setting-up-cloudtrail-multi-region

This skill provides domain expertise for enabling an AWS CloudTrail trail across all regions so that comprehensive API activity logs are captured centrally. It solves the problem of fragmented or incomplete audit logging by walking through the creation of a multi-region trail backed by S3 log storage, integrated with CloudWatch Logs, and paired with CloudWatch Logs Insights queries. The goal is to support security monitoring, compliance auditing, and operational analysis from a single, consistent logging setup.

The core workflow is to follow a documented setup procedure exactly, referenced as the CloudTrail multi-region setup procedure in references/cloudtrail-multi-region-setup.md, which covers creating the trail with S3 storage, wiring in CloudWatch Logs, and running log analysis via CloudWatch Logs Insights. The skill also includes a troubleshooting section covering common failure modes: choosing a different globally unique name when an S3 bucket already exists, verifying identity with aws sts get-caller-identity for permission-denied errors, ensuring the trail is started with start-logging when it is not logging, and confirming the CloudWatch Logs role ARN and log group region when events are missing from CloudWatch.

This skill targets AWS practitioners, security engineers, and compliance teams who need centralized API activity logging. It emphasizes least-privilege practices, explicitly advising against using *FullAccess managed policies and instead attaching only the required actions to the user or role. It also sets expectations around timing: initial log delivery can take 5-15 minutes, and events from opt-in regions may take several hours and up to 24 hours before they warrant further investigation, so patience is required before concluding that logging is broken.