Getting Started with Cross-Account CloudTrail Logging

Introduction

Cross-account CloudTrail logging is an effective way to centralize and secure your AWS account logs by storing them in a separate AWS account. This ensures that the logs are isolated from the source account, enhancing security and manageability. In this post, we'll cover two approaches to set up cross-account CloudTrail logging: using AWS Organizations and without using AWS Organizations.

What You Need

To get started, you need two AWS accounts:

• Log Account: Where logs will be stored.
• Logger Account: Where logs will be sent from.

Approach 1: Using AWS Organizations

AWS Organizations allows you to manage multiple AWS accounts centrally. By enabling CloudTrail across accounts, you can simplify the setup process.

Steps:

1. Enable AWS Organizations: Ensure your accounts are part of an AWS Organization.
2. Create a Trail in the Management Account:
   • Navigate to CloudTrail in the AWS Management Console.
   • Create a new trail and select "Enable for all accounts in my organization."
3. Check Trails in Member Accounts: AWS automatically creates a trail in all member accounts. There’s no need to modify the bucket policy.

Benefits:

• Simplifies setup by automatically creating trails in member accounts.
• Centralizes log management.
• No need to manually update bucket policies.

Considerations:

• Additional charges may apply if member accounts already have trails (only the first trail within a region is free).

Approach 2: Without Using AWS Organizations

This approach involves manually setting up cross-account logging without the automation provided by AWS Organizations.

Steps:

1. Configure the Log Account:

   • Create a CloudTrail trail.
   • Set up an S3 bucket to store the logs.

2. Modify the Bucket Policy:

   • Update the S3 bucket policy to allow the CloudTrail service and specific IAM roles from both accounts to write logs.

   Example bucket policy snippet:

   

3. Configure the Logger Account:

   1. Create a CloudTrail trail.
   2. Specify the S3 bucket from the log account as the storage location.
4. Verify the Logs:
   1. Log in to the log account.
   2. Check that the logs from the logger account are being correctly stored in the specified S3 bucket.

Benefits:

1. Full control over the setup process.
2. Enhanced security by isolating logs in a different account.

Considerations:

1. Requires manual configuration and policy updates.
2. Slightly more complex setup compared to using AWS Organizations.
 

Conclusion

Cross-account CloudTrail logging is a powerful way to enhance the security and manageability of your AWS logs. Whether you choose to use AWS Organizations for a simplified setup or manually configure the logging, both approaches offer robust solutions for centralizing your log storage. By following these steps, you can ensure your logs are secure and easily accessible for auditing and monitoring purposes.