How it works...
In this recipe, we sent logs from one account – the logger account – into another account – the log account. First, we created a trail in the log account. A bucket policy was created that allowed the CloudTrail service to log to the current account's log folder. We modified the bucket policy to allow the CloudTrail service to log to the logger account's log folder. CloudTrail logs each account's log in a folder specific to that account.
The default bucket policy that was generated by AWS had two statements. The first statement, whose Sid starts with AWSCloudTrailAclCheck, allows CloudTrail to read the bucket's ACL. The second statement, whose Sid starts with AWSCloudTrailWrite, gives CloudTrail permission to write to the ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access