Receiving Slack notifications when CloudTrail logging gets turned off

When someone turns off CloudTrail logs, it should be a warning sign, which we want to know when it happens. Luckily we can use EventBridge to route CloudTrail events to various targets and take the necessary steps to remediate the issue.

1. Problem statement

Amazon CloudTrail is the surveillance camera for our accounts. It records every API call that any users or roles make. If we have multiple accounts set up in AWS Organizations, we can create a central …

amazon amazon cloudtrail aws camera cloudtrail events issue logging logs notifications problem security serverless sign slack statement surveillance surveillance camera warning