I would maybe try to check if cloudtrail has been granted the required role (sometimes it might not work the first time) and provides events to the log group.
Btw. I am missing an option to upload a screenshot. Hence the link:
Thank you! We’ll test that out!
The root user alert is working fine for me following the lab instructions as is. Just FYI.