mcpField
S
setting-up-cloudtrail-multi-region

setting-up-cloudtrail-multi-region

github.com/awsSecurity3.3k6.1k installsUpdated 1d ago
Repository

About setting-up-cloudtrail-multi-region

A domain skill for setting up AWS CloudTrail across regions and configuring CloudWatch Logs Insights. It guides security monitoring, compliance auditing, operational analysis, and troubleshooting.

Key features

  1. 01Multi-region CloudTrail setup
  2. 02S3 storage and CloudWatch Logs integration
  3. 03CloudWatch Logs Insights configuration
  4. 04Troubleshooting logging and permissions

Use cases

  1. 01Enable API activity logging across AWS regions
  2. 02Investigate missing trail events
  3. 03Analyze logs for compliance and operations

Install

Copy the command and run it in a terminal.

$npx skills add https://github.com/aws/agent-toolkit-for-aws --skill setting-up-cloudtrail-multi-region

After installing, type/setting-up-cloudtrail-multi-regionin Claude Code to confirm it loaded.

Bundled filesreferences/cloudtrail-multi-region-setup.md

Details

From the project README

Setting Up CloudTrail Multi-Region

Overview

Domain expertise for enabling AWS CloudTrail across all regions to capture comprehensive API activity logs and configuring CloudWatch Logs Insights for security monitoring, compliance auditing, and operational analysis.

Set up a multi-region trail

To create a centralized multi-region CloudTrail trail with S3 storage, CloudWatch Logs integration, and log analysis, follow the procedure exactly. See CloudTrail multi-region setup procedure.

Troubleshooting

S3 bucket already exists

Choose a different globally unique name, or add a timestamp or organization identifier.

Permission denied errors

Verify your identity with aws sts get-caller-identity. Ensure your user/role has required actions attached. Do NOT use *FullAccess managed policies.

Trail not logging

Verify IAM role permissions, check S3 bucket policy allows CloudTrail access, and ensure the trail is started with start-logging.

Missing events in CloudWatch

Allow 5-15 minutes for initial log delivery. Verify the CloudWatch Logs role ARN is correct and the log group exists in the same region as the trail.

Opt-in region events not appearing

This is normal — events from opt-in regions may take several hours. Wait up to 24 hours before investigating further.

Comments

Markdown supported