From the command line, use create-subscription.

Creates a trail that specifies the settings for delivery of log data to an Amazon S3 bucket. The request includes a Trail structure that specifies the following:

• Trail name.
• The name of an existing Amazon S3 bucket to which CloudTrail delivers your log files.
• The name of the Amazon S3 key prefix that precedes each log file.
• The name of an existing Amazon SNS topic that notifies you that a new file is available in your bucket.
• Whether the log file should include AWS API calls from global services. Currently, the only global AWS API calls included in CloudTrail log files are from IAM and AWS STS.