# Amazon CloudTrail and Amazon Organizations
<a name="services-that-can-integrate-cloudtrail"></a>

Amazon CloudTrail is an Amazon service that helps you enable governance, compliance, and operational and risk auditing of your Amazon Web Services account. Using Amazon CloudTrail, a user in a management account can create an organization trail that logs all events for all Amazon Web Services accounts in that organization. Organization trails are automatically applied to all member accounts in the organization. Member accounts can see the organization trail, but can't modify or delete it. By default, member accounts don't have access to the log files for the organization trail in the Amazon S3 bucket. This helps you uniformly apply and enforce your event logging strategy across the accounts in your organization.

For more information, see [ Creating a Trail for an Organization](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/creating-trail-organization.html) in the *Amazon CloudTrail User Guide*. 

Use the following information to help you integrate Amazon CloudTrail with Amazon Organizations.



## Service-linked roles created when you enable integration
<a name="integrate-enable-slr-cloudtrail"></a>

The following [service-linked role](https://docs.amazonaws.cn/IAM/latest/UserGuide/using-service-linked-roles.html) is automatically created in your organization's management account when you enable trusted access. This role allows CloudTrail to perform supported operations within your organization's accounts in your organization.

You can delete or modify this role only if you disable trusted access between CloudTrail and Organizations, or if you remove the member account from the organization.
+ `AWSServiceRoleForCloudTrail`

## Service principals used by the service-linked roles
<a name="integrate-enable-svcprin-cloudtrail"></a>

The service-linked role in the previous section can be assumed only by the service principals authorized by the trust relationships defined for the role. The service-linked roles used by CloudTrail grant access to the following service principals:
+ `cloudtrail.amazonaws.com`

## Enabling trusted access with CloudTrail
<a name="integrate-enable-ta-cloudtrail"></a>

For information about the permissions needed to enable trusted access, see [Permissions required to enable trusted access](orgs_integrate_services.md#orgs_trusted_access_perms).

If you enable trusted access by creating a trail from the Amazon CloudTrail console, trusted access is configured automatically for you (recommended). You can also enable trusted access using the Amazon Organizations console. You must sign in with your Amazon Organizations management account to create an organization trail.

If you choose to create an organization trail using the Amazon CLI or the Amazon API, you must manually configure trusted access. For more information, see [ Enabling CloudTrail as a trusted service in Amazon Organizations](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/cloudtrail-create-and-update-an-organizational-trail-by-using-the-aws-cli.html#cloudtrail-create-organization-trail-by-using-the-cli-enable-trusted-service) in the *Amazon CloudTrail User Guide.*

**Important**  
 We strongly recommend that whenever possible, you use the Amazon CloudTrail console or tools to enable integration with Organizations. 

You can enable trusted access by running a Organizations Amazon CLI command, or by calling an Organizations API operation in one of the Amazon SDKs.

------
#### [ Amazon CLI, Amazon API ]

**To enable trusted service access using the Organizations CLI/SDK**  
Use the following Amazon CLI commands or API operations to enable trusted service access:
+ Amazon CLI: [enable-aws-service-access](https://docs.amazonaws.cn/cli/latest/reference/organizations/enable-aws-service-access.html)

  Run the following command to enable Amazon CloudTrail as a trusted service with Organizations.

  ```
  $ aws organizations enable-aws-service-access \
      --service-principal cloudtrail.amazonaws.com
  ```

  This command produces no output when successful.
+ Amazon API: [EnableAWSServiceAccess](https://docs.amazonaws.cn/organizations/latest/APIReference/API_EnableAWSServiceAccess.html)

------

## Disabling trusted access with CloudTrail
<a name="integrate-disable-ta-cloudtrail"></a>

For information about the permissions needed to disable trusted access, see [Permissions required to disable trusted access](orgs_integrate_services.md#orgs_trusted_access_disable_perms).

 Amazon CloudTrail requires trusted access with Amazon Organizations to work with organization trails and organization event data stores. If you disable trusted access using Amazon Organizations while you're using Amazon CloudTrail, all organization trails for member accounts are deleted because CloudTrail can't access the organization. All management account organization trails and organization event data stores are converted to account-level trails and event data stores. The `AWSServiceRoleForCloudTrail` role created for integration between CloudTrail and Amazon Organizations stays in the account. If you re-enable trusted access, CloudTrail will not take action on existing trails and event data stores. The management account must update any account-level trails and event data stores to apply them to the organization. 

To convert an account-level trail or event data store to an organization trail or organization event data store, do the following:
+ From the CloudTrail console, update the [trail](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/cloudtrail-update-a-trail-console.html) or [event data store](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/query-event-data-store-update.html) and choose the **Enable for all accounts in my organization** option.
+ From the Amazon CLI, do the following:
  + To update a trail, run the [https://docs.amazonaws.cn/cli/latest/reference/cloudtrail/update-trail.html](https://docs.amazonaws.cn/cli/latest/reference/cloudtrail/update-trail.html) command and include the `--is-organization-trail` parameter.
  + To update an event data store, run the [https://docs.amazonaws.cn/cli/latest/reference/cloudtrail/update-event-data-store.html](https://docs.amazonaws.cn/cli/latest/reference/cloudtrail/update-event-data-store.html) command and include the `--organization-enabled` parameter.

Only an administrator in the Amazon Organizations management account can disable trusted access with Amazon CloudTrail. You can disable trusted access only with the Organizations tools, using either the Amazon Organizations console, running an Organizations Amazon CLI command, or calling an Organizations API operation in one of the Amazon SDKs.

You can disable trusted access by using either the Amazon Organizations console, by running an Organizations Amazon CLI command, or by calling an Organizations API operation in one of the Amazon SDKs.

------
#### [ Amazon Web Services Management Console ]

**To disable trusted service access using the Organizations console**

1. Sign in to the [Amazon Organizations console](https://console.amazonaws.cn/organizations/v2). You must sign in as an IAM user, assume an IAM role, or sign in as the root user ([not recommended](https://docs.amazonaws.cn/IAM/latest/UserGuide/best-practices.html#lock-away-credentials)) in the organization’s management account.

1. In the navigation pane, choose **Services**.

1. Choose **Amazon CloudTrail** in the list of services.

1. Choose **Disable trusted access**.

1. In the **Disable trusted access for Amazon CloudTrail** dialog box, type **disable** to confirm, and then choose **Disable trusted access**.

1. If you are the administrator of only Amazon Organizations, tell the administrator of Amazon CloudTrail that they can now disable that service from working with Amazon Organizations using the service console or tools .

------
#### [ Amazon CLI, Amazon API ]

**To disable trusted service access using the Organizations CLI/SDK**  
You can use the following Amazon CLI commands or API operations to disable trusted service access:
+ Amazon CLI: [disable-aws-service-access](https://docs.amazonaws.cn/cli/latest/reference/organizations/disable-aws-service-access.html)

  Run the following command to disable Amazon CloudTrail as a trusted service with Organizations.

  ```
  $ aws organizations disable-aws-service-access \
      --service-principal cloudtrail.amazonaws.com
  ```

  This command produces no output when successful.
+ Amazon API: [DisableAWSServiceAccess](https://docs.amazonaws.cn/organizations/latest/APIReference/API_DisableAWSServiceAccess.html)

------

## Enabling a delegated administrator account for CloudTrail
<a name="integrate-enable-da-cloudtrail"></a>

When you use CloudTrail with Organizations, you can register any account within the organization to act as a CloudTrail delegated administrator to manage the organization's trails and event data stores on behalf of the organization. A delegated administrator is a member account in an organization that can perform the same administrative tasks in CloudTrail as the management account. 

**Minimum permissions**  
Only an administrator in the Organizations management account can register a delegated administrator for CloudTrail.

You can register a delegated administrator account using the CloudTrail console, or by using the Organizations `RegisterDelegatedAdministrator` CLI or SDK operation. To register a delegated administrator using the CloudTrail console, see [ Add a CloudTrail delegated administrator](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/cloudtrail-add-delegated-administrator.html). 

## Disabling a delegated administrator for CloudTrail
<a name="integrate-disable-da-cloudtrail"></a>

 Only an administrator in the Organizations management account can remove a delegated administrator for CloudTrail. You can remove the delegated administrator using either the CloudTrail console, or by using the Organizations `DeregisterDelegatedAdministrator` CLI or SDK operation. For information on how to remove a delegated administrator using the CloudTrail console, see [Remove a CloudTrail delegated administrator](https://docs.amazonaws.cn/awscloudtrail/latest/userguide/cloudtrail-remove-delegated-administrator.html) .