eventbridge/1-integration/template.yaml [21:63]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  LoggingBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref LoggingBucketName

  # Bucket policy enables CloudTrail to write to the logging bucket
  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref LoggingBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AWSCloudTrailAclCheck
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action: s3:GetBucketAcl
            Resource: !GetAtt LoggingBucket.Arn
          - Sid: AWSCloudTrailWrite
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action: s3:PutObject
            Resource: !Sub ${LoggingBucket.Arn}/AWSLogs/${AWS::AccountId}/*
            Condition:
              StringEquals:
                s3:x-amz-acl: bucket-owner-full-control

  # The CloudTrail trail - uses the LoggingBucketName as the trail name
  myTrail:
    Type: AWS::CloudTrail::Trail
    DependsOn: BucketPolicy
    Properties:
      TrailName: !Ref LoggingBucketName
      S3BucketName: !Ref LoggingBucket
      IsLogging: true
      IsMultiRegionTrail: false
      EventSelectors:
        - IncludeManagementEvents: false
          DataResources:
            - Type: AWS::S3::Object
              Values:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



eventbridge/4-multi-multi/template.yaml [31:73]:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
  LoggingBucket:
    Type: AWS::S3::Bucket
    Properties:
      BucketName: !Ref LoggingBucketName

  # Bucket policy enables CloudTrail to write to the logging bucket
  BucketPolicy:
    Type: AWS::S3::BucketPolicy
    Properties:
      Bucket: !Ref LoggingBucket
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Sid: AWSCloudTrailAclCheck
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action: s3:GetBucketAcl
            Resource: !GetAtt LoggingBucket.Arn
          - Sid: AWSCloudTrailWrite
            Effect: Allow
            Principal:
              Service: cloudtrail.amazonaws.com
            Action: s3:PutObject
            Resource: !Sub ${LoggingBucket.Arn}/AWSLogs/${AWS::AccountId}/*
            Condition:
              StringEquals:
                s3:x-amz-acl: bucket-owner-full-control

  # The CloudTrail trail - uses the LoggingBucketName as the trail name
  myTrail:
    Type: AWS::CloudTrail::Trail
    DependsOn: BucketPolicy
    Properties:
      TrailName: !Ref LoggingBucketName
      S3BucketName: !Ref LoggingBucket
      IsLogging: true
      IsMultiRegionTrail: false
      EventSelectors:
        - IncludeManagementEvents: false
          DataResources:
            - Type: AWS::S3::Object
              Values:
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -



