Complete Guide: Setting Up CloudTrail Logging

# Create trail via AWS CLI
aws cloudtrail create-trail \
    --name company-security-audit-trail \
    --s3-bucket-name company-cloudtrail-logs-unique-suffix \
    --include-global-service-events \
    --is-multi-region-trail \
    --enable-log-file-validation

# Start logging
aws cloudtrail start-logging \
    --name company-security-audit-trail

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AWSCloudTrailAclCheck",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
            },
            "Action": "s3:GetBucketAcl",
            "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME"
        },
        {
            "Sid": "AWSCloudTrailWrite",
            "Effect": "Allow",
            "Principal": {
                "Service": "cloudtrail.amazonaws.com"
            },
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::YOUR-BUCKET-NAME/AWSLogs/YOUR-ACCOUNT-ID/*",
            "Condition": {
                "StringEquals": {
                    "s3:x-amz-acl": "bucket-owner-full-control"
                }
            }
        },
        {
            "Sid": "DenyUnSecureCommunications",
            "Effect": "Deny",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": [
                "arn:aws:s3:::YOUR-BUCKET-NAME",
                "arn:aws:s3:::YOUR-BUCKET-NAME/*"
            ],
            "Condition": {
                "Bool": {
                    "aws:SecureTransport": "false"
                }
            }
        }
    ]
}

# Validate log file integrity using AWS CLI
aws cloudtrail validate-logs \
    --trail-arn arn:aws:cloudtrail:REGION:ACCOUNT-ID:trail/trail-name \
    --start-time 2026-01-01T00:00:00Z \
    --end-time 2026-01-02T00:00:00Z

# Example output shows validation results:
# Results for s3://bucket/AWSLogs/123456789012/CloudTrail/us-east-1/2026/01/01/
# 2026-01-01T00:05:00Z - 2026-01-01T01:00:00Z: VALID
# 2026-01-01T01:05:00Z - 2026-01-01T02:00:00Z: VALID

# Root account usage filter
{ ($.userIdentity.type = "Root") && ($.userIdentity.invokedBy NOT EXISTS) && ($.eventType != "AwsServiceEvent") }

# Failed console logins filter
{ ($.eventName = ConsoleLogin) && ($.errorMessage EXISTS) }

# IAM policy changes filter
{ ($.eventSource = iam.amazonaws.com) && (($.eventName = DeleteUserPolicy) || ($.eventName = DeleteRolePolicy) || ($.eventName = DeleteGroupPolicy) || ($.eventName = CreatePolicy) || ($.eventName = CreateRole) || ($.eventName = CreateUser)) }

# Security group changes filter
{ ($.eventName = AuthorizeSecurityGroupIngress) || ($.eventName = AuthorizeSecurityGroupEgress) || ($.eventName = RevokeSecurityGroupIngress) || ($.eventName = RevokeSecurityGroupEgress) || ($.eventName = CreateSecurityGroup) || ($.eventName = DeleteSecurityGroup) }

# CloudTrail configuration changes
{ ($.eventSource = cloudtrail.amazonaws.com) && (($.eventName = StopLogging) || ($.eventName = DeleteTrail) || ($.eventName = UpdateTrail)) }

#!/bin/bash
# CloudTrail Configuration Validation Script

echo "Validating CloudTrail configuration..."

# Check if trails exist
TRAILS=$(aws cloudtrail describe-trails --query 'trailList[*].Name' --output text)
if [ -z "$TRAILS" ]; then
    echo "✗ No CloudTrail found!"
    exit 1
else
    echo "✓ CloudTrail found: $TRAILS"
fi

# Check multi-region configuration
MULTIREGION=$(aws cloudtrail describe-trails --query 'trailList[*].IsMultiRegionTrail' --output text)
if [[ "$MULTIREGION" == *"True"* ]]; then
    echo "✓ Multi-region trail configured"
else
    echo "✗ WARNING: Trail not configured for all regions!"
fi

# Check logging status
for TRAIL in $TRAILS; do
    LOGGING=$(aws cloudtrail get-trail-status --name $TRAIL --query 'IsLogging' --output text)
    if [ "$LOGGING" = "True" ]; then
        echo "✓ CloudTrail logging is active for $TRAIL"
    else
        echo "✗ WARNING: CloudTrail logging is not active for $TRAIL!"
    fi
done

# Check log file validation
VALIDATION=$(aws cloudtrail describe-trails --query 'trailList[*].LogFileValidationEnabled' --output text)
if [[ "$VALIDATION" == *"True"* ]]; then
    echo "✓ Log file validation enabled"
else
    echo "! Log file validation not enabled"
fi

# Check recent log delivery
for TRAIL in $TRAILS; do
    RECENT_DELIVERY=$(aws cloudtrail get-trail-status --name $TRAIL --query 'LatestDeliveryTime' --output text)
    if [ "$RECENT_DELIVERY" != "None" ] && [ -n "$RECENT_DELIVERY" ]; then
        echo "✓ Recent log delivery confirmed: $RECENT_DELIVERY"
    else
        echo "! No recent log delivery detected for $TRAIL"
    fi
done

echo ""
echo "CloudTrail validation complete!"

# Generate test events to verify logging

# 1. Create and delete a test security group
aws ec2 create-security-group \
    --group-name test-cloudtrail-sg \
    --description "Test CloudTrail logging"

aws ec2 delete-security-group --group-name test-cloudtrail-sg

# 2. Check CloudTrail logs in S3 (wait 15 minutes)
aws s3 ls s3://your-cloudtrail-bucket/AWSLogs/ --recursive | head -20

# 3. Query CloudWatch Logs (wait 5 minutes)
aws logs describe-log-streams \
    --log-group-name CloudTrail/SecurityAuditLogs \
    --order-by LastEventTime \
    --descending \
    --limit 5