duo-labs / duo-labs/cloudtracker

Allow for Organization created trails

Open
#46 0 comments 8 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
912
Forks
108
PR merge metrics
No merged PRs in 30d

Description

Normal CloudTrail logs are stored in:
```
s3://my_log_bucket/OPTIONAL_PREFIX/AWSLogs/111111111111/CloudTrail/
```

Organization CloudTrail logs are stored in:
```
s3://my_log_bucket/OPTIONAL_PREFIX/AWSLogs/o-ORGANIZATION_ID/111111111111/CloudTrail/
```

I need to account for that `o-ORGANIZATION_ID` sub-directory.

One method may be to have in the `config.yaml` the full path to the CloudTrail logs, such as:
```
accounts:
- name: demo
id: 111111111111
iam: account-data/demo_iam.json
cloudtrail_logs: s3://my_log_bucket/OPTIONAL_PREFIX/AWSLogs/o-ORGANIZATION_ID/111111111111/CloudTrail/
``

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.