Cloudtrail - Can't set "Apply trail to all regions" to yes in terraform

[jmelfi]

We've been using terraform for some time to configure our AWS infrastructure and have been liking it.

When configuring Cloudtrail Trails, it should be possible to change the trail from the default (only apply to the region that it is created in) to applying to all AWS envs. This is helpful since we have one global policy that gets analyzed in batch.

Currently changing this manually is not an issue, as terraform does not find that there is a change in the state.

[radeksimko]

Hi @jmelfi
I actually wanted to add support for MultiRegion into aws_cloudtrail back in December. Specifically on the 18th.

The reason it has not reached Terraform codebase yet is because there was a bug in the CloudTrail API.

It was impossible to disable multi-region support & global service events both at the same time (in one API call). The error coming out of such API call was

A client error (InvalidParameterCombinationException) occurred when calling the UpdateTrail operation: Multi-Region trail must include global service events.

I have reached out to AWS on the 18th and reported this. The response I received back follows:

Hello Radek,
I just got feedback from cloudtrail team and they have confirmed that this is a bug. This issue will be fixed in upcoming release.
Thank you for helping us in identifying this issue.

I will try and test the API again soon to see if this bug has been fixed. If it was, then there's nothing preventing us from implementing it. 😉

[radeksimko]

I just quickly reran the repro case from that mentioned support ticket with AWS and it seems the bug was fixed. 😄

[jmelfi]

@radeksimko thanks for the quick reply here! It would be awesome for this to get added in. Looking forward to it!

[brentaustin-zz]

+1

[radeksimko]

Recently merged #4939 implemented this option.

[jmelfi]

@radeksimko thanks for the update on this merge and fix. I'll be looking at this today or tomorrow.

[ghost]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.

If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.