Arctera Insight Information Governance Administrator's Guide

To get all those required details,

1. Log in to the Cloudtrail console at https://console.aws.amazon.com/cloudtrail/
2. Click Create a trail
3. On the Choose Trail attributes page,

   • Enter Trail Name

   • Select New S3 bucket

   • Copy the location specified in the Logs will be stored field. You will need this location while creating the Athena Table.

     Note:

     These files will not be deleted by Information Governance. If required, delete files manually or automatically by creating a policy.

   • Enable Log file SSE-KMS encryption and provide an existing or new AWS KMS key, if you want to encrypt the log files

   • Disable Log file SSE-KMS encryption option if you do not want to encrypt the log files.

   • Enable Log file validation option.

   • Do not select anything in the CloudWatch Logs and Tags sections.

4. Click Next.
5. On the Choose Log Events page,

   • Select Data Events in the Events section.

   • Click Switch to advanced event selectors in the Data Events section.

   • Select S3 from the Data Event Type drop-down.

   • Select Custom from the Log selector template drop-down.

   • Enter a name in the Selector Name field.

   • For Advanced event selectors option, refer the table below:

     Field	Operator	Value
     eventName	does not start with	Head
     eventName	does not start with	List

     Points to remember:

     • If events of few buckets are required, add desired bucket details individually (add / at the end of every bucket). For example field:resources.ARN Operator:starts with Value:arn:aws:s3:::<bucket_name>/

     • If you want to avoid individual entries for few buckets, use common expression starts with and ends with if bucket naming convention allows the operation.

6. Click Save changes to create a new Trail