AutoGineer
Generated banner for Setting Up Cloudtrail Multi Region
Generated logo for Setting Up Cloudtrail Multi Region

Setting Up Cloudtrail Multi Region

AWSOfficialPublished by AWS

  • Skill
  • Workflow
  • Cloud and DevOps
  • Apache-2.0
  • No issues found
Download ZIP

From the author

Enables a multi-region AWS CloudTrail trail with S3 log storage, CloudWatch Logs integration, and CloudWatch Logs Insights queries for security monitoring and compliance auditing. Use when setting up centralized API activity logging across all AWS regions.
— the description by AWS

AutoGineer summary

Written by AutoGineer from the skill’s own files, not by the author

This skill provides a rigorous, step-by-step workflow for configuring AWS CloudTrail to capture API activity across all regions. It ensures centralized log storage in S3, integrates with CloudWatch Logs for real-time monitoring, and enables CloudTrail Insights for anomaly detection. The workflow includes mandatory verification steps, error handling, and configuration requirements to ensure a compliant and audit-ready logging infrastructure.

What it does

  • Verifies AWS credentials and environment dependencies.
  • Creates and configures a dedicated S3 bucket for secure log storage.
  • Enables multi-region trail logging for comprehensive API activity capture.
  • Integrates CloudTrail with CloudWatch Logs for real-time analysis.
  • Applies necessary encryption, versioning, and tagging to logging resources.
  • Provides troubleshooting guidance for common setup issues like permission errors or log delivery delays.

When to use it

  • When establishing centralized security monitoring across an entire AWS organization.
  • During the initial setup of a new AWS environment to ensure audit compliance.
  • When upgrading from single-region logging to a multi-region visibility strategy.
  • When preparing for security audits requiring comprehensive API activity logs.

Advantages

  • Ensures consistent logging configuration across all AWS regions.
  • Provides a structured, repeatable process that minimizes manual configuration errors.
  • Includes mandatory verification steps to confirm successful deployment.
  • Facilitates compliance auditing through centralized log management.

Usage examples

“Set up a multi-region CloudTrail named security-audit-trail in us-east-1 using bucket my-org-logs.”
The agent will initiate the multi-step workflow, verifying credentials, creating the S3 bucket, and configuring the trail to log all regions.
“I need to enable CloudTrail across all regions for compliance. Can you help?”
The agent will guide you through the required parameters and execute the sequential setup procedure to ensure all regions are covered.

Install

  1. Download the skill as a ZIP:

    https://autogineer.com/agent-skills/aws/setting-up-cloudtrail-multi-region/download

  2. Unzip it into the cross-client skills folder of your project:

    mkdir -p .agents/skills && unzip setting-up-cloudtrail-multi-region.zip -d .agents/skills

Documentation by AWS

Setting Up CloudTrail Multi-Region

Overview

Domain expertise for enabling AWS CloudTrail across all regions to capture comprehensive API activity logs and configuring CloudWatch Logs Insights for security monitoring, compliance auditing, and operational analysis.

Set up a multi-region trail

To create a centralized multi-region CloudTrail trail with S3 storage, CloudWatch Logs integration, and log analysis, follow the procedure exactly. See CloudTrail multi-region setup procedure.

Troubleshooting

S3 bucket already exists

Choose a different globally unique name, or add a timestamp or organization identifier.

Permission denied errors

Verify your identity with aws sts get-caller-identity. Ensure your user/role has required actions attached. Do NOT use *FullAccess managed policies.

Trail not logging

Verify IAM role permissions, check S3 bucket policy allows CloudTrail access, and ensure the trail is started with start-logging.

Missing events in CloudWatch

Allow 5-15 minutes for initial log delivery. Verify the CloudWatch Logs role ARN is correct and the log group exists in the same region as the trail.

Opt-in region events not appearing

This is normal — events from opt-in regions may take several hours. Wait up to 24 hours before investigating further.

Files

Requirements and compatibility

Works with: Claude Code, Claude apps, OpenAI Codex, GitHub Copilot, Cursor, Gemini CLI, Kiro, OpenCode, Goose, Amp, Roo Code, JetBrains Junie, Factory Droid, Devin (ex-Windsurf), Mistral Vibe, OpenHands, Letta

“Works with” means the tool reads the open Agent Skills format; a skill written for one tool may use features others lack.

Security

No issues found by our static scan· No issues found

A static scan is not a guarantee. Skills are third-party content: review a skill before you let an agent use it.

Attribution and licence

Published by
AWS
Publisher
AWS (Official)
Source
aws/agent-toolkit-for-aws · skills/specialized-skills/operations-skills/setting-up-cloudtrail-multi-region · commit 0a218f8
Licence
Apache License 2.0 (redistribution allowed)
  • LICENSE (added by AutoGineer from LICENSE)
  • NOTICE (added by AutoGineer from NOTICE)
  • ATTRIBUTION.md (written by AutoGineer)
Synced

AutoGineer is not affiliated with or endorsed by AWS or AWS.

Download ZIP

The ZIP holds the skill’s files, its licence files and an ATTRIBUTION.md. Download setting-up-cloudtrail-multi-region.zip