This CloudTrail integration is specifically designed to work with the destination bucket to which CloudTrail writes its logs.

It is based on CloudTrail’s naming convention and path structure.

If you’re looking to ship CloudTrail logs from a different bucket, please use the S3 Bucket shipping method instead.

Configuration

Before you begin:

  • If you plan on using an access key to authenticate your connection, you’ll need to set the s3:ListBucket and s3:GetObject permissions for the required S3 bucket.

  • If you plan on using an IAM role to authenticate your connection, you can get the role policy by filling out the bucket information and clicking the “Get the role policy” button.

  • File names in ascending alphanumeric order. This is important because the S3 fetcher’s offset is determined by the name of the last file fetched. We recommend using standard AWS naming conventions to determine the file name ordering and to avoid log duplication.

Send your logs to an S3 bucket

Logz.io fetches your CloudTrail logs from an S3 bucket.

For help with setting up a new trail, see Overview for Creating a Trail from AWS.

Add the S3 bucket information

To use the S3 fetcher, fill out the S3 bucket information on the CloudTrail log shipping page. You must be logged in to Logz.io.

When creating a bucket, you’ll only need to fill in 2 parameters which you can get from your CloudTrail AWS path. The AWS path structure for CloudTrail looks like this:

{BUCKET_NAME}/{PREFIX_IF_EXISTS}/cloudtrail/AWSLogs/{AWS_ACCOUNT_ID}/CloudTrail/

  • {BUCKET_NAME} is your S3 bucket name.

  • {PREFIX} is your CloudTrail path.

    If you don’t have a prefix, put down /cloudtrail/AWSLogs/{AWS_ACCOUNT_ID}/CloudTrail/.
    If you have a prefix, put down {PREFIX}/cloudtrail/AWSLogs/{AWS_ACCOUNT_ID}/CloudTrail/.

  • {Region} is not needed. Logz.io will pull data from all regions in AWS for the specified bucket and account.

Logz.io fetches logs that are generated after configuring an S3 bucket. Logz.io cannot fetch past logs retroactively.

Check Logz.io for your logs

Give your logs some time to get from your system to ours, and then open Kibana.

If you still don’t see your logs, see log shipping troubleshooting.