How to Integrate AWS CloudTrail | Defense.com Help Centre

Creating an S3 Bucket

Sign in to the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3/
Click Create bucket.
In Region, choose the AWS Region where you want the bucket to reside.
Under Object Ownership, select ACLs disabled.
In Block Public Access settings for this bucket, select Block all public access.
Leave the remaining settings as default and click Create Bucket.
Make a note of the ARN of the new S3 bucket, as this will be required later.

Type IAM in the search bar at the top of the AWS console and select IAM from the search results.
In the IAM view, click on the section named Roles in the left-hand toolbar.
Click Create role.
On the Create role page, select the entity type AWS account.
Under An AWS account, click the checkbox marked Another AWS account and enter the Account ID: 653730588838.
In the Options, select Require external ID, then in the External ID box, enter a random string of letters and numbers. Please do not include any special characters. Make a note of the External ID, as this will be required later.
Click “Next” and you’ll be taken to the Add permissions page.
Select the permissions AmazonSQSFullAccess and AmazonS3ReadOnlyAccess, then click Next.
Give the role a name (we recommend DefenseAssumedRole), then click Create role in the bottom right corner.
Once the role is created, you’ll see a View Role option in a green bar at the top of the page. Click on this, then click on Edit in the Summary section of the next page.
Change the value of Maximum session duration to 12 hours and click Save changes.
Make a note of the ARN of this role, as it will be required later

Type Cloudtrail in the search bar at the top of the AWS console and select Cloudtrail from the search results.
Click Create trail
Name the trail Defensecom-Logs. By default, logs will be collected for multiple regions.
Under Storage location, select the Use existing S3 bucket option and enter your S3 bucket name and details.
Disable Log file SSE-KMS encryption unless you would like to configure this; it is not required.
Make sure Log file validation under Additional settings is enabled. Leave the rest of the options as their default and click Next.
In Management events, select the events you’d like to be logged. Please be aware that if this is your first trail, you won’t be charged by AWS for selecting both read and write, but you will be charged if you already have a trail exporting management events.
You can also configure CloudTrail to send Data and Insight events on this page. Please be aware that AWS charges for these types of events.
Once you’re done, click Next, review the details, then click Create trail.

Each S3 bucket will require its own SQS Queue.

Type SQS in the search bar at the top of the AWS console and select Simple Queue Service from the search results.
Click Create queue.
Name the queue after the service you will be logging to it.
Under Access policy, select Advanced, then copy the code below into the text box and replace the text in bold with the relevant names

{
"Version": "2012-10-17",
"Id": "__default_policy_ID",
"Statement": [
{
"Sid": "__owner_statement",
"Effect": "Allow",
"Principal": {
"AWS": "arn:aws:iam::your-aws-account-id:root"
},
"Action": "SQS:*",
"Resource": "your-sqs-queue-arn"
},
{
"Sid": "__sender_statement",
"Effect": "Allow",
"Principal": {
"Service": "s3.amazonaws.com"
},
"Action": "SQS:SendMessage",
"Resource": "your-sqs-queue-arn",
"Condition": {
"StringEquals": {
"aws:SourceAccount": "your-aws-account-id"
},
"ArnLike": {
"aws:SourceArn": "your-s3-bucket-arn"
}
}
},
{
"Sid": "__receiver_statement",
"Effect": "Allow",
"Principal": {
"AWS": "the-arn-of-the-role-we-asked-you-to-create"
},
"Action": [
"SQS:ChangeMessageVisibility",
"SQS:DeleteMessage",
"SQS:ReceiveMessage"
],
"Resource": "your-sqs-queue-arn"
}
]
}
Leave the rest of the settings as their defaults, then click Create queue.

Open the Amazon S3 console at https://console.aws.amazon.com/s3/ and select the S3 bucket you set up earlier.
Go to the Properties tab, scroll down until you find Event notifications and click Create event notification.
Give the event an identifiable name, for example, cloudtrail-logs.
In the Event Types section, we recommend logging All object create events.
In the Destination section, select the SQS queue you created earlier, then Save changes.
To test that this has worked, upload any file to the S3 bucket, then go to the SQS queue and select the Monitoring tab. Please give a few minutes to see the message come through.

Once you've completed the above, please provide us with the following information via a support ticket:

And that's it! You've successfully integrated AWS CloudTrail 🎉