CollectorsCloud Collectors Administration Guide

Collect all the account numbers that will be sending CloudTrail events.

Find your Account # in My Account under Account Settings > Account ID. The account number is a 12 digit number, for example 111111111111.

In the account you want to set up to receive the trails (for the duration of this procedure, we use Account A as an example of the account name), create an S3 bucket.

Record the ARN for the bucket (see the properties tab).

Create an SQS queue (Standard).

Record the URL.

Set a policy for the SQS Queue to allow only the S3 bucket to send events to it:

1. In SQS, select the queue and then Permissions.

2. Click Edit Policy Document (Advanced).

3. Paste the following policy and modify it for your environment.

    { 
           "Version": "2012-10-17", 
           "Id": "queue ARN/SQSDefaultPolicy", 
           "Statement": [ 
               { 
               "Effect": "Allow", 
               "Principal": { 
                   "AWS": "*" 
               }, 
               "Action": ["SQS:SendMessage"], 
               "Resource": "queue ARN", 
               "Condition": { 
                   "ArnLike": { 
                   "aws:SourceArn": "bucket ARN" 
                   } 
               } 
               } 
           ] 
     } 

Configure the S3 Bucket to notify the SQS Queue when files are added to it:

1. In S3, select the Properties tab for the bucket.

2. Select Events > Add notification.

3. Enter a meaningful name (i.e. “Notify SQS new Files”).

4. Select ObjectCreate (All).

5. Under Send to, select SQS Queue.

6. Select the queue and then Save your changes.

Set a policy for the S3 Bucket to allow only the accounts for which you want to send CloudTrail events to this bucket to add objects to it:

1. In S3, select the bucket > Permissions > Bucket Policy.

2. Paste the following policy and modify it to add a row with the account ID for each source account:

   {
       "Version": "2012-10-17",
       "Statement": [
           {
           "Effect": "Allow",
           "Principal": {
               "Service": "cloudtrail.amazonaws.com"
           },
           "Action": "s3:GetBucketAcl",
           "Resource": "Bucket ARN"
           },
           {
               "Effect": "Allow",
               "Principal": {
                   "Service": "cloudtrail.amazonaws.com"
               },
               "Action": "s3:PutObject",
               "Resource": [
                   "Bucket ARN/[optional] myLogFilePrefix/AWSLogs/Account ID 1/*",
                   "Bucket ARN/[optional] myLogFilePrefix/AWSLogs/Account ID 2/*"
               ],
               "Condition": { 
                   "StringEquals": { 
                   "s3:x-amz-acl": "bucket-owner-full-control" 
                   }
               }
           }
       ]
   }
   

Configure a CloudTrail for each account to send its events to the bucket in Account A.

1. Log in to the desired account.

2. In CloudTrail, create a new trail (or re-configure an existing one).

3. Under Storage location select No in Create new bucket and set the bucket name (not ARN) of Account A.