Back to Details

setting-up-cloudtrail-multi-region

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese

Setting Up CloudTrail Multi-Region

配置多区域CloudTrail

Overview

概述

Domain expertise for enabling AWS CloudTrail across all regions to capture comprehensive API activity logs and configuring CloudWatch Logs Insights for security monitoring, compliance auditing, and operational analysis.
本内容提供在所有区域启用AWS CloudTrail以捕获全面的API活动日志，并配置CloudWatch Logs Insights用于安全监控、合规审计及运营分析的专业指导。

Set up a multi-region trail

配置多区域追踪

To create a centralized multi-region CloudTrail trail with S3 storage, CloudWatch Logs integration, and log analysis, follow the procedure exactly. See CloudTrail multi-region setup procedure.
如需创建一个配备S3存储、CloudWatch Logs集成及日志分析功能的集中式多区域CloudTrail追踪，请严格遵循以下步骤。详见CloudTrail多区域配置步骤。

Troubleshooting

故障排查

S3 bucket already exists

S3存储桶已存在

Choose a different globally unique name, or add a timestamp or organization identifier.
选择一个其他的全局唯一名称，或添加时间戳或组织标识符。

Permission denied errors

权限拒绝错误

Verify your identity with 
aws sts get-caller-identity
. Ensure your user/role has required actions attached. Do NOT use 
*FullAccess
managed policies.
使用
aws sts get-caller-identity
验证您的身份。确保您的用户/角色已附加所需的操作权限。请勿使用
*FullAccess
托管策略。

Trail not logging

追踪未记录日志

Verify IAM role permissions, check S3 bucket policy allows CloudTrail access, and ensure the trail is started with 
start-logging
.
验证IAM角色权限，检查S3存储桶策略是否允许CloudTrail访问，并确保已通过
start-logging
启动追踪。

Missing events in CloudWatch

CloudWatch中缺少事件

Allow 5-15 minutes for initial log delivery. Verify the CloudWatch Logs role ARN is correct and the log group exists in the same region as the trail.
首次日志交付需要等待5-15分钟。验证CloudWatch Logs角色ARN是否正确，且日志组与追踪位于同一区域。

Opt-in region events not appearing

可选区域事件未显示

This is normal — events from opt-in regions may take several hours. Wait up to 24 hours before investigating further.
此为正常现象——来自可选区域的事件可能需要数小时才能显示。请等待最多24小时后再进行进一步排查。