@@ -39,6 +39,30 @@ describe('validatePlanSteps — REQUIRED_PARAMS', () => {
     );
   });
 
+  it('reports a clear error when CreateLogGroupCommand is missing logGroupName (CS-787 fail-fast)', () => {
+    const errors = validatePlanSteps([
+      step({ service: 'logs', command: 'CreateLogGroupCommand', params: {} }),
+    ]);
+    expect(errors).toEqual(
+      expect.arrayContaining([
+        expect.stringMatching(
+          /CreateLogGroupCommand\): Required param "logGroupName" is missing or empty/,
+        ),
+      ]),
+    );
+  });
+
+  it('does NOT error when CreateLogGroupCommand has a logGroupName', () => {
+    const errors = validatePlanSteps([
+      step({
+        service: 'logs',
+        command: 'CreateLogGroupCommand',
+        params: { logGroupName: 'aws-cloudtrail-logs' },
+      }),
+    ]);
+    expect(errors.filter((e) => e.includes('logGroupName'))).toHaveLength(0);
+  });
+
   it('does NOT error when AWSServiceName is populated', () => {
     const errors = validatePlanSteps([
       step({
 
@@ -166,6 +166,12 @@ export const REQUIRED_PARAMS: Record<string, readonly string[]> = {
   PutBucketPolicyCommand: ['Bucket', 'Policy'],
   CreateTrailCommand: ['Name', 'S3BucketName'],
   PutMetricFilterCommand: ['logGroupName', 'filterName', 'metricTransformations'],
+  // A CreateLogGroup with no name is rejected by AWS with an opaque "Member must
+  // not be null" error, silently failing the whole remediation (CS-787). Fail
+  // fast with a clear message here. This covers CloudTrail AND every sibling
+  // remediation that mints a log group (Step Functions, SSM Session Manager,
+  // Transfer Family), which the CloudTrail-only name backfill deliberately skips.
+  CreateLogGroupCommand: ['logGroupName'],
 };
 
 /**
 
@@ -143,3 +143,199 @@ describe('normalizeFixPlan — AWS remediation edge cases', () => {
     expect(result.fixSteps[0].params).toEqual({ GroupName: 'default' });
   });
 });
+
+// CS-787: the "CloudTrail not integrated with CloudWatch Logs" auto-fix mints a
+// new log group, so the AI must invent the name. When it omits/empties
+// logGroupName, AWS rejects CreateLogGroup with "Member must not be null" and
+// the whole fix falls back to manual steps. The normalizer must guarantee a
+// valid name.
+describe('normalizeFixPlan — CreateLogGroup logGroupName backfill (CS-787)', () => {
+  const createLogGroupStep = (params: Record<string, unknown>): AwsCommandStep =>
+    makeStep({ service: 'logs', command: 'CreateLogGroupCommand', params });
+
+  const updateTrailStep = (logGroupArn: string): AwsCommandStep =>
+    makeStep({
+      service: 'cloudtrail',
+      command: 'UpdateTrailCommand',
+      params: {
+        Name: 'compai-trail',
+        CloudWatchLogsLogGroupArn: logGroupArn,
+        CloudWatchLogsRoleArn:
+          'arn:aws:iam::123456789012:role/CompAI-CloudTrailDelivery',
+      },
+    });
+
+  // A CloudTrail trail step with NO usable log-group ARN: the plan is still a
+  // CloudTrail integration fix, but there is nothing to derive the name from and
+  // nothing that will link the trail to a group. The normalizer must NOT invent a
+  // name here — doing so would create an orphan log group and report a false
+  // success on a still-non-compliant finding (CS-787). It leaves the step unfilled
+  // so REQUIRED_PARAMS validation rejects it and the fix fails honestly.
+  const updateTrailStepMissingArn = (): AwsCommandStep =>
+    makeStep({
+      service: 'cloudtrail',
+      command: 'UpdateTrailCommand',
+      params: { Name: 'compai-trail' },
+    });
+
+  it('leaves an OMITTED logGroupName unfilled when no trail ARN exists (no orphan group / false success — CS-787)', () => {
+    const plan = makePlan({
+      fixSteps: [createLogGroupStep({}), updateTrailStepMissingArn()],
+    });
+
+    const result = normalizeFixPlan(plan);
+
+    // Nothing to link the trail to → do NOT invent a name; leave it for
+    // REQUIRED_PARAMS validation to reject rather than create an orphan group.
+    expect(result.fixSteps[0].params.logGroupName).toBeUndefined();
+  });
+
+  it('leaves a blank logGroupName unchanged when no trail ARN exists', () => {
+    const plan = makePlan({
+      fixSteps: [
+        createLogGroupStep({ logGroupName: '   ' }),
+        updateTrailStepMissingArn(),
+      ],
+    });
+
+    const result = normalizeFixPlan(plan);
+
+    expect(result.fixSteps[0].params.logGroupName).toBe('   ');
+  });
+
+  it('derives the name from the trail step ARN so CreateLogGroup matches what UpdateTrail links to', () => {
+    const plan = makePlan({
+      fixSteps: [
+        createLogGroupStep({ logGroupName: '' }),
+        updateTrailStep(
+          'arn:aws:logs:us-east-1:123456789012:log-group:/compai/cloudtrail:*',
+        ),
+      ],
+    });
+
+    const result = normalizeFixPlan(plan);
+
+    expect(result.fixSteps[0].params.logGroupName).toBe('/compai/cloudtrail');
+  });
+
+  it('preserves a logGroupName the AI already supplied', () => {
+    const plan = makePlan({
+      fixSteps: [
+        createLogGroupStep({ logGroupName: 'my-custom-cloudtrail-lg' }),
+        updateTrailStep(
+          'arn:aws:logs:us-east-1:123456789012:log-group:something-else:*',
+        ),
+      ],
+    });
+
+    const result = normalizeFixPlan(plan);
+
+    expect(result.fixSteps[0].params.logGroupName).toBe(
+      'my-custom-cloudtrail-lg',
+    );
+  });
+
+  it('also backfills a CreateLogGroup step that appears in rollback steps (from the trail ARN)', () => {
+    const plan = makePlan({
+      rollbackSteps: [
+        createLogGroupStep({}),
+        updateTrailStep(
+          'arn:aws:logs:us-east-1:123456789012:log-group:/compai/cloudtrail:*',
+        ),
+      ],
+    });
+
+    const result = normalizeFixPlan(plan);
+
+    expect(result.rollbackSteps[0].params.logGroupName).toBe('/compai/cloudtrail');
+  });
+
+  it('is a no-op for plans without a CreateLogGroup step', () => {
+    const plan = makePlan({
+      fixSteps: [
+        makeStep({ service: 's3', command: 'PutPublicAccessBlockCommand' }),
+      ],
+    });
+
+    const result = normalizeFixPlan(plan);
+
+    expect(result.fixSteps).toEqual(plan.fixSteps);
+  });
+
+  // The CloudTrail default must NOT leak into other logging remediations. Many
+  // findings mint a log group via CreateLogGroupCommand (Step Functions, SSM
+  // Session Manager, Transfer Family, …) but reference it under their own name;
+  // stamping them with `aws-cloudtrail-logs` would create a group that doesn't
+  // match the sibling step that consumes it.
+  it('does NOT inject the CloudTrail default into a Step Functions logging remediation', () => {
+    const plan = makePlan({
+      fixSteps: [
+        createLogGroupStep({}),
+        makeStep({
+          service: 'sfn',
+          command: 'UpdateStateMachineCommand',
+          params: {
+            stateMachineArn:
+              'arn:aws:states:us-east-1:123456789012:stateMachine:my-sm',
+            loggingConfiguration: {
+              level: 'ALL',
+              includeExecutionData: true,
+              destinations: [
+                {
+                  cloudWatchLogsLogGroup: {
+                    logGroupArn:
+                      'arn:aws:logs:us-east-1:123456789012:log-group:/aws/vendedlogs/states/my-sm:*',
+                  },
+                },
+              ],
+            },
+          },
+        }),
+      ],
+    });
+
+    const result = normalizeFixPlan(plan);
+
+    expect(result.fixSteps[0].params.logGroupName).toBeUndefined();
+  });
+
+  it('does NOT inject the CloudTrail default into an SSM Session Manager logging remediation', () => {
+    const plan = makePlan({
+      fixSteps: [
+        createLogGroupStep({}),
+        makeStep({
+          service: 'ssm',
+          command: 'UpdateDocumentCommand',
+          params: {
+            Name: 'SSM-SessionManagerRunShell',
+            Content: JSON.stringify({
+              inputs: { cloudWatchLogGroupName: '/aws/ssm/session-logs' },
+            }),
+          },
+        }),
+      ],
+    });
+
+    const result = normalizeFixPlan(plan);
+
+    expect(result.fixSteps[0].params.logGroupName).toBeUndefined();
+  });
+
+  it('leaves the name unfilled for a CloudTrail plan (detected via CreateTrailCommand) that carries no log-group ARN', () => {
+    const plan = makePlan({
+      fixSteps: [
+        createLogGroupStep({}),
+        makeStep({
+          service: 'cloudtrail',
+          command: 'CreateTrailCommand',
+          params: { Name: 'compai-trail', S3BucketName: 'compai-logs' },
+        }),
+      ],
+    });
+
+    const result = normalizeFixPlan(plan);
+
+    // No ARN anywhere → nothing links the trail to the group → don't invent a name.
+    expect(result.fixSteps[0].params.logGroupName).toBeUndefined();
+  });
+});
@@ -1,4 +1,5 @@
 import type { AwsCommandStep, FixPlan } from './ai-remediation.prompt';
+import { logGroupNameFromArn } from './providers/aws/cloudwatch.adapter';
 
 /**
  * Maps an AWS service prefix (as it appears in `AwsCommandStep.service`)
@@ -40,6 +41,18 @@ const EC2_SECURITY_GROUP_COMMANDS = new Set([
 ]);
 const S3_ACL_COMMANDS = new Set(['PutBucketAclCommand']);
 const S3_ACL_PERMISSIONS = new Set(['s3:PutBucketAcl']);
+const CREATE_LOG_GROUP_COMMAND = 'CreateLogGroupCommand';
+const CLOUDTRAIL_SERVICE = 'cloudtrail';
+/**
+ * Commands that operate on a CloudTrail trail. A step whose `service` is
+ * CloudTrail — or that runs one of these commands — is what marks a plan as the
+ * CloudTrail→CloudWatch Logs integration fix, the ONLY remediation the
+ * `aws-cloudtrail-logs` default is correct for.
+ */
+const CLOUDTRAIL_TRAIL_COMMANDS = new Set([
+  'CreateTrailCommand',
+  'UpdateTrailCommand',
+]);
 
 export interface NormalizeFixPlanContext {
   resourceId?: string | null;
@@ -73,7 +86,9 @@ function normalizeStepList(
   securityGroupId: string | null,
 ): AwsCommandStep[] {
   return backfillSecurityGroupParams(
-    removeUnsupportedS3AclSteps(backfillServiceLinkedRoleParams(steps)),
+    backfillLogGroupName(
+      removeUnsupportedS3AclSteps(backfillServiceLinkedRoleParams(steps)),
+    ),
     securityGroupId,
   );
 }
@@ -168,3 +183,96 @@ function inferServiceLinkedRolePrincipal(
   }
   return null;
 }
+
+/**
+ * Backfill `logGroupName` on `CreateLogGroupCommand` steps the AI left empty.
+ *
+ * The "CloudTrail not integrated with CloudWatch Logs" remediation has to MINT
+ * a brand-new log group — the finding carries no existing log-group name
+ * (none exists yet), so the model must invent one. When it omits/empties
+ * `logGroupName`, AWS rejects the call with "Member must not be null / value
+ * null at logGroupName", the single step-repair fails, and the whole auto-fix
+ * silently falls back to manual steps. This is the same failure class as the
+ * SLR `AWSServiceName` backfill above.
+ *
+ * Resolve the name deterministically: prefer the log group the plan's trail
+ * step already targets (parsed from its `CloudWatchLogsLogGroupArn`) so the
+ * group we create matches what UpdateTrail links to; otherwise fall back to the
+ * canonical default. Only a missing/empty value is filled — a name the AI
+ * supplied is left untouched.
+ *
+ * Scope: this ONLY runs for the CloudTrail integration plan itself (detected by
+ * a CloudTrail trail step). Other logging remediations (SSM Session Manager,
+ * Step Functions, Transfer Family, …) also mint a log group via
+ * `CreateLogGroupCommand`, but each references it under its own name — stamping
+ * them with `aws-cloudtrail-logs` would create a group that doesn't match the
+ * sibling step that consumes it.
+ */
+function backfillLogGroupName(steps: AwsCommandStep[]): AwsCommandStep[] {
+  const needsBackfill = steps.some(
+    (step) =>
+      step.command === CREATE_LOG_GROUP_COMMAND &&
+      !hasNonEmptyString(step.params?.logGroupName),
+  );
+  if (!needsBackfill || !isCloudTrailIntegrationPlan(steps)) return steps;
+
+  // Only backfill the name we can DERIVE from the log-group ARN the trail step
+  // actually links to — that guarantees the group we create matches what
+  // UpdateTrail points at, i.e. a COMPLETE integration. If no step carries a
+  // parseable CloudWatchLogsLogGroupArn, nothing in the plan will link the trail
+  // to the group, so inventing a default name would create an orphan log group
+  // and report a FALSE success on a still-non-compliant finding (CS-787 cubic P1).
+  // Leave it unfilled instead: the CreateLogGroup step then fails REQUIRED_PARAMS
+  // validation and the fix falls back honestly rather than pretending it worked.
+  const resolved = inferCloudTrailLogGroupName(steps);
+  if (!resolved) return steps;
+
+  return steps.map((step) => {
+    if (
+      step.command !== CREATE_LOG_GROUP_COMMAND ||
+      hasNonEmptyString(step.params?.logGroupName)
+    ) {
+      return step;
+    }
+    return {
+      ...step,
+      params: { ...(step.params ?? {}), logGroupName: resolved },
+    };
+  });
+}
+
+/**
+ * True when the plan operates on a CloudTrail trail — the signal that a minted
+ * log group is destined for CloudTrail delivery and the `aws-cloudtrail-logs`
+ * default (the name the console proposes for trail log delivery) is correct.
+ * Keyed on the CloudTrail SDK client suffix or a trail command so it also
+ * matches plans that only create/update the trail without a parseable ARN.
+ */
+function isCloudTrailIntegrationPlan(steps: AwsCommandStep[]): boolean {
+  return steps.some(
+    (step) =>
+      step.service === CLOUDTRAIL_SERVICE ||
+      CLOUDTRAIL_TRAIL_COMMANDS.has(step.command),
+  );
+}
+
+/**
+ * Derive the CloudWatch Logs log-group NAME the plan's CloudTrail step points
+ * at, from any step carrying a `CloudWatchLogsLogGroupArn`. Keeps the created
+ * log group consistent with the trail integration. Returns null when no step
+ * references a parseable log-group ARN.
+ */
+function inferCloudTrailLogGroupName(steps: AwsCommandStep[]): string | null {
+  for (const step of steps) {
+    const arn = step.params?.CloudWatchLogsLogGroupArn;
+    if (typeof arn === 'string') {
+      const name = logGroupNameFromArn(arn);
+      if (name) return name;
+    }
+  }
+  return null;
+}
+
+function hasNonEmptyString(value: unknown): boolean {
+  return typeof value === 'string' && value.trim().length > 0;
+}