Create an OpenSearch cluster in VPC that receives CloudTrail CloudWatch Logs from Lambda.
This project contains a sample AWS CDK template to create Amazon CloudTrail, a CloudWatch Logs Group, AWS Lambda function and Amazon OpenSearch serverless collection.
The EventBridge rule publishes matched events to CloudWatch Logs from CloudTrail.
The Lambda function indexes those logs to Amazon OpenSearch which can be further viewed from the Amazon OpenSearch dashboard.