AWS CloudTrail and AWS Organizations
AWS CloudTrail is an AWS service that helps you enable governance, compliance, and operational and risk auditing of your AWS account. Using AWS CloudTrail, a user in a management account can create an organization trail that logs all events for all AWS accounts in that organization. Organization trails are automatically applied to all member accounts in the organization. Member accounts can see the organization trail, but can't modify or delete it. By default, member accounts don't have access to the log files for the organization trail in the Amazon S3 bucket. This helps you uniformly apply and enforce your event logging strategy across the accounts in your organization.
For more information, see Creating a Trail for an Organization in the AWS CloudTrail User Guide.
Use the following information to help you integrate AWS CloudTrail with AWS Organizations.
Service-linked roles created when you enable integration
The following service-linked role is automatically created in your organization's management account when you enable trusted access. This role allows CloudTrail to perform supported operations within your organization's accounts in your organization.
You can delete or modify this role only if you disable trusted access between CloudTrail and Organizations, or if you remove the member account from the organization.
-
AWSServiceRoleForCloudTrail
Service principals used by the service-linked roles
The service-linked role in the previous section can be assumed only by the service principals authorized by the trust relationships defined for the role. The service-linked roles used by CloudTrail grant access to the following service principals:
-
cloudtrail.amazonaws.com
Enabling trusted access with CloudTrail
For information about the permissions needed to enable trusted access, see Permissions required to enable trusted access.
If you enable trusted access by creating a trail from the AWS CloudTrail console, trusted access is configured automatically for you (recommended). You can also enable trusted access using the AWS Organizations console. You must sign in with your AWS Organizations management account to create an organization trail.
If you choose to create an organization trail using the AWS CLI or the AWS API, you must manually configure trusted access. For more information, see Enabling CloudTrail as a trusted service in AWS Organizations in the AWS CloudTrail User Guide.
Important
We strongly recommend that whenever possible, you use the AWS CloudTrail console or tools to enable integration with Organizations.
You can enable trusted access by running a Organizations AWS CLI command, or by calling an Organizations API operation in one of the AWS SDKs.
Disabling trusted access with CloudTrail
For information about the permissions needed to disable trusted access, see Permissions required to disable trusted access.
AWS CloudTrail requires trusted access with AWS Organizations to work with organization trails
and organization event data stores. If you disable trusted access using AWS Organizations
while you're using AWS CloudTrail, all organization trails for member accounts are deleted
because CloudTrail can't access the organization. All management account organization trails
and organization event data stores are converted to account-level trails and event data stores.
The AWSServiceRoleForCloudTrail role created for integration between CloudTrail and
AWS Organizations stays in the account. If you re-enable trusted access,
CloudTrail will not take action on existing trails and event data stores.
The management account must update any account-level trails
and event data stores to apply them to the organization.
To convert an account-level trail or event data store to an organization trail or organization event data store, do the following:
-
From the CloudTrail console, update the trail or event data store and choose the Enable for all accounts in my organization option.
-
From the AWS CLI, do the following:
-
To update a trail, run the update-trail command and include the
--is-organization-trailparameter. -
To update an event data store, run the update-event-data-store command and include the
--organization-enabledparameter.
-
Only an administrator in the AWS Organizations management account can disable trusted access with AWS CloudTrail. You can disable trusted access only with the Organizations tools, using either the AWS Organizations console, running an Organizations AWS CLI command, or calling an Organizations API operation in one of the AWS SDKs.
You can disable trusted access by using either the AWS Organizations console, by running an Organizations AWS CLI command, or by calling an Organizations API operation in one of the AWS SDKs.
Enabling a delegated administrator account for CloudTrail
When you use CloudTrail with Organizations, you can register any account within the organization to act as a CloudTrail delegated administrator to manage the organization's trails and event data stores on behalf of the organization. A delegated administrator is a member account in an organization that can perform the same administrative tasks in CloudTrail as the management account.
Minimum permissions
Only an administrator in the Organizations management account can register a delegated administrator for CloudTrail.
You can register a delegated administrator account using the CloudTrail console, or by using the Organizations
RegisterDelegatedAdministrator CLI or SDK operation. To register a delegated administrator using the CloudTrail console, see
Add a CloudTrail delegated administrator.
Disabling a delegated administrator for CloudTrail
Only an administrator in the Organizations management account can remove a delegated
administrator for CloudTrail. You can remove the delegated administrator using either the CloudTrail console, or by using the Organizations DeregisterDelegatedAdministrator CLI or SDK operation.
For information on how to remove a delegated administrator using the CloudTrail console, see Remove a CloudTrail delegated administrator .
