Question

A security engineer configured a CloudTrail trail to deliver events to a CloudWatch Logs log group so that metric filters and alarms can be created. Events are successfully delivered to the S3 bucket, but no log streams or events are appearing in the CloudWatch Logs log group. The trail shows no obvious errors in the console. What is the MOST likely cause?

Accepted Answer

The IAM role that CloudTrail assumes to write to CloudWatch Logs lacks the logs:CreateLogStream and logs:PutLogEvents permissions for the target log group

Answer

The CloudWatch Logs log group retention period is set too low, causing events to be deleted before they can be viewed

Answer

The S3 bucket policy is missing the required s3:GetBucketAcl permission for the CloudTrail service principal

Answer

Data events are not enabled on the trail, so no management events are forwarded to CloudWatch Logs