Consolidating Cloudtrail events from multiple accounts to one bucket

0

I'm trying to work this in the given example to write logs from Account B's Cloudtrail to Account A's bucket. I can't see the bucket in Account A in Account B's cloudtrail configuration event after adding the additional line in bucket policy under Action - s3:PutObject. : { "Version": "2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailAclCheck20150319", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::aws-cloudtrail-logs-481557513980-612e9c3a", "Condition": { "StringEquals": { "AWS:SourceArn": "arn:aws:cloudtrail:ap-southeast-1:481557513980:trail/management-events-joel.ckx_dev" } } }, { "Sid": "AWSCloudTrailWrite20150319", "Effect": "Allow", "Principal": { "Service": "cloudtrail.amazonaws.com" }, "Action": "s3:PutObject", "Resource": [ "arn:aws:s3:::aws-cloudtrail-logs-481557513980-612e9c3a/AWSLogs/481557513980/", "arn:aws:s3:::aws-cloudtrail-logs-481557513980-612e9c3a/AWSLogs/066239933787/" ], "Condition": { "StringEquals": { "AWS:SourceArn": "arn:aws:cloudtrail:ap-southeast-1:481557513980:trail/management-events-joel.ckx_dev", "s3:x-amz-acl": "bucket-owner-full-control" } } } ] }

  • BTW formatting your code with markdown would make it much more readable.

질문됨 2년 전940회 조회
2개 답변
0

If possible, you should consider using AWS Control Tower which will set up and maintain the Log Archive account with consolidated CloudTrail logs for you -> https://docs.aws.amazon.com/controltower/latest/userguide/how-control-tower-works.html#what-shared

If that's not possible, I suggest following the documentation Receiving CloudTrail log files from multiple accounts.

Cheers

답변함 2년 전
0

Another option is to use CloudTrail Lake

AWS
gsatur
답변함 일 년 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인