TheArchitect

CloudTrail Audit

AWS architecture template · SAA-C03: CloudTrail multi-region logging → S3 + KMS + CloudWatch + SNS alerts

CloudTrail Audit is a free AWS architecture template built with CloudTrail, CloudWatch, IAM, KMS, S3 and SNS. Open it in TheArchitect to edit the diagram, estimate monthly cost, and export the CloudFormation or Terraform that deploys it.

Open in TheArchitect All templates
KMSTrail RoleCloudTrailAudit Log Buck…CloudWatchAlert Topic
CloudTrail Audit architecture diagram

AWS services in this template

  • CloudTrail
  • CloudWatch
  • IAM
  • KMS
  • S3
  • SNS

Deployment notes

Needs input

  • The S3 audit bucket needs a bucket policy granting cloudtrail.amazonaws.com write access before the trail can start.

Generated CloudFormation — 6 resources

Logical IDResource type
KMSkmsAWS::KMS::Key
TrailRoleiamAWS::IAM::Role
CloudTrailcloudtrailAWS::CloudTrail::Trail
AuditLogBuckets3AWS::S3::Bucket
CloudWatchcloudwatchAWS::CloudWatch::Alarm
AlertTopicsnsAWS::SNS::Topic
View the full CloudFormation template
{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "Generated by TheArchitect — https://www.thecloudarchitect.dev",
  "Metadata": {
    "TheArchitect": {
      "Edges": [
        {
          "From": "KMSkms",
          "To": "CloudTrailcloudtrail",
          "Label": "encrypt"
        },
        {
          "From": "TrailRoleiam",
          "To": "CloudTrailcloudtrail",
          "Label": "role"
        },
        {
          "From": "CloudTrailcloudtrail",
          "To": "AuditLogBuckets3",
          "Label": "logs"
        },
        {
          "From": "CloudWatchcloudwatch",
          "To": "AlertTopicsns",
          "Label": "alarm"
        }
      ]
    }
  },
  "Resources": {
    "KMSkms": {
      "Type": "AWS::KMS::Key",
      "Properties": {
        "Description": "KMS key for CloudTrail log file encryption.",
        "KeySpec": "SYMMETRIC_DEFAULT",
        "KeyUsage": "ENCRYPT_DECRYPT",
        "EnableKeyRotation": true,
        "Enabled": true
      }
    },
    "TrailRoleiam": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "RoleName": "saa-audit-trail-role",
        "Description": "IAM role for CloudTrail CloudWatch Logs delivery."
      }
    },
    "CloudTrailcloudtrail": {
      "Type": "AWS::CloudTrail::Trail",
      "DependsOn": [
        "TrailRoleiam"
      ],
      "Properties": {
        "TrailName": "saa-audit-trail",
        "S3BucketName": "saa-audit-cloudtrail-logs",
        "IsLogging": true,
        "IsMultiRegionTrail": true,
        "EnableLogFileValidation": true,
        "IncludeGlobalServiceEvents": true
      }
    },
    "AuditLogBuckets3": {
      "Type": "AWS::S3::Bucket",
      "Properties": {
        "BucketName": "saa-audit-cloudtrail-logs",
        "VersioningConfiguration": {
          "Status": "Enabled"
        },
        "OwnershipControls": {
          "Rules": [
            {
              "ObjectOwnership": "BucketOwnerEnforced"
            }
          ]
        },
        "BucketEncryption": {
          "ServerSideEncryptionConfiguration": [
            {
              "ServerSideEncryptionByDefault": {
                "SSEAlgorithm": "AES256"
              }
            }
          ]
        },
        "PublicAccessBlockConfiguration": {
          "BlockPublicAcls": true,
          "BlockPublicPolicy": true,
          "IgnorePublicAcls": true,
          "RestrictPublicBuckets": true
        },
        "Tags": [
          {
            "Key": "Name",
            "Value": "saa-audit-cloudtrail-logs"
          }
        ]
      }
    },
    "CloudWatchcloudwatch": {
      "Type": "AWS::CloudWatch::Alarm",
      "Properties": {
        "AlarmName": "saa-audit-root-login",
        "AlarmDescription": "Alert on root account usage detected via CloudTrail metric filter.",
        "Namespace": "CloudTrailMetrics",
        "MetricName": "RootAccountUsageCount",
        "Statistic": "Sum",
        "Period": 300,
        "EvaluationPeriods": 1,
        "Threshold": 1,
        "ComparisonOperator": "GreaterThanOrEqualToThreshold",
        "TreatMissingData": "notBreaching"
      }
    },
    "AlertTopicsns": {
      "Type": "AWS::SNS::Topic",
      "Properties": {
        "TopicName": "saa-audit-security-alerts",
        "DisplayName": "Audit security alerts"
      }
    }
  }
}

Generated by TheArchitect from the diagram above. Review values such as names, CIDR ranges and instance sizes before deploying to your account.

Related templates