aws-cloudtrail

1# AWS CloudTrail
2 
3Audit AWS account activity with CloudTrail for compliance, security investigation, and operational troubleshooting.
4 
5## When to Use
6 
7- Enabling organization-wide audit logging across all AWS accounts
8- Investigating security incidents or unauthorized API activity
9- Meeting compliance requirements for SOC 2, HIPAA, PCI DSS, or FedRAMP
10- Setting up automated alerting on sensitive AWS API calls
11- Querying historical AWS activity for forensic analysis
12 
13## Create an Organization Trail
14 
15```bash
16# Create the S3 bucket for log storage
17aws s3api create-bucket \
18  --bucket org-cloudtrail-audit-logs \
19  --region us-east-1
20 
21# Apply bucket policy allowing CloudTrail to write
22aws s3api put-bucket-policy \
23  --bucket org-cloudtrail-audit-logs \
24  --policy '{
25    "Version": "2012-10-17",
26    "Statement": [
27      {
28        "Sid": "AWSCloudTrailAclCheck",
29        "Effect": "Allow",
30        "Principal": {"Service": "cloudtrail.amazonaws.com"},
31        "Action": "s3:GetBucketAcl",
32        "Resource": "arn:aws:s3:::org-cloudtrail-audit-logs"
33      },
34      {
35        "Sid": "AWSCloudTrailWrite",
36        "Effect": "Allow",
37        "Principal": {"Service": "cloudtrail.amazonaws.com"},
38        "Action": "s3:PutObject",
39        "Resource": "arn:aws:s3:::org-cloudtrail-audit-logs/AWSLogs/*",
40        "Condition": {
41          "StringEquals": {"s3:x-amz-acl": "bucket-owner-full-control"}
42        }
43      }
44    ]
45  }'
46 
47# Block public access on the audit bucket
48…