Now that we have gone through the process of setting up a new CloudTrail trail, we can move away from the AWS web console to the AWS CLI, where we will now cover how to audit CloudTrail to ensure that all best practices are being followed.
First, we will want to see if there are any active trails in our target account. We can do this with the CloudTrail DescribeTrails API, which allows us to view trails across all AWS regions, even if they are managed by the account's organization. The command will look something like this:
aws cloudtrail describe-trails --include-shadow-trails
The --include-shadow-trails flag is what allows us to see trails from other regions/our organization. The only trails that won't show up are region-specific ...
