Enable CloudTrail during provisioning

[BagOfMostlyWater]

CloudTrail creates audit data which can show what users are doing and/or how operations are failing. It should be turned on from the outset. It could be optionally disabled to accommodate accounts that will have many discrete AWS operations and low S3 storage budgets, but those will probably be rare.

Additionally, admins may want to receive SNS messages containing batches of CloudTrail logs. To turn on:

SNS > Navigation (left window) > Topics > ${target}-cloudtrails > Create Subscription >
Protocol=Email-JSON
Endpoint=emailaddress