# Prepare for creating a trail for your organization Before you create a trail for your organization, be sure that your organization management account or delegated administrator account is set up correctly for trail creation. + Your organization must have all features enabled before you can create a trail for it. For more information, see [Enabling All Features in Your Organization](https://docs.amazonaws.cn/organizations/latest/userguide/orgs_manage_org_support-all-features.html). + The management account must have the **AWSServiceRoleForOrganizations** role. This role is created automatically by Organizations when you create your organization, and is required for CloudTrail to log events for an organization. For more information, see [Organizations and service-linked roles](https://docs.amazonaws.cn/organizations/latest/userguide/orgs_integrate_services.html#orgs_integrate_services-using_slrs). + The user or role that creates the organization trail in the management or delegated administrator account must have sufficient permissions to create an organization trail. You must at least apply either the **AWSCloudTrail\$1FullAccess** policy, or an equivalent policy, to that role or user. You must also have sufficient permissions in IAM and Organizations to create the service-linked role and enable trusted access. If you choose to create a new S3 bucket for an organization trail using the CloudTrail console,
 your policy also needs to include the `s3:PutEncryptionConfiguration`
 action because by default server-side encryption is enabled for the bucket. The following example policy shows the minimum required permissions. **Note** You shouldn't share the **AWSCloudTrail\$1FullAccess** policy broadly across your Amazon Web Services account. Instead, you should restrict it to Amazon Web Services account administrators due to the highly sensitive nature of the information collected by CloudTrail. Users with this role have the ability to turn off or reconfigure the most sensitive and important auditing functions in their Amazon Web Services accounts. For this reason, you must closely control and monitor access to this policy. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "iam:GetRole", "organizations:EnableAWSServiceAccess", "organizations:ListAccounts", "iam:CreateServiceLinkedRole", "organizations:DisableAWSServiceAccess", "organizations:DescribeOrganization", "organizations:ListAWSServiceAccessForOrganization", "s3:PutEncryptionConfiguration" ], "Resource": "*" } ] } ``` ------ + To use the Amazon CLI or the CloudTrail APIs to create an organization trail, you must enable trusted access for CloudTrail in Organizations, and you must manually create an Amazon S3 bucket with a policy that allows logging for an organization trail. For more information, see [Creating a trail for an organization with the Amazon CLI](cloudtrail-create-and-update-an-organizational-trail-by-using-the-aws-cli.md). + To use an existing IAM role to add monitoring of an organization trail to Amazon CloudWatch Logs, you must manually modify the IAM role to allow delivery of CloudWatch Logs for member accounts to the CloudWatch Logs group for the management account, as shown in the following example. **Note** You must use an IAM role and CloudWatch Logs log group that exists in your own account. You cannot use an IAM role or CloudWatch Logs log group owned by a different account. ------ #### [ JSON ] **** ``` { "Version":"2012-10-17", "Statement": [ { "Sid": "AWSCloudTrailCreateLogStream20141101", "Effect": "Allow", "Action": [ "logs:CreateLogStream" ], "Resource": [ "arn:aws-cn:logs:us-east-2:111111111111:log-group:CloudTrail/DefaultLogGroupTest:log-stream:111111111111_CloudTrail_us-east-2*", "arn:aws-cn:logs:us-east-2:111111111111:log-group:CloudTrail/DefaultLogGroupTest:log-stream:o-exampleorgid_*" ] }, { "Sid": "AWSCloudTrailPutLogEvents20141101", "Effect": "Allow", "Action": [ "logs:PutLogEvents" ], "Resource": [ "arn:aws-cn:logs:us-east-2:111111111111:log-group:CloudTrail/DefaultLogGroupTest:log-stream:111111111111_CloudTrail_us-east-2*", "arn:aws-cn:logs:us-east-2:111111111111:log-group:CloudTrail/DefaultLogGroupTest:log-stream:o-exampleorgid_*" ] } ] } ``` ------ You can learn more about CloudTrail and Amazon CloudWatch Logs in [Monitoring CloudTrail Log Files with Amazon CloudWatch Logs](monitor-cloudtrail-log-files-with-cloudwatch-logs.md). In addition, consider the limits on CloudWatch Logs and the pricing considerations for the service before deciding to enable the experience for an organization trail. For more information, see [CloudWatch Logs Limits](https://docs.amazonaws.cn/AmazonCloudWatch/latest/logs/cloudwatch_limits_cwl.html) and [Amazon CloudWatch Pricing](https://aws.amazon.com/cloudwatch/pricing/). + To log data events in your organization trail for specific resources in member accounts, have ready a list of Amazon Resource Names (ARNs) for each of those resources. Member account resources are not displayed in the CloudTrail console when you create a trail; you can browse for resources in the management account on which data event collection is supported, such as S3 buckets. Similarly, if you want to add specific member resources when creating or updating an organization trail at the command line, you need the ARNs for those resources. **Note** Additional charges apply for logging data events. For CloudTrail pricing, see [Amazon CloudTrail Pricing](http://www.amazonaws.cn/cloudtrail/pricing/). You should also consider reviewing how many trails already exist in the management account and in the member accounts before creating an organization trail. CloudTrail limits the number of trails that can be created in each Region. You cannot exceed this limit in the Region where you create the organization trail in the management account. However, the trail will be created in the member accounts even if member accounts have reached the limit of trails in a Region. While the first trail of management events in any Region is free, charges apply to additional trails. To reduce the potential cost of an organization trail, consider deleting any unneeded trails in the management and member accounts. For more information about CloudTrail pricing, see [Amazon CloudTrail Pricing](http://www.amazonaws.cn/cloudtrail/pricing/). ## Security best practices in organization trails As a security best practice, we recommend adding the `aws:SourceArn` condition key to resource policies (such as those for S3 buckets, KMS keys, or SNS topics) that you use with an organization trail. The value of `aws:SourceArn` is the organization trail ARN (or ARNs, if you are using the same resource for more than one trail, such as the same S3 bucket to store logs for more than one trail). This ensures that the resource, such as an S3 bucket, accepts only data that is associated with the specific trail. The trail ARN must use the account ID of the management account. The following policy snippet shows an example where more than one trail is using the resource. ``` "Condition": { "StringEquals": { "aws:SourceArn": ["Trail_ARN_1",..., "Trail_ARN_n"] } } ``` For information about how to add condition keys to resource policies, see the following: + [Amazon S3 bucket policy for CloudTrail](create-s3-bucket-policy-for-cloudtrail.md) + [Configure Amazon KMS key policies for CloudTrail](create-kms-key-policy-for-cloudtrail.md) + [Amazon SNS topic policy for CloudTrail](cloudtrail-permissions-for-sns-notifications.md)