1. Sign in to the AWS Management Console and open the Amazon S3 console at https://console.aws.amazon.com/s3/.
2. Choose Create bucket.
3. Provide a unique Bucket name and select the Region where you want the bucket to reside.
4. Configure options according to your needs (versioning, logging, encryption, etc.).
5. Set up permissions carefully to ensure the bucket is secure.
6. Review and create the bucket.

1. Open the AWS CloudTrail console at https://console.aws.amazon.com/cloudtrail/.
2. In the dashboard, choose Trails in the left navigation pane.
3. Select the trail you want to update.
4. In the Storage location section, click the pencil icon (edit) next to S3 bucket.
5. Enter the name of the new S3 bucket you created in Step 1.
6. Save your changes.

If you have an IAM policy that specifically allows CloudTrail to write to the old S3 bucket, you’ll need to update it to allow CloudTrail to write to the new bucket.

1. Open the IAM console at https://console.aws.amazon.com/iam/.
2. Navigate to Policies.
3. Find the policy attached to the CloudTrail service that grants access to the old S3 bucket.
4. Edit the policy to include the new S3 bucket ARN in the resource section.

For example:

{
   "Version": "2012-10-17",
   "Statement": [
       {
           "Effect": "Allow",
           "Action": "s3:PutObject",
           "Resource": "arn:aws:s3:::new-bucket-name/AWSLogs/*",
           "Condition": {"StringEquals": {"s3:x-amz-acl": "bucket-owner-full-control"}}
       }
   ]
}


5. Review and save the policy.

1. Go back to the Amazon S3 console.
2. Select the new bucket and click on the Permissions tab.
3. Click on Bucket Policy.
4. Enter a policy that grants CloudTrail the necessary permissions to write to the bucket.

Example policy:

{
   "Version": "2012-10-17",
   "Statement": [
       {
           "Sid": "AWSCloudTrailWrite",
           "Effect": "Allow",
           "Principal": {
               "Service": "cloudtrail.amazonaws.com"
           },
           "Action": "s3:PutObject",
           "Resource": "arn:aws:s3:::new-bucket-name/AWSLogs/*",
           "Condition": {"StringEquals": {"s3:x-amz-acl": "bucket-owner-full-control"}}
       }
   ]
}


5. Click Save to apply the bucket policy.

1. After updating the trail to use the new bucket, AWS CloudTrail will start delivering logs to the new S3 bucket.
2. To verify that logs are being delivered, go to the CloudTrail console, select the trail, and then look at the Recent delivery history.
3. You can also go directly to the S3 bucket and check if new log files are appearing.

• If logs are not appearing in the new bucket, check CloudTrail for any error messages.
• Verify that the S3 bucket policies and IAM policies are correctly configured.
• Ensure that there are no network ACLs or S3 Block Public Access settings that could be preventing CloudTrail from delivering logs to the new bucket.