# AWS CloudTrail log collection via SNS trigger

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Faws%2Faws-coudtrail-log-collection-via-sns-trigger.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fcoralogix.com%2Fdocs%2Fintegrations%2Faws%2Faws-coudtrail-log-collection-via-sns-trigger.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

Warning

The legacy `Coralogix-CloudTrail-via-SNS` SAR app is deprecated. For new deployments, use the unified [Coralogix AWS Shipper](https://serverlessrepo.aws.amazon.com/applications/eu-central-1/597078901540/coralogix-aws-shipper), which supports CloudTrail-via-SNS through its `IntegrationType` and `SNSTopicArn` parameters. Its parameter set differs from the legacy app described below. See the [coralogix-aws-shipper repository](https://github.com/coralogix/coralogix-aws-shipper) for the current reference. These instructions will be migrated in a follow-up.

Forward your CloudTrail logs to Coralogix without writing any shipper code. A predefined Lambda function subscribes to the SNS topic your CloudTrail bucket notifies, reads each new object, and sends its contents to Coralogix.

## What you need [​](#what-you-need- "Direct link to what-you-need-")

* An active CloudTrail account.
* An SNS topic with `SNS:Publish` permission to the bucket.
* A CloudTrail S3 bucket with event notifications configured to that SNS topic.
* AWS permissions to create Lambda functions and IAM roles.
* A Coralogix [Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md).

## Deploy the Lambda function [​](#deploy-the-lambda-function- "Direct link to deploy-the-lambda-function-")

1

<!-- -->

.

Open the application

Go to the [Coralogix AWS Shipper application page](https://serverlessrepo.aws.amazon.com/applications/eu-central-1/597078901540/coralogix-aws-shipper) in the AWS Serverless Application Repository.

2

<!-- -->

.

Fill in the parameters

Complete the required parameters, using the table below.

3

<!-- -->

.

Deploy

Select **Deploy**.

## Parameters[​](#parameters "Direct link to Parameters")

| Parameter            | Description                                                                                                                                                                                                                                          |
| -------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Application Name     | Stack name of the application created through AWS CloudFormation                                                                                                                                                                                     |
| ApplicationName      | [Application name](https://coralogix.com/docs/user-guides/account-management/account-settings/application-and-subsystem-names.md) as seen in the Coralogix UI                                                                                        |
| SubsystemName        | [Subsystem name](https://coralogix.com/docs/user-guides/account-management/account-settings/application-and-subsystem-names.md) as seen in the Coralogix UI                                                                                          |
| NotificationEmail    | Address that receives an SNS notification if the Lambda fails. Requires a working SNS topic with a validated domain                                                                                                                                  |
| SnsKmsKeyArn         | Optional KMS key ARN (not an alias) encrypting the Lambda failure-notification SNS topic. Leave empty for no encryption. The key policy must allow `sns.amazonaws.com` and the Lambda execution role to use `kms:Decrypt` and `kms:GenerateDataKey*` |
| S3BucketName         | Name of the S3 bucket holding the CloudTrail logs. Must be in the same region as the stack you create                                                                                                                                                |
| SNSTopicARN          | ARN of the SNS topic. Must be in the same region as the S3 bucket                                                                                                                                                                                    |
| CoralogixRegion      | Region associated with your Coralogix [domain](https://coralogix.com/docs/user-guides/account-management/account-settings/coralogix-domain.md)                                                                                                       |
| FunctionArchitecture | Lambda function architecture. `x86_64` or `arm64`                                                                                                                                                                                                    |
| FunctionMemorySize   | Maximum memory the Lambda may consume. Leave at the default of 1024                                                                                                                                                                                  |
| FunctionTimeout      | Maximum seconds the function may run. Leave at the default of 300                                                                                                                                                                                    |
| PrivateKey           | Your Coralogix [Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md)                                                                                                                |

Note

Leave `FunctionMemorySize` and `FunctionTimeout` at their defaults. The function is sized for the volume CloudTrail produces.

## Related resources[​](#related-resources "Direct link to Related resources")

[AWS CloudTrail](https://coralogix.com/docs/integrations/aws/aws-cloudtrail.md)[Application and subsystem names](https://coralogix.com/docs/user-guides/account-management/account-settings/application-and-subsystem-names.md)[Send-Your-Data API key](https://coralogix.com/docs/user-guides/account-management/api-keys/send-your-data-api-key.md)