cloudtrail to cloudwatch

cloudtrail/basic/Readme.md

@@ -0,0 +1,17 @@
+# Create a bucket for cloudtrail logs
+
+aws s3 mb s3://my-cloudtrail-ab-1212
+
+# Create bucket policy to allow cloud trail to put to bucket
+
+aws s3api put-bucket-policy --bucket my-cloudtrail-ab-1212 --policy file://bucket-policy.json
+
+# Create Trail
+aws cloudtrail create-trail \
+--name MyTrail \
+--s3-bucket-name my-cloudtrail-ab-1212 \
+--region ca-central-1
+
+# Start Logging
+
+aws cloudtrail start-logging --name MyTrail

cloudtrail/basic/bucket-policy.json

@@ -0,0 +1,18 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+      {
+          "Sid": "AWSCloudTrailWrite20150319",
+          "Effect": "Allow",
+          "Principal": {"Service": "cloudtrail.amazonaws.com"},
+          "Action": "s3:PutObject",
+          "Resource": "arn:aws:s3:::my-cloudtrail-ab-1212/AWSLogs/myAccountID/*",
+          "Condition": {
+              "StringEquals": {
+                  "s3:x-amz-acl": "bucket-owner-full-control",
+                  "aws:SourceArn": "arn:aws:cloudtrail:ca-central-1:982383527471:trail/MyTrail"
+              }
+          }
+      }
+  ]
+}

cloudtrail/cloudwatch/Readme.md

@@ -0,0 +1,9 @@
+# Create CloudWatch Log and Stream
+
+aws logs create-log-group --log-group-name mycloudtrail
+
+# Update trail for CloudWatch Logs
+aws cloudtrail update-trail \
+--name MyTrail \
+--cloud-watch-logs-log-group-arn arn:aws:logs:ca-central-1:982383527471:log-group:mycloudtrail:* \
+--cloud-watch-logs-role-arn arn:aws:iam::982383527471:role/MyCloudTrail2CloudWatchRole

cloudtrail/cloudwatch/cloud-watch-policy.json

@@ -0,0 +1,27 @@
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+
+      "Sid": "AWSCloudTrailCreateLogStream2014110",
+      "Effect": "Allow",
+      "Action": [
+        "logs:CreateLogStream"
+      ],
+      "Resource": [
+        "arn:aws:logs:ca-central-1:982383527471:log-group:mycloudtrail:log-stream:*"
+      ]
+
+    },
+    {
+      "Sid": "AWSCloudTrailPutLogEvents20141101",
+      "Effect": "Allow",
+      "Action": [
+        "logs:PutLogEvents"
+      ],
+      "Resource": [
+        "arn:aws:logs:ca-central-1:982383527471:log-group:mycloudtrail:log-stream:*"
+      ]
+    }
+  ]
+}