There is an option when creating a CloudTrail trail to enable CloudWatch Logs. The description states "You can enable Sns notifications in CloudWatch Logs for specific API actions. Standard CloudWatch and CloudWatch Logs charges apply." This description makes it seem like you would enable CloudWatch Logs to use Sns specifically.

If CloudTrail can interface with Sns on its own just fine, what would be the purpose of going through CloudWatch Logs to get there? Is it just organizational?

CodePudding user response：

It is referring to the fact the you can filter specific API calls in CloudTrail trails by creating metric filters on the log entries.

CloudTrail has integration with SNS by default, but it will create a notification for every event in the trail. You need CloudWatch if you want something specific.