CloudTrail Meta

Resource Type

AWS.CloudTrail.Meta

Resource ID Format

For CloudTrail Meta resources, the resource ID is constructed as such:

[AccountId]::AWS.CloudTrail.Meta

Example:

123456789012::AWS.CloudTrail.Meta

This allows you to differentiate between CloudTrail Meta resources across all AWS accounts you have linked to Panther by looking at the characters before the first colon.

Background

This resource represents metadata on AWS CloudTrails for an entire account. Every time an account snapshot is taken, exactly one AWS.CloudTrail.Meta resource will be generated.

Fields

Field	Type	Description
Trails	List	A list of the ARNs of every trail in the account. Used to check for the existence of certain trails, the count of trails in an account, and the presence of trails in certain regions.
GlobalEventSelectors	List	The collection of management and data event settings across each CloudTrail in each region.

Example

{
    "AccountId": "123456789012",
    "GlobalEventSelectors": [
        {
            "DataResources": null,
            "IncludeManagementEvents": true,
            "ReadWriteType": "All"
        }
    ],
    "Name": "AWS.CloudTrail.Meta",
    "Region": "global",
    "ResourceId": "123456789012::AWS.CloudTrail.Meta",
    "ResourceType": "AWS.CloudTrail.Meta",
    "Tags": null,
    "TimeCreated": null,
    "Trails": [
        "arn:aws:cloudtrail:us-east-1:123456789012:trail/trail-east-1-1",
        "arn:aws:cloudtrail:us-east-1:123456789012:trail/trail-east-1-2",
        "arn:aws:cloudtrail:us-west-2:123456789012:trail/trail-west-2-1",
        "arn:aws:cloudtrail:us-west-1:123456789012:trail/other-trail"
    ]
}