Amazon CloudTrail Monitoring in ObserveOps
Overview
The Amazon CloudTrail integration with ObserveOps (formerly known as AIOps) collects configuration and delivery health telemetry from AWS CloudTrail trails. It monitors logging state, log file integrity validation, encryption settings, multi-region coverage, and delivery errors to S3, SNS, and CloudWatch Logs.
These metrics help security and compliance teams verify that audit logging is active, detect delivery failures before they create gaps in the audit record, and confirm that encryption and integrity validation are correctly configured.
Prerequisites
- AWS CloudTrail is enabled in the target AWS account with at least one trail configured.
- The IAM role or user used for integration has read access to CloudTrail resources (
cloudtrail:DescribeTrails,cloudtrail:GetTrailStatus). - Required CloudTrail API endpoints are reachable from ObserveOps.
- The AWS account is added in discovery with correct credentials and region configuration.
List of Supported KPIs
Trail Configuration
| Metric | Description | Type |
|---|---|---|
| aws.cloudtrail.logging.state | Indicates whether logging is enabled on the trail. | Boolean |
| aws.cloudtrail.log.validation.state | Indicates whether log file integrity validation is enabled. | Boolean |
| aws.cloudtrail.multi.region.state | Indicates whether the trail covers all AWS regions. | Boolean |
| aws.cloudtrail.global.service.events.state | Indicates whether global service events are included in the trail. | Boolean |
| aws.cloudtrail.kms.encryption.state | Indicates whether log files are encrypted using AWS KMS. | Boolean |
| aws.cloudtrail.organization.trail.state | Indicates whether the trail is an AWS Organizations trail. | Boolean |
| aws.cloudtrail.delivery.staleness.seconds | Age of the most recently delivered log file in seconds. | Seconds |
Delivery and Notifications
| Metric | Description | Type |
|---|---|---|
| aws.cloudtrail.delivery.error | Identifier of the most recent S3 delivery error. | String |
| aws.cloudtrail.delivery.error.active | Indicates whether there is an active S3 delivery error. | Boolean |
| aws.cloudtrail.notification.error | Identifier of the most recent SNS notification error. | String |
| aws.cloudtrail.notification.error.active | Indicates whether there is an active SNS notification error. | Boolean |
| aws.cloudtrail.cloudwatch.delivery.error | Identifier of the most recent CloudWatch Logs delivery error. | String |
| aws.cloudtrail.cloudwatch.delivery.error.active | Indicates whether there is an active CloudWatch Logs delivery error. | Boolean |
| aws.cloudtrail.digest.delivery.error | Identifier of the most recent log digest delivery error. | String |
| aws.cloudtrail.digest.delivery.error.active | Indicates whether there is an active log digest delivery error. | Boolean |