4 ms·
Had a similar issue with CloudTrail logs. These are delivered to your S3 bucket but the objects are owned by AWS's 'CloudTrail account'. This means you can't dr
by spaghetti-guy 7y ago
Had a similar issue with CloudTrail logs. These are delivered to your S3 bucket but the objects are owned by AWS's 'CloudTrail account'.
This means you can't drop the logs into your security account and then query them with Athena from another account.
Took ages to figure that out.
- jasonpeacock 7y agoI'm doing/fixing the same thing with the Cost Usage Reports. It feels like a common pattern to consolidate your logs into a single account for analysis, I wish they made it more straightforward to setup.
- spydum 7y agoIsn’t that one part of what control tower does now?
- kevinslin 7y agoyep. control tower creates centralized logging, scp rules and more. what used to take a dev a couple weeks to set up can now be done with a few clicks
- spaghetti-guy 7y agoWe haven't really dug in to analyzing those outside of cost explorer yet but that makes sense. One workaround I've heard of is S3 replication. I've not tried it yet but apparently the replica has the 'correct' ownership.