Table of Contents

1. Challenge

   Create Multi-Region CloudTrail Trail

   Create a new CloudTrail Trail (do not use the quick create feature!) with the following settings:

   If the settings are not mentioned below, then leave as default.

   Trail Attributes

   • Name: OurTrail
   • Storage location: Create new S3 bucket.
   • Log file SSE-KMS encryption: Enabled
   • New KMS Key Alias: CloudTrailKey
   • Log File Validation: Enabled

   Log Events

   • Event type: Management events
   • Management events: Read and Write API Activity
2. Challenge

   Create CloudTrail-specific KMS Key

   This will be created during your CloudTrail Trail creation in the previous objective. We call it out separately here for a learning check.

   Create a new KMS key with an Alias of CloudTrailKey.

3. Challenge

   Create SNS Topic and Subscription

   • Create a new standard SNS Topic called ConsoleAlerts.
   • Create a new subscription for the SNS Topic using the email protocol.
   • Confirm the subscription via the chosen email address.
   • Test the subscription by publishing a test message.
4. Challenge

   Create Amazon EventBridge Rule

   • Create a new EventBridge Rule named ConsoleSigninAlerts.
   • Set the event bus to default.
   • Set the rule type to Rule with event pattern.
   • For Event source choose AWS events or EventBridge partner events.
   • Under Creation method choose Custom pattern (JSON editor) and copy/paste the JSON file from the lab GitHub repo. Update references of REPLACE_ME with your account ID.
   • Under Sample events choose AWS Console Sign In via CloudTrail and copy the code.
   • Switch Sample event type to Enter my own, paste the copied code and replace account ID references on lines 6, 14, 15, and 16 with your account ID.
   • Set the target to be your ConsoleAlerts SNS Topic.
   • Test everything by signing out of your AWS account then back in as cloud_user. You should receive an email containing the JSON of the captured event.