AWS CloudTrail Best Practices

• 2021 https://aws.amazon.com/blogs/mt/aws-cloudtrail-best-practices/

aws cloudtrail create-trail

• Enable CloudTrail log file integrity validation: --enable-log-file-validation
• Receiving CloudTrail log files from multiple accounts
• Enable MFA-delete and versioning on the Amazon S3 Bucket storing log files: aws_s3_versioning, mfa_delete, aws s3api put-bucket-versioning
• Use advanced event selectors with data events: DeleteObject
• Integrate CloudTrail with Amazon CloudWatch Logs

Related

• AWS CloudTrail Events
• AWS Best Practices
• Data events
• --is-multi-region-trail
• --enable-log-file-validation

See also

• aws cloudtrail create-trail
• AWS CloudTrail, AWS CloudTrail Insights, CloudTrail Events, AWS CloudTrail Lake, Terraform, Best practices, Datadog SIEM Content Packs for Cloudtrail