aws-cloudtrail
starsforks
How to install aws-cloudtrail?
bagelhole/devops-security-agent-skills/aws-cloudtrail
$npx -y skills add BagelHole/DevOps-Security-Agent-Skills --skill aws-cloudtrailConfigure AWS CloudTrail for audit logging. Set up organization trails and event analysis. Use when auditing AWS activity.
SKILL.md
| 1 | # AWS CloudTrail |
| 2 | |
| 3 | Audit AWS account activity with CloudTrail for compliance, security investigation, and operational troubleshooting. |
| 4 | |
| 5 | ## When to Use |
| 6 | |
| 7 | - Enabling organization-wide audit logging across all AWS accounts |
| 8 | - Investigating security incidents or unauthorized API activity |
| 9 | - Meeting compliance requirements for SOC 2, HIPAA, PCI DSS, or FedRAMP |
| 10 | - Setting up automated alerting on sensitive AWS API calls |
| 11 | - Querying historical AWS activity for forensic analysis |
| 12 | |
| 13 | ## Create an Organization Trail |
| 14 | |
| 15 | ```bash |
| 16 | # Create the S3 bucket for log storage |
| 17 | aws s3api create-bucket \ |
| 18 | --bucket org-cloudtrail-audit-logs \ |
| 19 | --region us-east-1 |
| 20 | |
| 21 | # Apply bucket policy allowing CloudTrail to write |
| 22 | aws s3api put-bucket-policy \ |
| 23 | --bucket org-cloudtrail-audit-logs \ |
| 24 | --policy '{ |
| 25 | "Version": "2012-10-17", |
| 26 | "Statement": [ |
| 27 | { |
| 28 | "Sid": "AWSCloudTrailAclCheck", |
| 29 | "Effect": "Allow", |
| 30 | "Principal": {"Service": "cloudtrail.amazonaws.com"}, |
| 31 | "Action": "s3:GetBucketAcl", |
| 32 | "Resource": "arn:aws:s3:::org-cloudtrail-audit-logs" |
| 33 | }, |
| 34 | { |
| 35 | "Sid": "AWSCloudTrailWrite", |
| 36 | "Effect": "Allow", |
| 37 | "Principal": {"Service": "cloudtrail.amazonaws.com"}, |
| 38 | "Action": "s3:PutObject", |
| 39 | "Resource": "arn:aws:s3:::org-cloudtrail-audit-logs/AWSLogs/*", |
| 40 | "Condition": { |
| 41 | "StringEquals": {"s3:x-amz-acl": "bucket-owner-full-control"} |
| 42 | } |
| 43 | } |
| 44 | ] |
| 45 | }' |
| 46 | |
| 47 | # Block public access on the audit bucket |
| 48 | aws s3api put-public-access-block \ |
| 49 | --bucket org-cloudtrail-audit-logs \ |
| 50 | --public-access-block-configuration \ |
| 51 | BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true |
| 52 | |
| 53 | # Enable versioning for tamper protection |
| 54 | aws s3api put-bucket-versioning \ |
| 55 | --bucket org-cloudtrail-audit-logs \ |
| 56 | --versioning-configuration Status=Enabled |
| 57 | |
| 58 | # Enable server-side encryption |
| 59 | aws s3api put-bucket-encryption \ |
| 60 | --bucket org-cloudtrail-audit-logs \ |
| 61 | --server-side-encryption-configuration '{ |
| 62 | "Rules": [{"ApplyServerSideEncryptionByDefault": {"SSEAlgorithm": "aws:kms", "KMSMasterKeyID": "alias/cloudtrail-key"}}] |
| 63 | }' |
| 64 | |
| 65 | # Set lifecycle policy for log retention |
| 66 | aws s3api put-bucket-lifecycle-configuration \ |
| 67 | --bucket org-cloudtrail-audit-logs \ |
| 68 | --lifecycle-configuration '{ |
| 69 | "Rules": [ |
| 70 | { |
| 71 | "ID": "TransitionToGlacier", |
| 72 | "Status": "Enabled", |
| 73 | "Filter": {"Prefix": "AWSLogs/"}, |
| 74 | "Transitions": [ |
| 75 | {"Days": 90, "StorageClass": "GLACIER"} |
| 76 | ] |
| 77 | }, |
| 78 | { |
| 79 | "ID": "ExpireOldLogs", |
| 80 | "Status": "Enabled", |
| 81 | "Filter": {"Prefix": "AWSLogs/"}, |
| 82 | "Expiration": {"Days": 2555} |
| 83 | } |
| 84 | ] |
| 85 | }' |
| 86 | |
| 87 | # Create the organization trail |
| 88 | aws cloudtrail create-trail \ |
| 89 | --name org-audit-trail \ |
| 90 | --s3-bucket-name org-cloudtrail-audit-logs \ |
| 91 | --is-organization-trail \ |
| 92 | --is-multi-region-trail \ |
| 93 | --enable-log-file-validation \ |
| 94 | --kms-key-id arn:aws:kms:us-east-1:123456789012:alias/cloudtrail-key \ |
| 95 | --cloud-watch-logs-log-group-arn arn:aws:logs:us-east-1:123456789012:log-group:CloudTrail:* \ |
| 96 | --cloud-watch-logs-role-arn arn:aws:iam::123456789012:role/CloudTrail-CWLogs-Role |
| 97 | |
| 98 | # Start logging |
| 99 | aws cloudtrail start-logging --name org-audit-trail |
| 100 | ``` |
| 101 | |
| 102 | ## Event Selectors for Management and Data Events |
| 103 | |
| 104 | ```bash |
| 105 | # Configure advanced event selectors for granular control |
| 106 | aws cloudtrail put-event-selectors \ |
| 107 | --trail-name org-audit-trail \ |
| 108 | --advanced-event-selectors '[ |
| 109 | { |
| 110 | "Name": "AllManagementEvents", |
| 111 | "FieldSelectors": [ |
| 112 | {"Field": "eventCategory", "Equals": ["Management"]} |
| 113 | ] |
| 114 | }, |
| 115 | { |
| 116 | "Name": "S3DataEventsForSensitiveBuckets", |
| 117 | "FieldSelectors": [ |
| 118 | {"Field": "eventCategory", "Equals": ["Data"]}, |
| 119 | {"Field": "resources.type", "Equals": ["AWS::S3::Object"]}, |
| 120 | {"Field": "resources.ARN", "StartsWith": [ |
| 121 | "arn:aws:s3:::sensitive-data-bucket/", |
| 122 | "arn:aws:s3:::pii-bucket/", |
| 123 | "arn:aws:s3:::financial-data/" |
| 124 | ]} |
| 125 | ] |
| 126 | }, |
| 127 | { |
| 128 | "Name": "LambdaInvocations", |
| 129 | "FieldSelectors": [ |
| 130 | {"Field": "eventCategory", "Equals": ["Data"]}, |
| 131 | {"Field": "resources.type", "Equals": ["AWS::Lambda::Function"]} |
| 132 | ] |
| 133 | }, |
| 134 | { |
| 135 | "Name": "DynamoDBDataEvents", |
| 136 | "FieldSelectors": [ |
| 137 | {"Field": "eventCategory", "Equals": ["Data"]}, |
| 138 | {"Field": "resources.type", "Equals": ["AWS::DynamoDB::Table"]} |
| 139 | ] |
| 140 | } |
| 141 | ]' |
| 142 | ``` |
| 143 | |
| 144 | ## CloudWatch Alerts for Sensitive Activity |
| 145 | |
| 146 | ```bash |
| 147 | # Create metric filter for unauthorized API calls |
| 148 | aws logs put-metric-filter \ |
| 149 | --log-group-name CloudTrail \ |
| 150 | --filter-name UnauthorizedAPICalls \ |
| 151 | --filter-pattern '{ ($.errorCode = "*UnauthorizedAccess*") || ($.errorCode = "AccessDenied*") }' \ |
| 152 | --metric-transformations \ |
| 153 | me |
People who liked this also viewed
6 picksType
- microsoft-foundryDeploy, evaluate, fine-tune, and manage Foundry agents end-to-end with azd: hosted agent scaffold/run/deploy, prompt agent create, batch eval, continuous eval, prompt optimizer, Agent Optimizer scaffoSkillsJul 2026
- azure-deployExecute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application SkillsJul 2026
- azure-preparePrepare azd-based Azure projects for deployment: generates azure.yaml, infrastructure (Bicep/Terraform), and Dockerfiles for the Azure Developer CLI (azd) workflow. USE ONLY when the user explicitly wSkillsJul 2026
- azure-validate--- name: azure-validate description: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity pSkillsJul 2026
- azure-aigatewayConfigure Azure API Management as an AI Gateway for AI models, MCP tools, and agents. WHEN: semantic caching, token limit, content safety, load balancing, AI model governance, MCP rate limiting, jailbSkillsJul 2026
- azure-hosted-copilot-sdkOfficial agent plugin providing skills and MCP server configurations for Azure scenarios.SkillsJul 2026
