In this recipe, we will learn how to send the CloudTrail logs of one account to another account. By storing logs in a separate account, we isolate the logs from the source account, which will prevent anyone with access to the source account from tampering with the logs. We can provide account-level access to the log account to a limited set of people. Sending logs from multiple accounts to a single account also provides a central place for us to query logs.
Cross-account CloudTrail logging
Getting ready
We'll need two working AWS accounts to complete this recipe. We will call them log account and logger account. The logger account will send logs to the log account.
Log in to the logger account, which is where logs will...
