| agent: |
NVnfrVOzW6Q13Y7hUa0cFilter out redundant global AWS CloudTrail Trails
Filter out redundant global AWS CloudTrail Trails
There was a problem that the LLM was not able to address. Please rephrase your prompt and try again.
This task aims to identify and filter out redundant global trails within AWS CloudTrail. A global trail is a trail that applies to all regions in an AWS account. Redundant global trails can capture duplicate events, leading to unnecessary data storage and processing costs. Our script carefully inspects all global trails in each AWS region and identifies redundancies, providing a clear report of any trails that are unnecessary or duplicative. This allows for streamlined management and potential cost savings by helping administrators easily spot and remove any redundant global trails.
inputs
outputs
import boto3
# Replace the following line with the actual list of trails you have
#all_trails = [{'Name': 'ctrail_123', 'S3BucketName': 'aws-cloudtrail-logs-355237452254-0d3050fa', 'IncludeGlobalServiceEvents': True, 'IsMultiRegionTrail': True, 'HomeRegion': 'us-east-1', 'TrailARN': 'arn:aws:cloudtrail:us-east-1:355237452254:trail/ctrail_123', 'LogFileValidationEnabled': True, 'HasCustomEventSelectors': True, 'HasInsightSelectors': True, 'IsOrganizationTrail': False}, {'Name': 'c_global', 'S3BucketName': 'aws-cloudtrail-logs-355237452254-0d3050fa', 'IncludeGlobalServiceEvents': True, 'IsMultiRegionTrail': True, 'HomeRegion': 'us-west-2', 'TrailARN': 'arn:aws:cloudtrail:us-west-2:355237452254:trail/c_global', 'LogFileValidationEnabled': False, 'HasCustomEventSelectors': True, 'HasInsightSelectors': False, 'IsOrganizationTrail': False}, {'Name': 'ctrail_oregon', 'S3BucketName': 'aws-cloudtrail-logs-355237452254-0d3050fa', 'IncludeGlobalServiceEvents': False, 'IsMultiRegionTrail': False, 'HomeRegion': 'us-west-2', 'TrailARN': 'arn:aws:cloudtrail:us-west-2:355237452254:trail/ctrail_oregon', 'LogFileValidationEnabled': True, 'HasCustomEventSelectors': True, 'HasInsightSelectors': True, 'IsOrganizationTrail': False}]
if all_trails:
try:
# Filtering global trails that are in their home region
global_trails = [trail for trail in all_trails if trail['IsMultiRegionTrail'] and trail['HomeRegion'] == trail['HomeRegion']]
# Grouping global trails per account
account_trail_map = {}
for trail in global_trails:
account_id = trail['TrailARN'].split(':')[4]
account_trail_map.setdefault(account_id, []).append(trail)
# Identifying and printing redundant global trails
redundant_trails_found = False
for account_id, trails in account_trail_map.items():
if len(trails) > 1:
redundant_trails_found = True
print(f"Alarm: Account {account_id} has {len(trails)} global trails which is redundant.")
for i, trail in enumerate(trails):
redundant_to = ', '.join([t['Name'] for idx, t in enumerate(trails) if idx != i])
print(f" - Resource: {trail['TrailARN']}, Reason: {trail['Name']} is redundant to {redundant_to}, Region: {trail['HomeRegion']}")
if not redundant_trails_found:
print("No redundant global trails found.")
except Exception as e:
# Log any general exception that occurs
print(f"An unexpected error occurred: {e}")
else:
print("No trails were provided.")
copied