> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS CloudTrail

> Run an OpenTelemetry Collector with the awscloudwatch receiver on your trail's CloudWatch Logs group and export CloudTrail events to Sazabi over OTLP.

[All AWS integration capabilities](https://docs.sazabi.com/catalogs/integrations/aws)

## About

This page covers the manual path: you run an OpenTelemetry Collector in your own infrastructure that reads your trail's CloudWatch Logs group and exports each CloudTrail event to Sazabi over OTLP. Every AWS credential stays on your side. To have Sazabi install a subscription filter for you instead, see [AWS CloudTrail (connect your account)](https://docs.sazabi.com/catalogs/log-sources/connect-your-account/cloudtrail.md).

Each event keeps CloudTrail's own JSON, including `eventName`, `eventSource`, `userIdentity`, `sourceIPAddress`, `errorCode`, `recipientAccountId`, and `awsRegion`.

## Prerequisites

* A CloudTrail trail with CloudWatch Logs delivery turned on. Check with `aws cloudtrail describe-trails`; the `CloudWatchLogsLogGroupArn` field names the log group.
* OpenTelemetry Collector **Contrib** distribution (includes the `awscloudwatch` receiver).
* AWS IAM credentials for the collector with `logs:DescribeLogGroups`, `logs:GetLogEvents`, and `logs:StartLiveTail` on the trail's log group.
* Your Sazabi intake URL: open the log source and copy the **Intake URL** from its setup screen (the public key is embedded in the URL).

## Set up in the dashboard

**Step 1**

### Create the log source

Go to [**Settings > Log streams**](https://app.sazabi.com/settings/log-source-providers), click **Add source**, select **AWS CloudTrail**, and choose **Send to an endpoint**. The setup screen shows a collector configuration with your intake URL filled in.

**Step 2**

### Configure the collector

Copy the configuration into your collector. Set the receiver's `region` to your trail's log group region and its `names` list to the trail's log group name.

**Step 3**

### Start the collector

Deploy or restart the collector with AWS credentials that carry the permissions above. It polls the log group and exports new CloudTrail events to Sazabi.

## Set up with the CLI

Create the log source and copy its collector configuration with the [Sazabi CLI](https://docs.sazabi.com/reference/cli/log-sources.md):

```bash theme={"system"}
sazabi log-sources create cloudtrail --mode manual
```

The command prints the intake URL for the new source. Point the collector's `otlphttp` exporter at it using the configuration shown above. Run `sazabi log-sources get <log-source-id>` at any time to reprint the endpoint, or `sazabi log-sources setup-instructions cloudtrail` for agent-readable setup steps.

## Verify

Make an AWS API call, for example `aws sts get-caller-identity`. Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) and confirm records attributed to the **AWS CloudTrail** source appear. CloudTrail delivers to CloudWatch Logs within about five minutes; the collector forwards events on its next poll.

## Troubleshooting

**No events arrive** — Confirm the collector's `region` and log group name match the trail's `CloudWatchLogsLogGroupArn`, and that the trail is logging (`aws cloudtrail get-trail-status --name <trail>`).

**"AccessDeniedException" in collector logs** — The collector's credentials are missing `logs:GetLogEvents` or `logs:DescribeLogGroups` on the log group.

**401 from the intake URL** — The URL's public key was rotated or deleted. Copy the current intake URL from the log source's setup screen.

## Further reading

> [card] [AWS CloudTrail (connect your account)](https://docs.sazabi.com/catalogs/log-sources/connect-your-account/cloudtrail.md)
>
> Let Sazabi install a subscription filter on the trail's log group.

> [card] [Log sources](https://docs.sazabi.com/catalogs/log-sources.md)
>
> Browse the full log source catalog.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.