Simple Log Service:Import AWS CloudTrail logs

Before you begin

AWS CloudTrail writes audit logs to an Amazon S3 bucket. Each time Amazon S3 receives new data, it sends a notification message to an Amazon SQS queue, and Simple Log Service imports the logs from that queue.

Review the following requirements before you import AWS CloudTrail logs:

• Supported regions — You can create the Simple Log Service project only in China (Hangzhou), China (Beijing), China (Zhangjiakou), China (Ulanqab), China (Chengdu), and China (Shenzhen).

• IAM permissions — If you use an IAM user, grant the user the following permissions.

{
  "Version": "1",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sqs:ReceiveMessage",
        "sqs:SendMessage",
        "sqs:DeleteMessage",
        "sqs:GetQueueAttributes",
        "sqs:ListQueues",
        "s3:GetObject",
        "kms:Decrypt"
      ],
      "Resource": "*"
    }
  ]
}

In AWS, complete the following configuration so that new CloudTrail data triggers notifications to your SQS queue:

1. Create a trail in AWS CloudTrail.

2. Create a queue in Amazon SQS.

3. Configure event notifications in the Amazon S3 bucket that corresponds to the trail created in step 1.

   When you configure event notifications, set the destination to the queue created in step 2.

Procedure

1. Log on to the Log Service console

2. In the Log Application section, on the Audit & Security tab, click Log Analysis for AWS CloudTrail.

3. On the Data Import Management page, click Add.

4. In the Create Configuration panel, create a CloudTrail audit configuration.

   1. Configure the following parameters.

      Parameter	Description
      Configuration Name	The name of the CloudTrail audit configuration.
      Project	The project used to manage the resources of the CloudTrail audit application. For supported regions, see Before you begin.
      AWS account ID	The ID of the AWS account.
      AWS access key ID	The AWS access key ID used to access AWS. Important Make sure that your access key has the permissions to access the required AWS resources.
      AWS secret access key	The AWS secret access key used to access AWS.
      AWS region	The region where the SQS queue resides.
      SQS Queue URL	The identifier of the SQS queue.
      SQS BatchSize	The maximum number of messages that can be pulled from SQS at a time. Default value: 10. Valid values: 1 to 10.
      Import Interval	The scheduling interval of the data import task. Default value: 3. Valid values: 1 to 43,200. Unit: minutes.
      Concurrent Tasks	The number of concurrent data import tasks. Default value: 1. Valid values: 1 to 20. Note If the data volume is large, you can increase this value.

   2. Click Preview.

      Note

      If the preview fails, troubleshoot the configuration based on the error message. You can proceed to the next step only after the preview result displays success.

   3. Click OK.

Related operations

You can also perform the following operations on the Data Import Management page.

The following operations let you view imported logs and reports:

The following operations manage the configuration lifecycle: