Skip to main content
All AWS integration capabilities

​
About

This page covers the manual path: you run an OpenTelemetry Collector in your own infrastructure that reads your trail’s CloudWatch Logs group and exports each CloudTrail event to Sazabi over OTLP. Every AWS credential stays on your side. To have Sazabi install a subscription filter for you instead, see AWS CloudTrail (connect your account). Each event keeps CloudTrail’s own JSON, including eventName, eventSource, userIdentity, sourceIPAddress, errorCode, recipientAccountId, and awsRegion.

​
Prerequisites

  • A CloudTrail trail with CloudWatch Logs delivery turned on. Check with aws cloudtrail describe-trails; the CloudWatchLogsLogGroupArn field names the log group.
  • OpenTelemetry Collector Contrib distribution (includes the awscloudwatch receiver).
  • AWS IAM credentials for the collector with logs:DescribeLogGroups, logs:GetLogEvents, and logs:StartLiveTail on the trail’s log group.
  • Your Sazabi intake URL: open the log source and copy the Intake URL from its setup screen (the public key is embedded in the URL).

​
Set up in the dashboard

1

​
Create the log source

Go to Settings > Log streams, click Add source, select AWS CloudTrail, and choose Send to an endpoint. The setup screen shows a collector configuration with your intake URL filled in.
2

​
Configure the collector

Copy the configuration into your collector. Set the receiver’s region to your trail’s log group region and its names list to the trail’s log group name.
3

​
Start the collector

Deploy or restart the collector with AWS credentials that carry the permissions above. It polls the log group and exports new CloudTrail events to Sazabi.

​
Set up with the CLI

Create the log source and copy its collector configuration with the Sazabi CLI:
The command prints the intake URL for the new source. Point the collector’s otlphttp exporter at it using the configuration shown above. Run sazabi log-sources get <log-source-id> at any time to reprint the endpoint, or sazabi log-sources setup-instructions cloudtrail for agent-readable setup steps.

​
Verify

Make an AWS API call, for example aws sts get-caller-identity. Open the Intake page and confirm records attributed to the AWS CloudTrail source appear. CloudTrail delivers to CloudWatch Logs within about five minutes; the collector forwards events on its next poll.

​
Troubleshooting

No events arrive — Confirm the collector’s region and log group name match the trail’s CloudWatchLogsLogGroupArn, and that the trail is logging (aws cloudtrail get-trail-status --name <trail>). “AccessDeniedException” in collector logs — The collector’s credentials are missing logs:GetLogEvents or logs:DescribeLogGroups on the log group. 401 from the intake URL — The URL’s public key was rotated or deleted. Copy the current intake URL from the log source’s setup screen.

​
Further reading

AWS CloudTrail (connect your account)

Let Sazabi install a subscription filter on the trail’s log group.

Log sources

Browse the full log source catalog.