CloudTrail trails Integration with CloudWatch Logs Rule

Rule Description

Troubleshooting Steps

2. 1.
   Verify IAM Roles: Ensure that the IAM roles used by both CloudTrail and CloudWatch have the necessary permissions.
4. 2.
   Check Trail Configuration: Review the CloudTrail trail configuration to ensure it is set up correctly and that it is configured to output logs to CloudWatch.
6. 3.
   Verify CloudWatch Logs Setup: Validate that the CloudWatch Logs group exists and is properly configured to receive logs from CloudTrail.
8. 4.
   Check Logging Status: Confirm that CloudTrail logging and CloudWatch logs integration are enabled and active.
10. 5.
    Verify Trust Relationship: Ensure that the CloudTrail trail and CloudWatch Logs role have a trust relationship between them.
12. 6.
    Check CloudTrail and CloudWatch Regions: Confirm that the CloudTrail trail and CloudWatch Logs are both in the same region.

Necessary Codes

aws cloudtrail create-trail --name MyTrail --s3-bucket-name my-bucket --cloud-watch-logs-log-group-arn "arn:aws:logs:us-west-2:123456789012:log-group:MyLogGroup" --is-multi-region-trail

aws logs create-log-group --log-group-name MyLogGroup

MyTrail

my-bucket

arn:aws:logs:us-west-2:123456789012:log-group:MyLogGroup

MyLogGroup

Step-by-Step Guide for Remediation

2. 1.
   Open the AWS Management Console and navigate to the CloudTrail service.
4. 2.
   Click on "Trails" in the left-hand sidebar and select the desired trail.
6. 3.
   Click on "Actions" and select "Edit trail".
8. 4.
   Under the "CloudWatch Logs" section, select the appropriate CloudWatch Logs group to send the logs to.
10. 5.
    Enable the "Include global services" option if required for your use case.
12. 6.
    Click on "Save" to apply the changes.
14. 7.
    Open the AWS Management Console and navigate to the CloudWatch service.
16. 8.
    In the left-hand sidebar, click on "Logs" and then "Log groups".
18. 9.
    Click on "Create log group".
20. 10.
    Provide a name for the log group (e.g., MyLogGroup) and click on "Create".
22. 11.
    Use the necessary code snippet provided earlier to create the log group via the AWS CLI if preferred.
24. 12.
    Verify that the CloudTrail and CloudWatch Logs are in the same region.
26. 13.
    Confirm that CloudTrail logging and CloudWatch logs integration are enabled and active.
28. 14.
    Wait for a few minutes for logs to start appearing in the CloudWatch Logs group.
30. 15.
    To test the integration, perform AWS actions that should trigger CloudTrail logs and verify their presence in the CloudWatch Logs group.