Michael
I’m not sure if Root user activity will be logged (and trigger an alarm) only in the region where CloudTrail and CloudWatch were configured, or in any of the regions.
1 Answers
Faye Ellis
I think the alarm will only be triggered in the region where you have completed the CloudWatch configuration
The confusion is mainly because "Apply trail to all regions" is set to "Yes" for CloudTrail configuration, but the CloudWatch are set in one specific region.