Creating a CloudTrail Trail and EventBridge Alert for Console Sign-Ins

Create a new CloudTrail Trail (do not use the quick create feature!) with the following settings:

If the settings are not mentioned below, then leave as default.

Trail Attributes

• Name: OurTrail
• Storage location: Create new S3 bucket.
• Log file SSE-KMS encryption: Enabled
• New KMS Key Alias: CloudTrailKey
• Log File Validation: Enabled

Log Events

• Event type: Management events
• Management events: Read and Write API Activity

This will be created during your CloudTrail Trail creation in the previous objective. We call it out separately here for a learning check.

Create a new KMS key with an Alias of CloudTrailKey.

• Create a new standard SNS Topic called ConsoleAlerts.
• Create a new subscription for the SNS Topic using the email protocol.
• Confirm the subscription via the chosen email address.
• Test the subscription by publishing a test message.

• Create a new EventBridge Rule named ConsoleSigninAlerts.
• Set the event bus to default.
• Set the rule type to Rule with event pattern.
• For Event source choose AWS events or EventBridge partner events.
• Under Creation method choose Custom pattern (JSON editor) and copy/paste the JSON file from the lab GitHub repo. Update references of REPLACE_ME with your account ID.
• Under Sample events choose AWS Console Sign In via CloudTrail and copy the code.
• Switch Sample event type to Enter my own, paste the copied code and replace account ID references on lines 6, 14, 15, and 16 with your account ID.
• Set the target to be your ConsoleAlerts SNS Topic.
• Test everything by signing out of your AWS account then back in as cloud_user. You should receive an email containing the JSON of the captured event.