Search code examples
amazon-cloudtrail

Why does my Cloudtrail key have a random ID?

For some reason my S3 bucket for my Cloudtrail logs stores logs in the following format:

/AWSLogs/${SOME_RANDOM_ID}/${ACCOUNT_ID}/CloudTrail/${REGION}

Where there is this SOME_RANDOM_ID, which does not show up in the create statement when I go to create my Athena Table for my Cloudtrail logs. This caused all my queries to return 0 records and until I figured out what was going on.

I don't see this in the documentation under what conditions this happens, is this to partition writes to s3 to avoid SLAs on individual keys? Why is this happenening to me? Is anybody else experiencing this issue?

Solution

  • @Dunedan was right, the ${SOME_RANDON_ID} is equal to the output of aws organizations describe-organization --query "Organization.Id".