
+from prowler.providers.alibabacloud.services.actiontrail.actiontrail_client import (
+    actiontrail_client,
+)
+from prowler.providers.alibabacloud.services.oss.oss_client import oss_client
+
+
+def _is_policy_public(policy_document: dict) -> bool:
+    """
+    Check if a bucket policy allows public access.
+
+    A policy is considered public if it has a statement with:
+    - Effect: "Allow"
+    - Principal: ["*"] (or contains "*")
+    - No Condition elements
+
+    Args:
+        policy_document: The parsed policy document as a dictionary.
+
+    Returns:
+        bool: True if policy allows public access, False otherwise.
+    """
+    if not policy_document:
+        return False
+
+    statements = policy_document.get("Statement", [])
+    if not isinstance(statements, list):
+        statements = [statements]
+
+    for statement in statements:
+        effect = statement.get("Effect", "")
+        principal = statement.get("Principal", [])
+        condition = statement.get("Condition")
+
+        # If there's a condition, it's not truly public
+        if condition:
+            continue
+
+        if effect == "Allow":
+            # Check if Principal is "*" or contains "*"
+            if isinstance(principal, list):
+                if "*" in principal:
+                    return True
+            elif principal == "*":
+                return True
+
+    return False
+
+
+class actiontrail_oss_bucket_not_publicly_accessible(Check):
+    """Check if the OSS bucket used to store ActionTrail logs is not publicly accessible."""
+
+    def execute(self) -> list[CheckReportAlibabaCloud]:
+        findings = []
+
+        # Get all ActionTrail trails
+        for trail in actiontrail_client.trails.values():
+            # Only check trails that have an OSS bucket configured
+            if not trail.oss_bucket_name:
+                continue
+
+            # Find the OSS bucket used by this trail
+            bucket = None
+            for oss_bucket in oss_client.buckets.values():
+                if oss_bucket.name == trail.oss_bucket_name:
+                    bucket = oss_bucket
+                    break
+
+            # Create report for this trail's OSS bucket
+            report = CheckReportAlibabaCloud(metadata=self.metadata(), resource=trail)
+            report.region = trail.home_region
+            report.resource_id = trail.oss_bucket_name
+            report.resource_arn = (
+                f"acs:oss::{actiontrail_client.audited_account}:{trail.oss_bucket_name}"
+            )
+
+            if not bucket:
+                # Bucket not found in OSS service (might not have permissions or bucket doesn't exist)
+                report.status = "MANUAL"
+                report.status_extended = (
+                    f"ActionTrail trail {trail.name} uses OSS bucket {trail.oss_bucket_name}, "
+                    "but the bucket could not be found or accessed. Please verify the bucket exists "
+                    "and that you have permissions to access it."
+                )
+                findings.append(report)
+                continue
+
+            # Check bucket ACL
+            acl_public = False
+            if bucket.acl and bucket.acl != "private":
+                if bucket.acl in ["public-read", "public-read-write"]:
+                    acl_public = True
+
+            # Check bucket policy
+            policy_public = _is_policy_public(bucket.policy)
+
+            # Determine status
+            if acl_public or policy_public:
+                report.status = "FAIL"
+                issues = []
+                if acl_public:
+                    issues.append(f"Bucket ACL is set to {bucket.acl}")
+                if policy_public:
+                    issues.append("Bucket policy allows public access (Principal: '*')")
+                report.status_extended = (
+                    f"OSS bucket {trail.oss_bucket_name} used by ActionTrail trail {trail.name} "
+                    f"is publicly accessible. {'; '.join(issues)}. "
+                    "ActionTrail logs contain sensitive information and should not be publicly accessible."
+                )
+            else:
+                report.status = "PASS"
+                report.status_extended = (
+                    f"OSS bucket {trail.oss_bucket_name} used by ActionTrail trail {trail.name} "
+                    f"is not publicly accessible. ACL is {bucket.acl} and bucket policy does not allow public access."
+                )
+
+            findings.append(report)
+
+        return findings

prowler/providers/alibabacloud/services/actiontrail/actiontrail_service.py

@@ -0,0 +1,110 @@
+from datetime import datetime
+from typing import Optional
+
+from alibabacloud_actiontrail20200706 import models as actiontrail_models
+from pydantic.v1 import BaseModel
+
+from prowler.lib.logger import logger
+from prowler.lib.scan_filters.scan_filters import is_resource_filtered
+from prowler.providers.alibabacloud.lib.service.service import AlibabaCloudService
+
+
+class ActionTrail(AlibabaCloudService):
+    """
+    ActionTrail service class for Alibaba Cloud.
+
+    This class provides methods to interact with Alibaba Cloud ActionTrail service
+    to retrieve trails and their configuration.
+    """
+
+    def __init__(self, provider):
+        # Call AlibabaCloudService's __init__
+        # ActionTrail is a regional service
+        super().__init__(__class__.__name__, provider, global_service=False)
+
+        # Fetch ActionTrail resources
+        self.trails = {}
+        self.__threading_call__(self._describe_trails)
+
+    def _describe_trails(self, regional_client):
+        """List all ActionTrail trails."""
+        region = getattr(regional_client, "region", "unknown")
+        logger.info(f"ActionTrail - Describing trails in {region}...")
+        try:
+            # Use Tea SDK client (ActionTrail is regional service)
+            request = actiontrail_models.DescribeTrailsRequest()
+            response = regional_client.describe_trails(request)
+
+            if response and response.body and response.body.trail_list:
+                # trail_list is already a list, not an object with a trail attribute
+                trails_list = response.body.trail_list
+                if not isinstance(trails_list, list):
+                    trails_list = [trails_list]
+
+                for trail_data in trails_list:
+                    trail_name = getattr(trail_data, "name", "")
+                    if not trail_name:
+                        continue
+
+                    # Get trail region (can be specific region or "All")
+                    trail_region = getattr(trail_data, "trail_region", "")
+                    home_region = getattr(trail_data, "home_region", "")
+                    status = getattr(trail_data, "status", "")
+
+                    # Create ARN
+                    arn = f"acs:actiontrail::{self.audited_account}:trail/{trail_name}"
+
+                    if not self.audit_resources or is_resource_filtered(
+                        arn, self.audit_resources
+                    ):
+                        # Parse creation date if available
+                        creation_date = None
+                        creation_date_str = getattr(trail_data, "create_time", None)
+                        if creation_date_str:
+                            try:
+                                # ActionTrail date format: "2024-02-02T10:02:11Z" or similar
+                                creation_date = datetime.strptime(
+                                    creation_date_str.replace("Z", "+00:00"),
+                                    "%Y-%m-%dT%H:%M:%S%z",
+                                )
+                            except (ValueError, AttributeError):
+                                creation_date = datetime.strptime(
+                                    creation_date_str.replace("Z", "+00:00"),
+                                    "%Y-%m-%dT%H:%M:%S.%f%z",
+                                )
+
+                        self.trails[arn] = Trail(
+                            arn=arn,
+                            name=trail_name,
+                            home_region=home_region,
+                            trail_region=trail_region,
+                            status=status,
+                            oss_bucket_name=getattr(trail_data, "oss_bucket_name", ""),
+                            oss_bucket_location=getattr(
+                                trail_data, "oss_bucket_location", ""
+                            ),
+                            sls_project_arn=getattr(trail_data, "sls_project_arn", ""),
+                            event_rw=getattr(trail_data, "event_rw", ""),
+                            creation_date=creation_date,
+                        )
+
+        except Exception as error:
+            logger.error(
+                f"{regional_client.region} -- {error.__class__.__name__}[{error.__traceback__.tb_lineno}]: {error}"
+            )
+
+
+# Service Models
+class Trail(BaseModel):
+    """ActionTrail Trail model."""
+
+    arn: str
+    name: str
+    home_region: str
+    trail_region: str  # "All" for multi-region, or specific region name
+    status: str  # "Enable" or "Disable"
+    oss_bucket_name: str = ""
+    oss_bucket_location: str = ""
+    sls_project_arn: str = ""
+    event_rw: str = ""  # "All", "Read", "Write"
+    creation_date: Optional[datetime] = None