Creating Trail CloudTrail Console

1. Open the CloudTrail Console

   1. Sign in to the AWS Management Console.

   2. Navigate to CloudTrail → Trails → Create Trail.

   3. Click Create Trail.

2. Configure Basic Trail Settings

   Field	Value / Description
   Trail name	EntroTrail (or another descriptive name)
   Storage location	Select Create a new S3 bucket
   S3 bucket name	Use a unique name, e.g. entro-cloudtrail-logs-prod
   Log file SSE-KMS encryption	(Optional) Enable if KMS encryption is required
   Enable CloudWatch Logs	Optional, for real-time streaming (SailPoint Entro does not require this)

3. Choose Event Types

   In the Event type section, select the following:

   • Management events

   • Data events (recommended for broader coverage)

   • Read/Write events → choose All

   This ensures SailPoint Entro has complete context around API calls, secret reads, and key management actions.

4. Review and Create

   1. Review all settings.

   2. Click Create Trail.

   3. Wait for confirmation that the trail has been successfully created.

5. Verify Log Delivery to S3

   1. Navigate to S3 → Buckets → entro-cloudtrail-logs-prod (or your selected name).

   2. Confirm that a folder structure appears for each region: AWSLogs/<account-id>/CloudTrail/<region>/YYYY/MM/DD/...

   3. Wait for initial log delivery (~15 minutes).

6. Apply SailPoint Entro Access Permissions

   If you are setting up SailPoint Entro CloudTrail integration, ensure that the bucket policy allows SailPoint Entro's role to read logs.

   Follow: Configure a Trail with the CloudTrail Console →

Security Notes

• Logs remain in your S3 bucket; SailPoint Entro accesses them via read-only IAM permissions.
• You retain full control over log lifecycle, retention, and encryption settings.
• CloudTrail automatically applies least-privilege principles to its internal write actions.