Description
Connecting CloudTrail to CloudWatch Logs makes account activity available for log searches, metric filters, and alarms. Without this integration or an alternative monitoring path, unusual activity may be noticed late.
Potential impact
Searching audit events or generating required alerts may take longer.
Remediation
Set cloudwatch_logs_role_arn and cloudwatch_logs_log_group_arn when the integration is needed. Verify write permissions and delivery, then configure the required filters and alarms.
Examples
The examples specify both the role ARN and log group ARN. Prepare the role and log group in advance.
Before
yaml
- name: Create CloudTrail
community.aws.cloudtrail:
state: present
name: default
s3_bucket_name: mylogbucket
region: us-east-1
is_multi_region_trail: true
enable_log_file_validation: true
kms_key_id: "alias/MyAliasName"
- name: Create CloudTrail2
community.aws.cloudtrail:
state: present
name: default
s3_bucket_name: mylogbucket
region: us-east-1
is_multi_region_trail: true
enable_log_file_validation: true
cloudwatch_logs_role_arn: "arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role"
kms_key_id: "alias/MyAliasName"
After
yaml
- name: Create CloudTrail
community.aws.cloudtrail:
state: present
name: default
s3_bucket_name: mylogbucket
region: us-east-1
is_multi_region_trail: true
enable_log_file_validation: true
cloudwatch_logs_role_arn: "arn:aws:iam::123456789012:role/CloudTrail_CloudWatchLogs_Role"
cloudwatch_logs_log_group_arn: "arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail/DefaultLogGroup:*"
kms_key_id: "alias/MyAliasName"