setting-up-cloudtrail-multi-region
aws/agent-toolkit-for-aws
Set up centralized multi-region AWS CloudTrail logging with S3 and CloudWatch integration for security monitoring.
What is setting-up-cloudtrail-multi-region?
Configures a multi-region AWS CloudTrail trail to capture API activity across all AWS regions, storing logs in S3 and integrating with CloudWatch Logs for security monitoring and compliance auditing. Use this when you need centralized, organization-wide API activity logging and log analysis.
- Create a multi-region CloudTrail trail capturing API activity across all AWS regions
- Store CloudTrail logs in S3 with proper bucket configuration and policies
- Integrate CloudTrail logs with CloudWatch Logs for real-time monitoring
- Set up CloudWatch Logs Insights queries for security analysis and compliance reporting
- Configure IAM roles and permissions for secure log delivery
How to install setting-up-cloudtrail-multi-region
npx skills add https://github.com/aws/agent-toolkit-for-aws --skill setting-up-cloudtrail-multi-region- AWS account with appropriate IAM permissions (CloudTrail, S3, CloudWatch Logs, IAM)
- AWS CLI configured with valid credentials
- An S3 bucket name (must be globally unique)
- Basic understanding of AWS CloudTrail and CloudWatch Logs
How to use setting-up-cloudtrail-multi-region
- 1.Run the skill to access the CloudTrail multi-region setup procedure
- 2.Follow the referenced setup procedure to create the S3 bucket with proper policies
- 3.Create the multi-region CloudTrail trail via AWS Console or CLI
- 4.Configure CloudWatch Logs integration by specifying a log group and IAM role
- 5.Start logging on the trail and verify events appear in S3 and CloudWatch Logs
- 6.Set up CloudWatch Logs Insights queries for your security monitoring needs
Use cases
- Centralized security monitoring across all AWS regions in your organization
- Compliance auditing and regulatory reporting (SOC 2, PCI-DSS, etc.)
- Investigating API activity and tracking configuration changes across accounts
- Detecting unauthorized or suspicious API calls in real-time
- Archiving and analyzing historical API activity for forensics
- AWS security engineers
- Cloud compliance and audit teams
- DevOps and infrastructure teams managing multi-region deployments
- Security operations center (SOC) analysts
setting-up-cloudtrail-multi-region FAQ
Logs typically appear in S3 within 5-15 minutes. CloudWatch Logs may take a similar timeframe. Events from opt-in regions can take several hours or up to 24 hours.
Your user or role needs CloudTrail, S3, CloudWatch Logs, and IAM permissions. Verify with `aws sts get-caller-identity` and attach specific required actions rather than using `*FullAccess` policies.
Verify the IAM role has correct permissions, the S3 bucket policy allows CloudTrail access, and the trail is started with `start-logging`. Check CloudWatch Logs role ARN and log group configuration.
Yes, but ensure it has the correct bucket policy allowing CloudTrail to write logs. If you encounter 'bucket already exists' errors, choose a different globally unique name or add a timestamp/identifier.
Use CloudWatch Logs Insights queries on the log group associated with your trail. The skill provides guidance on setting up queries for security analysis and compliance reporting.
Full instructions (SKILL.md)
Source of truth, from aws/agent-toolkit-for-aws.
name: setting-up-cloudtrail-multi-region description: Enables a multi-region AWS CloudTrail trail with S3 log storage, CloudWatch Logs integration, and CloudWatch Logs Insights queries for security monitoring and compliance auditing. Use when setting up centralized API activity logging across all AWS regions. version: 1
Setting Up CloudTrail Multi-Region
Overview
Domain expertise for enabling AWS CloudTrail across all regions to capture comprehensive API activity logs and configuring CloudWatch Logs Insights for security monitoring, compliance auditing, and operational analysis.
Set up a multi-region trail
To create a centralized multi-region CloudTrail trail with S3 storage, CloudWatch Logs integration, and log analysis, follow the procedure exactly. See CloudTrail multi-region setup procedure.
Troubleshooting
S3 bucket already exists
Choose a different globally unique name, or add a timestamp or organization identifier.
Permission denied errors
Verify your identity with aws sts get-caller-identity. Ensure your user/role has required actions attached. Do NOT use *FullAccess managed policies.
Trail not logging
Verify IAM role permissions, check S3 bucket policy allows CloudTrail access, and ensure the trail is started with start-logging.
Missing events in CloudWatch
Allow 5-15 minutes for initial log delivery. Verify the CloudWatch Logs role ARN is correct and the log group exists in the same region as the trail.
Opt-in region events not appearing
This is normal — events from opt-in regions may take several hours. Wait up to 24 hours before investigating further.
Related skills
More from aws/agent-toolkit-for-aws and the wider catalog.
setting-up-cloudwatch-alarm-notifications
Set up encrypted SNS topics and subscriptions for CloudWatch alarm notifications with proper security controls.
setting-up-ec2-instance-profiles
Securely grant EC2 instances AWS service access via IAM roles and instance profiles without hardcoded credentials.
setup
Configure AWS DevOps and Security Agent connections for MCP integration.
setup-devops-agent
Setup and diagnostics for AWS DevOps Agent MCP connection in Claude.
setup-security-agent
Configure AWS Security Agent workspace with agent space, IAM role, and S3 bucket.
shieldadvanced
Configure AWS Shield Advanced for enhanced DDoS protection, automatic layer 7 mitigation, and expert support.