Setting Up Cloudtrail Multi Region

This sets up CloudTrail to capture API activity across all AWS regions in one go, storing logs in S3 and pushing them to CloudWatch Logs for querying. You'd use this when you need centralized audit trails for security monitoring or compliance requirements instead of managing per-region trails. The skill walks through the complete setup including the CloudWatch Logs integration and has practical troubleshooting for common issues like permission errors and the sometimes lengthy delay for opt-in region events to appear. Worth noting it explicitly steers you away from overly permissive IAM policies, which is the right call for anything touching audit logs.

skills.sh installs: 6.5K
GitHub stars: 3.4K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add aws/agent-toolkit-for-aws --skill setting-up-cloudtrail-multi-region --agent claude-code

Installs into .claude/skills of the current project.

Files

Setting Up CloudTrail Multi-Region

Overview

Domain expertise for enabling AWS CloudTrail across all regions to capture comprehensive API activity logs and configuring CloudWatch Logs Insights for security monitoring, compliance auditing, and operational analysis.

Set up a multi-region trail

To create a centralized multi-region CloudTrail trail with S3 storage, CloudWatch Logs integration, and log analysis, follow the procedure exactly. See CloudTrail multi-region setup procedure.

Troubleshooting

S3 bucket already exists

Choose a different globally unique name, or add a timestamp or organization identifier.

Permission denied errors

Verify your identity with aws sts get-caller-identity. Ensure your user/role has required actions attached. Do NOT use *FullAccess managed policies.