[Config] Control Tower v3.0 Required Config File Tweaks - (NEW: Organization CloudTrail)

[drewdresser]

Required Basic Info

• Accelerator Version: 1.5.3
• Install Type: Clean

Describe the bug
In Control Tower section of the documentation, should the ASEA include reference to using Control Tower's new CloudTrail capabilities? What setup should we use - Enabled, or Disabled?

[KyleSouthworthGSS]

Hi, I have tried the Control Tower CloudTrail configuration set to 'Not enabled' and 'Enabled', each resulted in the ASEA phase 4 failing to update LogGroupMetricFilters. I have raised this with AWS as I am also seeing the following error in Control Tower:
"AWS Control Tower failed to delete your account trails completely: AWS Control Tower encountered an error deleting your account trails. Try again later. If this error persists, contact AWS Support."

I am also seeing the following error in the Phase 4 logs: 'Error: Did not find LogGroup "aws-controltower/CloudTrailLogs"'

[KyleSouthworthGSS]

Just had confirmation off AWS support -

"Further, I would like to inform you that in the recent update [1] of landing zone version (3.0) we no longer create the IAM role aws-controltower-CloudWatchLogsRole and the CloudWatch log group aws-controltower/CloudTrailLogs in each enrolled account. Previously, we created these in each account for its account trail. With organization trails, we only create one in the management account. So the log group aws-controltower/CloudTrailLogs would have been deleted for the member accounts after the CT update."

[drewdresser]

Thanks, Kyle. Which "landing zone" are you referring to that has a version 3.0?

…

On Fri, Aug 5, 2022 at 12:27 PM KyleSouthworthGSS ***@***.***> wrote: Just had confirmation off AWS support - "Further, I would like to inform you that in the recent update [1] of landing zone version (3.0) we no longer create the IAM role aws-controltower-CloudWatchLogsRole and the CloudWatch log group aws-controltower/CloudTrailLogs in each enrolled account. Previously, we created these in each account for its account trail. With organization trails, we only create one in the management account. So the log group aws-controltower/CloudTrailLogs would have been deleted for the member accounts after the CT update." — Reply to this email directly, view it on GitHub <#1021 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAYEYAL3XLCRKE3ESO6BIWDVXU6GJANCNFSM55NFXTKA> . You are receiving this because you authored the thread.Message ID: <aws-samples/aws-secure-environment-accelerator/issues/1021/1206634712@ github.com>

[Brian969]

• Control Tower updated to version 3 which moved to Organization based CloudTrail rather than account based
• the ASEA example CT config file is no longer valid for Control Tower v3+
• the cloudwatch metric and alarms sections of the example CT config file need to be updated to look more like all the other non-CT example config files (specifically, lines 231-445)
• i.e. "accounts": ["ALL"] to "accounts": ["management"] and "default-accounts": ["ALL"] to "default-accounts": ["management"] also - I have not looked, but "loggroup-name": "aws-controltower/CloudTrailLogs" needs to be validated as still being the correct name - now validated.
• To answer the original question - What setup should we use - Enabled, or Disabled? you should select Enabled (otherwise you will not have any CloudTrail deployed and centrally logged).

[KyleSouthworthGSS]

Thanks @Brian969 this helped me resolve.