What problem does it solve? Setting up centralized API activity logging across all AWS regions involves many error-prone manual steps: creating S3 buckets with correct policies, IAM roles, CloudWatch log groups, and trail configuration. This Skill provides a verified, sequential procedure that gets CloudTrail logging right the first time for security monitoring and compliance auditing. ## Core Features & Use Cases - Multi-Region Trail Setup: Creates a CloudTrail trail capturing API events across all AWS regions with log file validation and global service events. - Secure Log Storage: Provisions an S3 bucket with versioning, KMS encryption, lifecycle policies, and a hardened bucket policy using source account and ARN conditions. - CloudWatch Logs Analysis: Integrates with CloudWatch Logs and provides ready-to-use Logs Insights queries for failed API calls, root account activity, deletions, and IAM changes. - Use Case: A security team needs centralized audit logging before a compliance review. Run this procedure to deploy a multi-region trail with S3 archival, real-time CloudWatch analysis, and optional anomaly detection via CloudTrail Insights. ## Quick Start Set up a multi-region CloudTrail trail named security-audit-trail storing logs in a new S3 bucket in us-east-1 with CloudWatch Logs integration.
