How to set up an organization CloudTrail in AWS

An organization trail is one trail, owned by the management account, that logs events for the management account and every member account. Member accounts can see it but cannot change, stop or delete it.

• Where to work: sign in to the organization's management account, or to a CloudTrail delegated administrator account.
• Organizations: all features must be enabled in AWS Organizations, and CloudTrail must be a trusted service. Step 1 checks this.
• Permissions: AWS says the user or role needs at least the AWSCloudTrail_FullAccess policy or an equivalent, plus enough IAM and Organizations permissions to create the service-linked role and enable trusted access. Keep this limited to account administrators, because it can switch auditing off.
• Tools: the AWS CLI with a profile for the management account, and the CloudTrail console.
• Existing trails: list the trails already in the management account first. There is a per-Region trail limit, and AWS notes the first trail of management events in a Region is free while additional trails can incur charges.
• Bucket: decide where the logs go. A dedicated S3 bucket in the management account (or a log archive account) works well, with no other uses.

Step 1 only reads. Steps 2 to 5 change your organization and are marked CHANGE.

1. Look at the current state (read-only).

   aws organizations describe-organization --query "Organization.FeatureSet"
   aws organizations list-aws-service-access-for-organization --query "EnabledServicePrincipals[?ServicePrincipal=='cloudtrail.amazonaws.com']"
   aws cloudtrail describe-trails --include-shadow-trails

   The first command should print ALL. An empty result from the second means CloudTrail is not yet a trusted service.
2. CHANGE: let CloudTrail work across the organization. Run with a management account profile:

   aws organizations enable-aws-service-access --service-principal cloudtrail.amazonaws.com

   If the first command printed CONSOLIDATED_BILLING, enable all features in AWS Organizations first (aws organizations enable-all-features). Follow the AWS Organizations documentation for that change and plan it with the owners of your member accounts.
3. CHANGE: create the log bucket and give CloudTrail write access. Create a private S3 bucket and attach a policy with three statements, as AWS documents: CloudTrail may call s3:GetBucketAcl, and may call s3:PutObject under AWSLogs/<management-account-id>/* and under AWSLogs/<organization-id>/*. Use aws:SourceArn to tie the policy to your trail's ARN, so the bucket accepts logs only from that trail:

   {
     "Version": "2012-10-17",
     "Statement": [
       { "Sid": "AWSCloudTrailAclCheck20150319", "Effect": "Allow",
         "Principal": { "Service": "cloudtrail.amazonaws.com" },
         "Action": "s3:GetBucketAcl", "Resource": "arn:aws:s3:::BUCKET",
         "Condition": { "StringEquals": { "aws:SourceArn": "arn:aws:cloudtrail:REGION:MGMT_ACCOUNT_ID:trail/org-trail" } } },
       { "Sid": "AWSCloudTrailWrite20150319", "Effect": "Allow",
         "Principal": { "Service": "cloudtrail.amazonaws.com" },
         "Action": "s3:PutObject", "Resource": "arn:aws:s3:::BUCKET/AWSLogs/MGMT_ACCOUNT_ID/*",
         "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control", "aws:SourceArn": "arn:aws:cloudtrail:REGION:MGMT_ACCOUNT_ID:trail/org-trail" } } },
       { "Sid": "AWSCloudTrailOrganizationWrite20150319", "Effect": "Allow",
         "Principal": { "Service": "cloudtrail.amazonaws.com" },
         "Action": "s3:PutObject", "Resource": "arn:aws:s3:::BUCKET/AWSLogs/ORG_ID/*",
         "Condition": { "StringEquals": { "s3:x-amz-acl": "bucket-owner-full-control", "aws:SourceArn": "arn:aws:cloudtrail:REGION:MGMT_ACCOUNT_ID:trail/org-trail" } } }
     ]
   }

   Replace the upper-case placeholders with your own values. Also turn on S3 Block Public Access for the bucket. If you create the trail in the console and let it create the bucket, CloudTrail sets this up for you.
4. CHANGE: create the organization trail. Console: CloudTrail > Trails > Create trail, tick Enable for all accounts in my organization. Console-created organization trails are multi-Region. CLI:

   aws cloudtrail create-trail --name org-trail --s3-bucket-name BUCKET \
     --is-organization-trail --is-multi-region-trail --enable-log-file-validation
   aws cloudtrail start-logging --name org-trail

   Log file validation lets you prove later that log files were not altered.
5. CHANGE (optional): add encryption and alerting. Encrypt the logs with a KMS key whose policy allows CloudTrail, and send events to CloudWatch Logs if you want alarms. Both need extra resource policies, so follow the AWS pages in the sources below. Data events (for example S3 object-level activity) are off by default and cost extra, so enable them only for resources that matter.

These commands only read. Run them with the management account profile.

aws cloudtrail describe-trails --trail-name-list org-trail \
  --query "trailList[].[Name,IsOrganizationTrail,IsMultiRegionTrail,LogFileValidationEnabled,S3BucketName]"
aws cloudtrail get-trail-status --name org-trail \
  --query "[IsLogging,LatestDeliveryError,LatestDeliveryTime]"
aws cloudtrail get-event-selectors --trail-name org-trail

You want true for the organization and multi-Region flags, IsLogging as true, and no delivery error. After a few minutes, objects appear in the bucket under a folder for the organization ID, with one subfolder per account. A delivery error usually means the bucket policy does not match the trail ARN. AWS creates the trail in member accounts even when delivery validation fails, so always check the status.

• Creating the trail in a member account and expecting it to cover the organization. Only the management or delegated administrator account can create an organization trail.
• Forgetting the organization-ID statement in the bucket policy, so only the management account's own logs arrive.
• Using a single-Region trail (the CLI default) and missing activity in other Regions.
• Skipping log file validation, so you cannot later show that log files were left unaltered.
• Giving many people AWSCloudTrail_FullAccess. Anyone with it can stop or reconfigure auditing.
• Leaving the log bucket readable by workload accounts or without public access blocked.
• Reading Event history in the console and concluding member accounts are missing. It only shows the account you are signed in to.

ConfigCobra is read-only: it never changes your AWS. It reads your accounts through an assume-role connection and covers CIS Amazon Web Services Foundations v7.0.0 (70 controls), among 306 controls across the four AWS benchmarks. The related checks below cover CloudTrail being enabled in all Regions, log file validation, bucket logging, encryption and change monitoring.

The daily automatic scan, drift alerts and email notifications tell you if a trail is later switched off or reconfigured, and findings come with remediation steps you apply yourself. The AWS inventory lists resources across the accounts in scope.