CloudTrail creates an hash for the log-files being added to S3.

Every hour a digest file is created containing the details of the logs delivered and their hash.

That allows to verify the integrity of the logs and that log files have not been tampered in any way. (by running a CLI command - not from console and not automatically)