setting-up-cloudtrail-multi-region

Set up centralized multi-region AWS CloudTrail logging with S3 and CloudWatch.

2.3k|234|Updated Apr 23, 2026

Search Tags:#security #aws #logging #compliance #auditing #multiregion #cloudtrail

Ready to run

npx skills add https://github.com/aws/agent-toolkit-for-aws --skill setting-up-cloudtrail-multi-region-aws

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: setting-up-cloudtrail-multi-region
Source: https://github.com/aws/agent-toolkit-for-aws/tree/main/skills/specialized-skills/operations-skills/setting-up-cloudtrail-multi-region
Command: npx skills add https://github.com/aws/agent-toolkit-for-aws --skill setting-up-cloudtrail-multi-region-aws

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

Enables centralized multi-region AWS CloudTrail logging with S3 log storage, CloudWatch Logs integration, and CloudWatch Logs Insights queries for security monitoring, compliance auditing, and operational analysis. Use when setting up centralized API activity logging across all AWS regions.

Core Features & Use Cases

Create a centralized multi-region CloudTrail trail with S3 storage, CloudWatch Logs integration, and CloudWatch Logs Insights for analysis.
Automate setup of CloudWatch Log Groups, IAM roles, and multi-region configuration; supports optional data events and Insights, with encryption and tagging where applicable.
Use Case: Organization requires consolidated API activity logs for security auditing, compliance reporting, and operational insight across all regions.

Quick Start

Follow the step-by-step guide to create the multi-region CloudTrail trail, S3 bucket, CloudWatch Logs group, and IAM role to begin centralized logging.

Frequently Asked Questions about setting-up-cloudtrail-multi-region

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I set up centralized multi-region CloudTrail logging in AWS?▼

Centralized multi-region CloudTrail logging is set up by creating an S3 bucket for storage, a CloudWatch Logs group, an IAM role, and a multi-region trail. This captures API activity across all AWS regions for auditing and compliance monitoring.

What is the best way to capture AWS API activity across multiple regions for compliance?▼

The best way to capture AWS API activity for compliance is configuring a single multi-region CloudTrail trail. This consolidates logs from all regions into one centralized S3 bucket and CloudWatch Logs group for unified security auditing and operational analysis.

Can I integrate CloudTrail with CloudWatch Logs for security monitoring?▼

Yes, CloudTrail integrates with CloudWatch Logs by creating a dedicated IAM role and log group during trail setup. This allows you to use CloudWatch Logs Insights queries to analyze API activity and support security monitoring workflows.

Does multi-region CloudTrail support data events and Insights queries?▼

Multi-region CloudTrail supports optional data events and CloudTrail Insights during trail creation. Enabling these features provides deeper visibility into S3 object-level API operations and anomalous API activity for enhanced operational analysis.

How do I verify a CloudTrail trail is logging after setup?▼

You verify a CloudTrail trail is logging by running post-setup verification checks once the multi-region trail, S3 bucket, CloudWatch Logs group, and IAM role are fully configured. This ensures logs are actively capturing API activity across regions.

Do I need to create an IAM role to send CloudTrail logs to CloudWatch?▼

Yes, you need to create a specific IAM role to send CloudTrail logs to CloudWatch. This role grants CloudTrail permissions to deliver API activity events into the centralized CloudWatch Logs group for Insights queries and monitoring.