> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS

> Use AWS with Sazabi through native log source, manual log source, MCP connector and sandbox CLI capabilities.

## Supported capabilities

MCP connectorSandbox CLINative log sourceManual log source

* **MCP connector**: [AWS](https://docs.sazabi.com/catalogs/mcp-connectors/aws.md) — Give the Sazabi agent tools to search AWS documentation and run AWS API operations using your own IAM credentials.
* **Sandbox CLI**: [AWS](https://docs.sazabi.com/catalogs/sandbox-clis/aws.md) — Give the Sazabi agent the AWS CLI (aws) in its sandbox to interact with AWS services using access keys or an assumed role.
* **Native log source**: [Amazon VPC Flow Logs](https://docs.sazabi.com/catalogs/log-sources/connect-your-account/aws-vpc-flow-logs.md) — Connect your AWS account so Sazabi creates a flow log for each VPC you pick and streams its network traffic records in through CloudWatch Logs.
* **Native log source**: [AWS WAF](https://docs.sazabi.com/catalogs/log-sources/connect-your-account/aws-waf.md) — Connect your AWS account so Sazabi sets up subscription filters on your AWS WAF log groups and streams web ACL logs in real time.
* **Native log source**: [AWS CloudTrail](https://docs.sazabi.com/catalogs/log-sources/connect-your-account/cloudtrail.md) — Connect your AWS account so Sazabi can subscribe to your trail's CloudWatch Logs group and stream CloudTrail events in real time.
* **Native log source**: [AWS CloudWatch](https://docs.sazabi.com/catalogs/log-sources/connect-your-account/cloudwatch.md) — Connect your AWS account so Sazabi can set up subscription filters on your CloudWatch log groups and stream logs in real time.
* **Manual log source**: [AWS API Gateway](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/aws-api-gateway.md) — Send AWS API Gateway access and execution logs from CloudWatch Logs to Sazabi to see who calls which API, failed authorizations, and abusive clients.
* **Manual log source**: [AWS GuardDuty](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/aws-guardduty.md) — Send Amazon GuardDuty findings to Sazabi in near real time with an Amazon EventBridge rule and API destination in each Region.
* **Manual log source**: [Amazon VPC Flow Logs](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/aws-vpc-flow-logs.md) — Run an OpenTelemetry Collector with the awscloudwatch receiver to forward the VPC flow logs you publish to CloudWatch Logs to Sazabi.
* **Manual log source**: [AWS WAF](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/aws-waf.md) — Run an OpenTelemetry Collector that reads your aws-waf-logs- CloudWatch log groups and forwards AWS WAF web ACL logs to Sazabi.
* **Manual log source**: [AWS CloudTrail](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/cloudtrail.md) — Run an OpenTelemetry Collector with the awscloudwatch receiver on your trail's CloudWatch Logs group and export CloudTrail events to Sazabi over OTLP.
* **Manual log source**: [AWS CloudWatch](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/cloudwatch.md) — Run an OpenTelemetry Collector with the awscloudwatch receiver and an otlphttp exporter to forward CloudWatch log group data to Sazabi.

Each connection method has its own setup and permissions. Connecting one method does not enable the others.

## About

Use AWS with Sazabi through native log source, manual log source, MCP connector and sandbox CLI capabilities. Choose a supported capability above to see its credentials, permissions, setup instructions, and verification steps. Each method is configured separately.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.