Controlling user permissions for CloudTrail trails - Amazon CloudTrail
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Controlling user permissions for CloudTrail trails

Amazon CloudTrail integrates with Amazon Identity and Access Management (IAM) to help you to control access to CloudTrail and other Amazon resources that CloudTrail requires. Examples of these resources include Amazon S3 buckets and Amazon Simple Notification Service (Amazon SNS) topics. You can use IAM to control which Amazon users can create, configure, or delete CloudTrail trails, start and stop logging, and access the buckets that contain log information. To learn more, see Identity and Access Management for Amazon CloudTrail.

The following topics help you understand permissions, policies, and CloudTrail security: