[AWS][CFn]CloudTrail 설정

샘플 코드

---
AWSTemplateFormatVersion: 2010-09-09
Description: CloudTrail

#------------------------------
# Resources: Your resource list
#------------------------------
Resources:
  # CloudTrailをS3に保存するためのバケットを作成する。ライフサイクルは13ヶ月(400日)。
  ## Logs bucket
  CloudTrailBucket:
    Type: AWS::S3::Bucket
    Properties:
      AccessControl: LogDeliveryWrite
      BucketEncryption:
        ServerSideEncryptionConfiguration:
        - ServerSideEncryptionByDefault:
            SSEAlgorithm: AES256
      PublicAccessBlockConfiguration:
        BlockPublicAcls: True
        BlockPublicPolicy: True
        IgnorePublicAcls: True
        RestrictPublicBuckets: True
      LifecycleConfiguration:
        Rules: 
        - Id: 13months(400days)
          Status: Enabled
          ExpirationInDays: 400
          NoncurrentVersionExpirationInDays: 400
    DeletionPolicy: Retain

  ## Logs bucket policy
  CloudTrailBucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref CloudTrailBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
        - Sid: AWSCloudTrailAclCheck
          Effect: Allow
          Principal:
            Service: cloudtrail.amazonaws.com
          Action: s3:GetBucketAcl
          Resource: !Sub "arn:aws:s3:::${CloudTrailBucket}"
        - Sid: AWSCloudTrailWrite
          Effect: Allow
          Principal:
            Service: cloudtrail.amazonaws.com
          Action: s3:PutObject
          Resource: !Sub "arn:aws:s3:::${CloudTrailBucket}/AWSLogs/${AWS::AccountId}/*"
          Condition:
            StringEquals:
              s3:x-amz-acl: bucket-owner-full-control

  # S3に保存したログはKMSで暗号化し、特定のユーザでしか復号できないようにする
  ## KMS
  myKey:
    Type: AWS::KMS::Key
    Properties:
      Description: for CloudTrail log files
      Enabled: True
      KeyPolicy:
        Version: 2012-10-17
        Id: CloudTrailEncryptKey
        Statement:
        - Sid: Allow administration of the key
          Effect: Allow
          Principal:
            AWS: !Sub "arn:aws:iam::${AWS::AccountId}:user/NaGym_t" #ここは任意のroleやuserに変更してください。
          Action:
          - kms:Create*
          - kms:Describe*
          - kms:Enable*
          - kms:List*
          - kms:Put*
          - kms:Update*
          - kms:Revoke*
          - kms:Disable*
          - kms:Get*
          - kms:Delete*
          - kms:TagResource
          - kms:UntagResource
          - kms:ScheduleKeyDeletion
          - kms:CancelKeyDeletion
          Resource: "*"
        - Sid: Allow use of the key
          Effect: Allow
          Principal:
            Service: cloudtrail.amazonaws.com
            AWS: !Sub "arn:aws:iam::${AWS::AccountId}:user/NaGym_t" #ここは任意のroleやuserに変更してください。
          Action:
          - kms:Encrypt
          - kms:Decrypt
          - kms:ReEncrypt
          - kms:GenerateDataKey*
          - kms:DescribeKey
          Resource: "*"
        - Sid: Allow attachment of persistent resources
          Effect: Allow
          Principal:
            AWS: !Sub "arn:aws:iam::${AWS::AccountId}:user/NaGym_t" #ここは任意のroleやuserに変更してください。
          Action:
          - kms:CreateGrant
          - kms:ListGrants
          - kms:RevokeGrant
          Resource: "*"
          Condition:
            Bool:
              kms:GrantIsForAWSResource: True
    DeletionPolicy: Retain

  # CloudTrailを有効化する
  ## CloudTrail
  CloudTrail:
    Type: AWS::CloudTrail::Trail
    Properties:
      S3BucketName: !Ref CloudTrailBucket
      IncludeGlobalServiceEvents: true
      IsLogging: true
      KMSKeyId: !Ref myKey
      IsMultiRegionTrail: true
      EnableLogFileValidation: true
      TrailName: cloudtraillog

실행 결과