CloudTrail - API Auditing

import * as aws from "@pulumi/aws";

// Create a basic trail for all regions
const trail = new aws.cloudtrail.Trail("audit-trail", {
    s3BucketName: auditBucket.id,
    isMultiRegionTrail: true,
    enableLogFileValidation: true,
});

// Create an organization trail with CloudWatch integration
const orgTrail = new aws.cloudtrail.Trail("org-trail", {
    s3BucketName: auditBucket.id,
    isOrganizationTrail: true,
    cloudWatchLogsGroupArn: trailLogGroup.arn,
    cloudWatchLogsRoleArn: trailRole.arn,
    enableLogFileValidation: true,
});

class Trail extends pulumi.CustomResource {
    constructor(name: string, args: TrailArgs, opts?: pulumi.CustomResourceOptions);

    readonly arn: pulumi.Output<string>;
    readonly homeRegion: pulumi.Output<string>;
}

interface TrailArgs {
    s3BucketName: pulumi.Input<string>;
    s3KeyPrefix?: pulumi.Input<string>;
    cloudWatchLogsGroupArn?: pulumi.Input<string>;
    cloudWatchLogsRoleArn?: pulumi.Input<string>;
    enableLogFileValidation?: pulumi.Input<boolean>;
    includeGlobalServiceEvents?: pulumi.Input<boolean>;
    isMultiRegionTrail?: pulumi.Input<boolean>;
    isOrganizationTrail?: pulumi.Input<boolean>;
    kmsKeyId?: pulumi.Input<string>;
    tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
}

const auditBucket = new aws.s3.Bucket("cloudtrail-logs", {
    forceDestroy: false,
    versioning: {
        enabled: true,
    },
});

const trailKey = new aws.kms.Key("trail-key", {
    description: "CloudTrail log encryption",
    enableKeyRotation: true,
});

const trail = new aws.cloudtrail.Trail("security-audit", {
    s3BucketName: auditBucket.id,
    s3KeyPrefix: "cloudtrail",
    enableLogFileValidation: true,
    includeGlobalServiceEvents: true,
    isMultiRegionTrail: true,
    kmsKeyId: trailKey.id,
    tags: {
        Environment: "production",
        Compliance: "required",
    },
});

const trailLogGroup = new aws.cloudwatch.LogGroup("cloudtrail-logs", {
    retentionInDays: 90,
});

const trailRole = new aws.iam.Role("cloudtrail-role", {
    assumeRolePolicy: JSON.stringify({
        Version: "2012-10-17",
        Statement: [{
            Action: "sts:AssumeRole",
            Principal: {
                Service: "cloudtrail.amazonaws.com",
            },
            Effect: "Allow",
        }],
    }),
});

new aws.iam.RolePolicy("cloudtrail-logs-policy", {
    role: trailRole.id,
    policy: pulumi.all([trailLogGroup.arn]).apply(([logGroupArn]) =>
        JSON.stringify({
            Version: "2012-10-17",
            Statement: [{
                Effect: "Allow",
                Action: ["logs:CreateLogStream", "logs:PutLogEvents"],
                Resource: `${logGroupArn}:*`,
            }],
        })
    ),
});

const trail = new aws.cloudtrail.Trail("monitored-trail", {
    s3BucketName: auditBucket.id,
    cloudWatchLogsGroupArn: trailLogGroup.arn,
    cloudWatchLogsRoleArn: trailRole.arn,
    isMultiRegionTrail: true,
    enableLogFileValidation: true,
});

class EventDataStore extends pulumi.CustomResource {
    constructor(name: string, args?: EventDataStoreArgs, opts?: pulumi.CustomResourceOptions);

    readonly arn: pulumi.Output<string>;
}

interface EventDataStoreArgs {
    name?: pulumi.Input<string>;
    retentionPeriod?: pulumi.Input<number>;
    multiRegionEnabled?: pulumi.Input<boolean>;
    organizationEnabled?: pulumi.Input<boolean>;
    advancedEventSelectors?: pulumi.Input<pulumi.Input<EventDataStoreAdvancedEventSelector>[]>;
    kmsKeyId?: pulumi.Input<string>;
    tags?: pulumi.Input<{[key: string]: pulumi.Input<string>}>;
}