Hello team.
I have a named CloudTrail which every account must have. aws-landing-zone-logs-us-east-1
Some accounts have additional CloudTrails in addition to the above for there own purposes.
I want an alert that tells me if 'any' account does not have a CloudTrail called aws-landing-zone-logs-us-east-1 but IMPORTANTLY ignoring any other CloudTrail they may already have.
The problem is that the below is alerting even though an account has aws-landing-zone-logs-us-east-1 because it is alerting for the additional CloudTrails also on that account.
config where api.name='aws-cloudtrail-describe-trails' AND cloud.type = 'aws' AND json.rule = "(s3BucketName!= aws-landing-zone-logs-us-east-1)"
Your help welcome and can't figure how to do it.
... View more