'Is there a way to get the original AWS Account ID on Cloudwatch Alert for Cloudtrail Logs?

I have created a trail for an organization, following this document: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/creating-trail-organization.html

After that, my intent was to monitor and get alerts on Slack for these logs using Cloudwatch and SNS. I have followed everything that can be found here: https://docs.aws.amazon.com/awscloudtrail/latest/userguide/monitor-cloudtrail-log-files-with-cloudwatch-logs.html and I was successfully able to get alerts on Slack through SNS.

However, I saw that the AWS Account ID that is shown on each message is always the Management Account of the AWS organization and not the one where the alert has been generated.

So, the question is: is there a way to get the original Account ID?



Sources

This article follows the attribution requirements of Stack Overflow and is licensed under CC BY-SA 3.0.

Source: Stack Overflow

Solution Source