cloudtrail

Provisions an organization-level AWS CloudTrail trail with CloudWatch Logs integration.

Creates an organization-wide, multi-region trail that delivers logs to a central S3 bucket (provisioned separately via the storage/s3-bucket module) and streams events to a CloudWatch log group. Configures a dedicated IAM role for CW delivery, optional KMS encryption, log file validation, and data event capture for S3 objects and Lambda functions by default.

Usage

module "cloudtrail" {
  source  = "hcassc.jfrog.io/iac-terraform-modules-virtual/governance/cloudtrail/aws"
  version = "0.1.0"

  trail_name     = "org-trail"
  s3_bucket_name = module.cloudtrail_bucket.id
  kms_key_id     = module.kms.key_arn
}

Requirements

Name	Version
terraform	~> 1.5
aws	~> 6.50

Providers

Name	Version
aws	6.50.0

Resources

Name	Type
aws_cloudtrail.this	resource
aws_cloudwatch_log_group.this	resource
aws_iam_role.cloudtrail_cw	resource
aws_iam_role_policy.cloudtrail_cw	resource

Inputs

Name	Description	Type	Default	Required
s3_bucket_name	Name of the S3 bucket for CloudTrail log delivery	string	n/a	yes
cloudwatch_logs_retention_days	Retention period in days for the CloudWatch log group	number	365	no
data_resources	Data event resources to capture. Map key is a logical name.type is the CloudTrail resource type (e.g. AWS::S3::Object).values is the list of ARNs or ARN prefixes to include.	map(object({ type = string values = list(string) }))	{ "all_lambda": { "type": "AWS::Lambda::Function", "values": [ "arn:aws:lambda" ] }, "all_s3": { "type": "AWS::S3::Object", "values": [ "arn:aws:s3:::" ] }}	no
enable_log_file_validation	Enable log file integrity validation	bool	true	no
include_global_service_events	Include global service events (IAM, STS, etc.)	bool	true	no
is_multi_region_trail	Capture events from all regions	bool	true	no
is_organization_trail	Enable organization-level trail spanning all member accounts	bool	true	no
kms_key_id	KMS key ARN for trail log encryption (optional)	string	null	no
management_events_rw_type	Read/Write type for management events — All, ReadOnly, WriteOnly, or None	string	"All"	no
s3_key_prefix	S3 key prefix for CloudTrail log objects	string	"cloudtrail"	no
tags	Resource tags to apply to all resources	map(string)	{}	no
trail_name	Name of the CloudTrail trail	string	"org-trail"	no

Outputs

Name	Description
arn	CloudTrail trail ARN
cloudwatch_log_group_arn	ARN of the CloudWatch log group receiving trail events
cloudwatch_role_arn	ARN of the IAM role used for CloudWatch Logs delivery
home_region	Region in which the trail was created
id	CloudTrail trail ID (name)