This topic describes how to update a multi-account trail in the ActionTrail console.

Prerequisites

A resource directory is enabled. For more information, see Enable a resource directory.

Procedure

  1. Log on to the ActionTrail console by using the management account.
    Note Member accounts can view multi-account trails but are not authorized to update them.
  2. In the left-side navigation pane, click Trails.
  3. On the Trails page, find the multi-account trail that you want to update and click the trail name.
  4. On the page that appears, click Edit in the upper-right corner.
  5. In the Trail Basic Settings step, change the values of the Applied Regions and Event Type parameters and click Next.
    Note You cannot modify the Apply Trail to All Member Accounts parameter. To modify this parameter, you must delete the multi-account trail and create a multi-account trail again.
  6. In the Event Delivery Settings step, change the delivery method and click Next.
    • Delivery to Log Service
      • If you select Delivery to Current Account, change the values of the Logstore Region and Project Name parameters.
      • If you select Delivery to Another Account, change the values of the Log Service Project ARN and RAM Role ARN of Destination Account parameters.
    • Delivery to OSS
      • If you select Delivery to Current Account, change the values of the Bucket Name, Log File Prefix, and Server Encryption parameters.
        Note You can change the value of the Server Encryption parameter only if you select New OSS Bucket.
      • If you select Delivery to Another Account, change the values of the RAM Role ARN of OSS Bucket, Bucket Name, and Log File Prefix parameters.
  7. In the Preview and Create step, confirm the updated trail information and click Submit.
  8. Optional:In the message that appears, click OK.
    Note This step is required only when you set the Apply Trail to All Member Accounts parameter to Yes. In this case, the parameter settings of all member accounts in the resource directory are updated.