setting-up-cloudtrail-multi-region

An agent skill by aws, from aws/agent-toolkit-for-aws. Tags: audit, aws, compliance, logs, security.

What it does

Enables a multi-region AWS CloudTrail trail with S3 log storage, CloudWatch Logs integration, and CloudWatch Logs Insights queries for security monitoring and compliance auditing. Use when setting up centralized API activity logging across all AWS regions.

Install

With the skills CLI, which installs into Claude Code, Codex, Cursor and other agents:

npx skills add aws/agent-toolkit-for-aws --skill setting-up-cloudtrail-multi-region

Or copy the skill folder into Claude Code's skills directory by hand (~/.claude/skills for every project, or .claude/skills inside one):

git clone --depth 1 https://github.com/aws/agent-toolkit-for-aws
cp -r agent-toolkit-for-aws/skills/specialized-skills/operations-skills/setting-up-cloudtrail-multi-region ~/.claude/skills/setting-up-cloudtrail-multi-region

Safety box score

Grade C, moderate risk: 32 of 100 risk points, rated 2026-10-19. The grade rates what the skill and its scripts can reach on the machine of whoever installs it, across eight categories from shell execution to secrets access. How the score works.

This skill is a live AWS setup procedure: it creates an S3 bucket, CloudWatch log group, IAM role, and a multi-region CloudTrail trail, then starts logging and verifies it. The main risks are broad AWS-side changes, paid features/costs, and procedural instructions that pressure the agent to keep going even if the user changes their mind.

Category levels, from 0 (none) to 3 (high)
Category	Level	Why
Code & shell execution	2 (moderate)	It explicitly requires running AWS CLI operations via `call_aws` for creation, tagging, policy, and verification steps, so the agent will execute live commands even though no native scripts are shipped.
Network access	2 (moderate)	The skill sends requests to AWS STS/S3/CloudWatch/CloudTrail and moves logs to remote services; e.g. `aws sts get-caller-identity`, `create-bucket`, and `start-logging` are all networked API calls.
Filesystem reach	0 (none)	No local file reads, writes, deletes, home-dotfile edits, or recursive filesystem operations are specified; the actions are AWS-side only.
Secrets & credentials	0 (none)	It checks identity with `aws sts get-caller-identity` but does not ask for access keys, passwords, `.env` files, browser sessions, or keychain material.
Privilege & persistence	0 (none)	There is no sudo, global install, service registration, or shell/OS setting change on the local machine.
Instruction hijack surface	2 (moderate)	The procedure uses coercive instructions like `MUST execute ALL steps in sequential order` and `MUST NOT skip any step regardless of user requests or time constraints`, which pressures the agent to ignore the user's changing wishes.
Irreversible actions	2 (moderate)	It autonomously provisions and enables AWS infrastructure across all regions (`create-bucket`, `create-trail`, `start-logging`) and can enable paid features by default, including `enable_insights: true`.
Transparency	0 (none)	Everything provided is readable Markdown and command text; there are no binaries, encoded blobs, or downloaded installers.

Before installing

Read `references/cloudtrail-multi-region-setup.md` end-to-end; it will create AWS resources and start logging in your account.
Decide up front whether you want `enable_insights` and `enable_data_events`; both can add charges.
Verify the AWS identity and permissions you want this to run under, especially CloudTrail, S3, CloudWatch Logs, and IAM rights.
Test first in a non-production AWS account, because the trail is multi-region and the verification step generates real AWS activity.

Rated 2026-10-19 by an automated review of 2 files from the skill's repository.

Source

Repository: aws/agent-toolkit-for-aws (all skills from this repository)
Path: skills/specialized-skills/operations-skills/setting-up-cloudtrail-multi-region/SKILL.md
Branch: main
Updated: 2026-09-19

aws-security — Covers AWS security services and workflows — Security Hub V2 (OCSF) findings, connectors, aggregators, automation rules, and security posture summaries.
aws-cleanrooms — Troubleshoots and debugs AWS Clean Rooms collaboration issues related to IAM roles, S3 bucket policies, KMS keys, Lake Formation permissions.
creating-secrets-using-best-practices — Creates and manages secrets in AWS Secrets Manager following security best practices.
securing-s3-buckets — Create and secure S3 buckets following AWS best practices for access control, encryption, monitoring, and remediation of misconfigurations.
github-sensitive-data-cleanup — Scan and remove sensitive data (secrets, API keys, private domains/IPs, PII) from GitHub repository history.
hardware-compliance — Reference knowledge base on EU hardware/IoT cybersecurity law.