CloudTrail events not available in CloudTrail account

Thank you for your question, Mark. I understand your concern about not being able to view all events from your entire organization within the "Event history" tab in your CloudTrail delegated administrator account. Let me clarify this situation for you.

The behavior you're experiencing is actually the expected functionality of CloudTrail Event history, and it's not related to missing permissions. Here's why:

1. Event history in CloudTrail is designed to show events only for the specific AWS account you are currently signed into. This applies even if the account is a delegated administrator for CloudTrail in an AWS Organizations setup.

2. When you view the Event history in your CloudTrail delegated administrator account, you will only see the events for that particular account, not for the entire organization.

3. Similarly, when you're signed into the management account, the Event history will only display events for the management account itself, not for the member accounts in the organization.

4. This limitation applies to all accounts within the organization, including the management account and delegated administrator accounts.

To view events for a specific member account, you would need to sign in to that account directly and check its Event history.

It's important to note that while you can't see all organization events in the Event history of a single account, your organization-wide trail is still capturing and storing logs for all accounts as intended. These logs are being stored in your CloudTrail account as you've set up.

If you need to analyze events across multiple accounts in your organization, you have a few options:

1. You can create an organization event data store or trail, which allows for more comprehensive event aggregation and analysis.

2. You can use other AWS services to analyze the data in your organization trail. For example, you could use Amazon Athena to query the logs stored in your CloudTrail account.

3. For more advanced querying and analysis across multiple attributes and regions, you might consider using CloudTrail Lake, which supports querying across various event types and attributes.

Remember, the Event history feature is separate from the trails and event data stores you've created, and it has its own limitations, including the 90-day retention period and the lack of organization-level event aggregation.

I hope this clarifies why you're not seeing all organization events in your CloudTrail account's Event history and provides some alternatives for analyzing your organization-wide events.
Sources
Organization delegated administrator - AWS CloudTrail
Creating a trail for an organization - AWS CloudTrail
Working with CloudTrail Event history - AWS CloudTrail