Amazon CloudTrail and Amazon Organizations
Amazon CloudTrail is an Amazon service that helps you enable governance, compliance, and operational and risk auditing of your Amazon Web Services account. Using Amazon CloudTrail, a user in a management account can create an organization trail that logs all events for all Amazon Web Services accounts in that organization. Organization trails are automatically applied to all member accounts in the organization. Member accounts can see the organization trail, but can't modify or delete it. By default, member accounts don't have access to the log files for the organization trail in the Amazon S3 bucket. This helps you uniformly apply and enforce your event logging strategy across the accounts in your organization.
For more information, see Creating a Trail for an Organization in the Amazon CloudTrail User Guide.
Use the following information to help you integrate Amazon CloudTrail with Amazon Organizations.
Service-linked roles created when you enable integration
The following service-linked role is automatically created in your organization's management account when you enable trusted access. This role allows CloudTrail to perform supported operations within your organization's accounts in your organization.
You can delete or modify this role only if you disable trusted access between CloudTrail and Organizations, or if you remove the member account from the organization.
-
AWSServiceRoleForCloudTrail
Service principals used by the service-linked roles
The service-linked role in the previous section can be assumed only by the service principals authorized by the trust relationships defined for the role. The service-linked roles used by CloudTrail grant access to the following service principals:
-
cloudtrail.amazonaws.com
Enabling trusted access with CloudTrail
For information about the permissions needed to enable trusted access, see Permissions required to enable trusted access.
If you enable trusted access by creating a trail from the Amazon CloudTrail console, trusted access is configured automatically for you (recommended). You can also enable trusted access using the Amazon Organizations console. You must sign in with your Amazon Organizations management account to create an organization trail.
If you choose to create an organization trail using the Amazon CLI or the Amazon API, you must manually configure trusted access. For more information, see Enabling CloudTrail as a trusted service in Amazon Organizations in the Amazon CloudTrail User Guide.
Important
We strongly recommend that whenever possible, you use the Amazon CloudTrail console or tools to enable integration with Organizations.
You can enable trusted access by running a Organizations Amazon CLI command, or by calling an Organizations API operation in one of the Amazon SDKs.
Disabling trusted access with CloudTrail
For information about the permissions needed to disable trusted access, see Permissions required to disable trusted access.
Amazon CloudTrail requires trusted access with Amazon Organizations to work with organization trails
and organization event data stores. If you disable trusted access using Amazon Organizations
while you're using Amazon CloudTrail, all organization trails for member accounts are deleted
because CloudTrail can't access the organization. All management account organization trails
and organization event data stores are converted to account-level trails and event data stores.
The AWSServiceRoleForCloudTrail role created for integration between CloudTrail and
Amazon Organizations stays in the account. If you re-enable trusted access,
CloudTrail will not take action on existing trails and event data stores.
The management account must update any account-level trails
and event data stores to apply them to the organization.
To convert an account-level trail or event data store to an organization trail or organization event data store, do the following:
-
From the CloudTrail console, update the trail or event data store and choose the Enable for all accounts in my organization option.
-
From the Amazon CLI, do the following:
-
To update a trail, run the update-trail command and include the
--is-organization-trailparameter. -
To update an event data store, run the update-event-data-store command and include the
--organization-enabledparameter.
-
Only an administrator in the Amazon Organizations management account can disable trusted access with Amazon CloudTrail. You can disable trusted access only with the Organizations tools, using either the Amazon Organizations console, running an Organizations Amazon CLI command, or calling an Organizations API operation in one of the Amazon SDKs.
You can disable trusted access by using either the Amazon Organizations console, by running an Organizations Amazon CLI command, or by calling an Organizations API operation in one of the Amazon SDKs.
Enabling a delegated administrator account for CloudTrail
When you use CloudTrail with Organizations, you can register any account within the organization to act as a CloudTrail delegated administrator to manage the organization's trails and event data stores on behalf of the organization. A delegated administrator is a member account in an organization that can perform the same administrative tasks in CloudTrail as the management account.
Minimum permissions
Only an administrator in the Organizations management account can register a delegated administrator for CloudTrail.
You can register a delegated administrator account using the CloudTrail console, or by using the Organizations
RegisterDelegatedAdministrator CLI or SDK operation. To register a delegated administrator using the CloudTrail console, see
Add a CloudTrail delegated administrator.
Disabling a delegated administrator for CloudTrail
Only an administrator in the Organizations management account can remove a delegated
administrator for CloudTrail. You can remove the delegated administrator using either the CloudTrail console, or by using the Organizations DeregisterDelegatedAdministrator CLI or SDK operation.
For information on how to remove a delegated administrator using the CloudTrail console, see Remove a CloudTrail delegated administrator .