Log Group support for CloudTrail

[DenSpirit]

It might be desirable for @aws-cdk/aws-cloudtrail's Trail construct to expose log group it creates, and/or accept existing log group.

Use Case

CloudTrail's log group export is useful for setting up metric filters on API events that happen in the account. With raw CloudFormation we needed to define LogGroup separately and were able to set up those. In CDK we'd need to use one of the escape hatches to reach it.

Proposed Solution

Should be a normal readonly property definition.
Implementation pending.

Other

ℹ️ enabling Trail construct to accept custom log group might interfere with retention configuration.

• 👋 I may be able to implement this feature request
• ⚠️ This feature might incur a breaking change

---

This is a 🚀 Feature Request

[rix0rrr]

I think we don't even have LogGroup support for Trails at all, let alone exposing one. Don't all CloudTrail logs go to S3?

[DenSpirit]

@rix0rrr In Trail construct there are two options present, sendToCloudWatchLogs and cloudWatchLogsRetention. Enabling sending to logs creates a log group as Cfn* resource, but the group is not stored in properties.