AWS CloudTrail

Records AWS account API activity to S3 as a multi-Region trail.

Provider: aws
Kind: Monitoring
Category: Operations
Official docs: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-a-trail-using-the-console-first-time.html

Properties · 3 set by this component

property	type	values	required	kind default	this component
alertGrouping	boolean	—	no	false	inherited
collectorMode	enum	pull \| push	no	pull	▸ push
dataEvents · component property	boolean	—	no	false	inherited
independentOfMonitored	boolean	—	no	false	inherited
insightsEvents · component property	boolean	—	no	false	inherited
logFileSseKmsEncryption · component property	boolean	—	no	true	inherited
managed	boolean	—	no	false	▸ true
multiRegion · component property	boolean	—	no	true	inherited
retentionDays	integer	—	no	—	inherited
signal	enum	metrics \| logs \| traces \| alerts \| all	no	metrics	▸ logs

Rules that apply · 0

Every rule whose selector covers this component's kind or its category. Whether a rule fires depends on the design: its properties, its edges and its groups.

No rule reads this kind yet. That is a gap, not a guarantee.

Use it in a design

nodes:
  - { id: "cloudtrail", component: "aws-cloudtrail" }

Other Monitoring products · 174

and 134 more → Monitoring page

Source

1# yaml-language-server: $schema=../../schema/component.schema.json
2# AWS CloudTrail trail: records account API activity as events and delivers them to S3, optionally to CloudWatch
3# Logs and EventBridge. "What Is AWS CloudTrail?" and "Creating a trail with the CloudTrail console": every trail
4# created in the console is multi-Region, log file SSE-KMS encryption defaults to Enabled, data events and
5# Insights events are opt-in, and the free Event history covers the past 90 days of management events.
6schemaVersion: "1"
7type: "component"
8id: "aws-cloudtrail"
9kind: "monitoring"
10provider: "aws"
11docs: "https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-a-trail-using-the-console-first-time.html"
12defaults:
13  signal: "logs"
14  collectorMode: "push"
15  managed: true
16properties:
17  multiRegion:
18    type: "boolean"
19    default: true
20  logFileSseKmsEncryption:
21    type: "boolean"
22    default: true
23  dataEvents:
24    type: "boolean"
25    default: false
26  insightsEvents:
27    type: "boolean"
28    default: false

The same page as markdown, for an agent: /catalogue/components/aws-cloudtrail.md