Description
A single-Region trail does not provide coverage of regional activity across all AWS Regions. A multi-Region trail helps collect events across the AWS Regions enabled in the account.
Potential impact
Without another collection path, activity in some Regions may be absent from audits and incident investigations.
Remediation
Set is_multi_region_trail: true when auditing multiple Regions and verify log delivery. Also review collection settings for the event types you need.
Examples
The examples compare single-Region or default settings with a multi-Region trail. Multi-Region configuration alone does not automatically collect every data event.
Before
yaml
- name: Create CloudTrail
community.aws.cloudtrail:
state: present
name: default
s3_bucket_name: mylogbucket
region: us-east-1
is_multi_region_trail: false
enable_log_file_validation: true
cloudwatch_logs_role_arn: "arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role"
cloudwatch_logs_log_group_arn: "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:*"
sns_topic_name: random1
kms_key_id: "alias/MyAliasName"
- name: Create CloudTrail2
community.aws.cloudtrail:
state: present
name: default
s3_bucket_name: mylogbucket
s3_key_prefix: cloudtrail
region: us-east-1
cloudwatch_logs_role_arn: "arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role"
cloudwatch_logs_log_group_arn: "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:*"
sns_topic_name: random2
enable_log_file_validation: true
kms_key_id: "alias/MyAliasName"
After
yaml
- name: Create CloudTrail
community.aws.cloudtrail:
state: present
name: default
s3_bucket_name: mylogbucket
region: us-east-1
is_multi_region_trail: true
enable_log_file_validation: true
cloudwatch_logs_role_arn: arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role
cloudwatch_logs_log_group_arn: arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:*
sns_topic_name: random
kms_key_id: alias/MyAliasName