Create CloudTrail

Create CloudTrail

  1. Access AWS Management Console

    • Find CloudTrail
    • Select CloudTrail

create cloudtrail

  1. In the CloudTrail interface

    • Select Trails
    • Select Create trail

create cloudtrail

  1. In the Choose trail attributes section

    You can choose a different name if you like!

    • Trail name enter kms-key-cloudtrail
    • Storage location select Use existing S3 bucket
    • Select Browse

create cloudtrail

  1. Next step

    • Select kms-key-s3-<account-id>-<region>-an
    • Press Choose

create cloudtrail

  1. In the Prefix - optional section

    You can choose a different name if you like!

    • Enter cloudtrail
    • Keep Log file SSE-KMS encryption disabled for this lab
    • Keep the default additional settings

create cloudtrail

  1. Scroll down to the section and press Next

create cloudtrail

  1. In the Choose log events section

    • In Event type, select Management events
    • Select Data events

create cloudtrail

  1. Next, scroll down to the Data events section

    • Select Switch to basic event selectors to switch modes

create cloudtrail

  1. Next, press Continue

create cloudtrail

  1. In the Data event: S3 section

    • Data event source select S3
    • In All current and future S3 buckets, leave Read and Write unchecked
    • In Individual bucket selection, press Browse

create cloudtrail

  1. Next step

    • Select kms-key-s3-<account-id>-<region>-an
    • Confirm Read and Write are selected for that bucket
    • Press Choose

create cloudtrail

  1. Next, press Next

create cloudtrail

  1. In Configure event aggregation - optional

    • Leave Aggregation templates empty
    • Select Next

create cloudtrail

  1. In Review and create

    • Confirm No aggregated templates selected
    • Select Create trail

create cloudtrail

  1. Confirm the trail was created successfully

create cloudtrail

  1. Access S3 again

create cloudtrail

  1. Select Buckets, open General purpose buckets, and select kms-key-s3-<account-id>-<region>-an

create cloudtrail

  1. In the Objects tab, verify that the cloudtrail/ folder was created. This folder stores the trail logs, including the S3 data events recorded for kms-key-s3-<account-id>-<region>-an

create cloudtrail