CODEWITHSUNDEEP
amazon-web-servicesamazon-s3aws-lambdaamazon-cloudtrail
Lucas M.
Lucas M.

Reputation: 53

Moving specific Logs from AWS Cloudtrail to S3

tI want to send a Cloudtrail log (Specifically when an secrets manager key rotates) to an S3 bucket. We already have the logs in Cloudtrail, is there an easy way to configure Cloudtrail to send these logs to S3 as soon as it happens? I was thinking of setting up a Lambda function that runs on a CRON schedule to do this for me, but would there be an easier way?

Upvotes: 1

Views: 658

Answers (2)

Marcin
Marcin

Reputation: 238259

If you want to get specific events from CT in real-time as they happen, then you should setup CloudWatch Event rule for them:

The rule could be:

{
  "source": [
    "aws.secretsmanager"
  ],
  "detail-type": [
    "AWS API Call via CloudTrail"
  ],
  "detail": {
    "eventSource": [
      "secretsmanager.amazonaws.com"
    ],
    "eventName": [
      "RotateSecret"
    ]
  }
}

With a target of Firehose delivery stream set for S3 bucket of your choise.

Upvotes: 1

kormik
kormik

Reputation: 91

There is a slightly easier way, although not necessarily cost-effective (depends on your case) and you won't avoid using Lambda. Instead of setting up a cron, you can enable CloudWatch export for your trail, from where you can set a Lambda subscription filter. This way you can export to S3 exactly the events you want (don't have to code the filters into function) as soon as they come. But - you have to pay extra for the CloudWatch Logs, so it's not a good option if you have a large trail.

Upvotes: 0

Related Questions