Receiving Slack notifications when CloudTrail logging gets turned off

1

Slack

After logging has stopped, EventBridge will route a message to a dedicated Slack channel with the user's name, account number and the time of the event. Optionally, it will also invoke a Lambda function, which will re-enable logging in CloudTrail.

#Communication #Group Chat & Notifications #Chat 208 social mentions

2

Node.js

Let's see some minimal Node.js code for the function that we can use to restart CloudTrail logging.

#Runtime #JavaScript Runtime #JavaScript 785 social mentions

3

Amazon SNS

Of course, Slack is not the only way to receive notifications. EventBridge integrates with many target services, both AWS and 3rd parties. For example, we can set up email or phone text message alerts in SNS, or add a different target if business needs require.

#Data Integration #Stream Processing #Web Service Automation 54 social mentions

4

AWS Lambda

After logging has stopped, EventBridge will route a message to a dedicated Slack channel with the user's name, account number and the time of the event. Optionally, it will also invoke a Lambda function, which will re-enable logging in CloudTrail.

#Cloud Computing #Cloud Hosting #Backend As A Service 244 social mentions

5

AWS Identity and Access Management

An API destination is a separate resource, so EventBridge will need permission to invoke it. EventBridge will create a new IAM role if we don't already have one. Its permission policy looks like this:.

#Identity And Access Management #Identity Provider #SSO 52 social mentions

6

AWS Control Tower

Amazon CloudTrail is the surveillance camera for our accounts. It records every API call that any users or roles make. If we have multiple accounts set up in AWS Organizations, we can create a central trail in the management account. We can then enable logging to all accounts and all regions. Or, if we use Control Tower to set up the account structure, we don't need to do anything because it will automatically create the trail.

#Security #Online Services #Monitoring Tools 16 social mentions

7

AWS CloudTrail

Amazon CloudTrail is the surveillance camera for our accounts. It records every API call that any users or roles make. If we have multiple accounts set up in AWS Organizations, we can create a central trail in the management account. We can then enable logging to all accounts and all regions. Or, if we use Control Tower to set up the account structure, we don't need to do anything because it will automatically create the trail.

#API Tools #APIs #Developer Tools 13 social mentions