---
title: "AWS CloudTrail"
url: "https://axoflow.com/docs/axoflow/data-sources/appliances/amazon/aws-cloudtrail/"
description: "Collect the CloudTrail log files that your trail delivers to an Amazon S3 bucket with a Cloud Connector, and look up the labels Axoflow adds."
last_modified: "2026-10-26T13:26:52+01:00"
---

> For the complete documentation index, see [llms.txt](https://axoflow.com/docs/axoflow/llms.txt).

# AWS CloudTrail

Collect the CloudTrail log files that your trail delivers to an Amazon S3 bucket with a Cloud Connector, and look up the labels Axoflow adds.

AWS CloudTrail:
Tracks AWS account activity and API usage for auditing, governance, and compliance monitoring.

Axoflow can collect the log files that your [AWS CloudTrail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-user-guide.html) trail delivers to an Amazon S3 bucket. At a high level, the process looks like this:

- [Create a **Connector Rule**](https://axoflow.com/docs/axoflow/data-sources/appliances/amazon/aws-cloudtrail/index.md#create-connector-rule) on the AxoRouter that deploys an Axoflow Cloud Connector and collects the data from the S3 bucket that receives the trail log files. Axoflow Cloud Connector is a simple container that runs on an AxoRouter instance.
- Configure a [Flow](https://axoflow.com/docs/axoflow/data-management/index.md) on AxoConsole that processes and routes the collected data to your [destination](https://axoflow.com/docs/axoflow/destinations/index.md) (for example, Splunk or another SIEM).

The Axoflow Cloud Connector doesn’t poll the bucket. Instead, it reads the Amazon SQS queue that receives the `s3:ObjectCreated:*` event notifications of the bucket, and downloads every object that the queue announces.

![How Axoflow collects data from AWS CloudTrail with Axoflow Cloud Connector and AxoRouter](https://axoflow.com/docs/axoflow/data-sources/appliances/amazon/aws-cloudtrail/architecture-same-host.svg)

## Prerequisites

- An AxoRouter instance that:

  - Was provisioned with [**Enable Cloudconnectors**](https://axoflow.com/docs/axoflow/provisioning/axorouter/linux/advanced-options/index.md#cloudconnectors-enable) turned on.
  - Can reach the Amazon S3 and Amazon SQS endpoints of the region on TCP port 443. Adjust your firewall rules and the access rules of the data source as needed.
  - You know the IP address the AxoRouter. To find it:

    1. Open the AxoConsole.
    2. Select the **Routers** or the **Topology** page.
    3. Select on AxoRouter instance that is going to receive the logs.
    4. Check the **Networks > Address** field.
- An AWS account with an active subscription.
- A [trail](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-create-and-update-a-trail.html) that delivers its log files to an S3 bucket. Axoflow Cloud Connector reads plain and gzip-compressed `.json` objects.
- An [SQS queue](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ways-to-add-notification-config-to-bucket.html) that receives the `s3:ObjectCreated:*` event notifications of the bucket, either directly or through an SNS topic. The queue must be in the same region as the bucket, because S3 event notifications can only target a queue in the region of the bucket.
- AWS credentials that can read the queue and download the objects of the bucket. Axoflow Cloud Connector can use:

  - a [static access key and secret key](https://docs.aws.amazon.com/sdkref/latest/guide/feature-static-credentials.html),
  - the default credential chain of the host it runs on (for example, an EC2 instance role, EKS IRSA or Pod Identity, or environment variables),
  - an [IAM role](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles.html) that it assumes with either of the above.

## Configure Axoflow Cloud Connector on AxoRouter

To collect data from CloudTrail, complete the following steps.

1. Select **Routers > Connector Rules > Add Connector Rule**. (Alternatively, you can select **Add Connector > Add a connector rule** on the **Connectors** page of an AxoRouter host.)

   ![Connector rules list](https://axoflow.com/docs/axoflow/img/data-management/connector-rules/connector-rules-list_hu_6f335a0660dd40e6.webp)
2. Select the **AWS CloudTrail**.
3. Enter a name for the connector rule into the **Connector rule name** field.

   ![Generic connector rule parameters](https://axoflow.com/docs/axoflow/img/connector-rule-generic_hu_32a9c886e16162f3.webp)
4. (Optional) Add labels to the connector rule. You will be able to use these labels in [Flow Processing steps](https://axoflow.com/docs/axoflow/data-management/processing/index.md), for example, in the **Query** field of **Select Messages** steps. For details about the message schema and the related connector-specific fields, see the [`meta.connector` object](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.connector).
5. Set the **Router selector** for the connector rule. The selector determines which AxoRouter instances get a connector from this connector rule.

   **CAUTION:**

   Each connector rule for AWS CloudTrail must match exactly one AxoRouter. Use the `name` or `guid` AQL selector to make sure it matches only one AxoRouter. Otherwise several Axoflow Cloud Connector instances collect the same data, and Axoflow receives every message multiple times.

   ![Router selectors](https://axoflow.com/docs/axoflow/img/data-management/connector-rules/connector-rules-router-selector_hu_4e7807cc9a0d1c54.webp)

   You can use any labels and metadata of the AxoRouter hosts in the Router selectors, for example, the hostname of the AxoRouter, or any [custom labels](https://axoflow.com/docs/axoflow/onboard-hosts/hosts/add-host-metadata/index.md).

   - If you leave the router selector empty, it matches every AxoRouter instance.
   - To select only a specific AxoRouter instance, set the `name` field to the name of the instance as selector. For example, `name = my-axorouter`.
   - If you set multiple fields in the selector, the selector will match only AxoRouter instances that match all elements of the selector. (There in an AND relationship between the fields.)
6. (Optional) Enter a **Suffix** for the connector rule. AxoConsole uses the suffix in the name of the connector instances that it creates on the AxoRouter hosts. The name of the connector instance follows the `<name-of-AxoRouter>-<suffix>` schema. For example, if the name of a matching AxoRouter instance is `axorouter-1`, and the suffix of the rule is `custom`, the name of the connector on that AxoRouter is `axorouter-1-custom`.

   If the **Suffix** field is empty, AxoConsole uses the name of the connector rule instead. For example, if the name of the connector rule is `otlp-1`, the name of the connector is `axorouter-1-otlp-1`.
7. (Optional) Enter a description for the rule.
8. Configure how Axoflow Cloud Connector reaches the bucket and the queue.

   - **Region**: The AWS region of the S3 bucket and the SQS queue. S3 event notifications can only target a queue in the region of the bucket.
   - **Bucket**: The name of the S3 bucket that CloudTrail delivers its log files to.
   - **SQS queue URL**: The HTTPS URL of the SQS queue that receives the `s3:ObjectCreated:*` event notifications of the bucket.

   **CAUTION:**

   Use the event notification of the bucket, not the SNS topic that CloudTrail itself can publish to. The CloudTrail notification has a different payload, and Axoflow Cloud Connector doesn’t process it.
9. (Optional) Select **More options** to change the [advanced options](https://axoflow.com/docs/axoflow/data-sources/appliances/amazon/aws-cloudtrail/index.md#advanced-options) of the connector, for example, to set the credentials that Axoflow Cloud Connector authenticates with.
10. Select **Add**. The Axoflow Cloud Connector starts reading the queue and forwarding the collected log files to the AxoRouter instance.
11. Verify that the Axoflow Cloud Connector is running.

    1. Select **Routers**, then select the AxoRouter you added the Axoflow Cloud Connector to.
    2. Select **Services** and check that **axoflow-cloudconnector.service** is running without errors.
12. [Create a Flow](https://axoflow.com/docs/axoflow/data-management/flows/index.md) to route the data from the AxoRouter instance to a destination. You can use the [Labels](https://axoflow.com/docs/axoflow/data-sources/appliances/amazon/aws-cloudtrail/index.md#labels) of this source to select its messages.

## Advanced options

Select **More options** on the connector rule to set the following options.

- **Prefix**: Collect only the objects whose key starts with this prefix. It’s useful if the bucket holds other log types as well.
- **Access key** and **Secret key**: A static AWS credential. Set both options, or neither of them. If you leave them empty, Axoflow Cloud Connector uses the default AWS credential chain of the host it runs on, for example, an EC2 instance role, EKS IRSA or Pod Identity, or environment variables.
- **Role ARN**: The ARN of an IAM role that Axoflow Cloud Connector assumes before it reads the queue and the bucket, for example, when the log files are delivered to the bucket of another account. Axoflow Cloud Connector assumes the role with the static keys if you set them, otherwise with the identity of the host.
- **External ID**: The external ID (`sts:ExternalId`) that the trust policy of the role requires. Set it only together with **Role ARN**.

## Labels

Axoflow automatically adds the following labels to data collected from this source:

| Analytics label | Message field | Value |
| --- | --- | --- |
| `vendor` | [`meta.vendor`](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.vendor) | `amazon` |
| `product` | [`meta.product`](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.product) | `aws-cloudtrail` |
| `service` | [`meta.service.name`](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.service.name) | `management`, `data`, `insight`, or `networkactivity` |

The `service` label depends on the category of the CloudTrail event (the `eventCategory` field): `Management`, `Data`, `Insight`, or `NetworkActivity`.

You can use the labels as:

- labels in **Customize Graph** on the [Analytics page](https://axoflow.com/docs/axoflow/metrics/analytics/index.md),
- in the **Filter labels** field during [log tapping](https://axoflow.com/docs/axoflow/onboard-hosts/log-tapping/index.md).

You can use the message fields

- in [Flow Processing steps](https://axoflow.com/docs/axoflow/data-management/processing/index.md), for example, in the **Query** field of **Select Messages** steps,
- in AQL expressions in the search bars.

## Sending data to Splunk

When sending the data collected from this source to Splunk, Axoflow uses the following sourcetype and index settings:

| sourcetype | index |
| --- | --- |
| `aws:cloudtrail` | `aws-activity` |

If the Axoflow classification doesn’t set the source field for the message automatically, and you haven’t set it in a [flow processing step](https://axoflow.com/docs/axoflow/data-management/processing/index.md#set-fields) manually (by setting the `meta.destination.splunk.source` field), AxoRouter automatically sets the source to the [name of the AxoRouter connector](https://axoflow.com/docs/axoflow/reference/message-schema/reference/index.md#meta.connector.name) that received the message (for example, `axorouter-syslog-tcp-514`).

## Sending data to Google SecOps

When sending the data collected from this source to a [*dynamic* Google SecOps destination](https://axoflow.com/docs/axoflow/destinations/google/secops/index.md), Axoflow sets the following log type: `AWS_CLOUDTRAIL`.