AWS CloudTrail log collection via SNS trigger
The legacy Coralogix-CloudTrail-via-SNS SAR app is deprecated. For new deployments, use the unified Coralogix AWS Shipper, which supports CloudTrail-via-SNS through its IntegrationType and SNSTopicArn parameters. Its parameter set differs from the legacy app described below. See the coralogix-aws-shipper repository for the current reference. These instructions will be migrated in a follow-up.
Forward your CloudTrail logs to Coralogix without writing any shipper code. A predefined Lambda function subscribes to the SNS topic your CloudTrail bucket notifies, reads each new object, and sends its contents to Coralogix.
What you need
- An active CloudTrail account.
- An SNS topic with
SNS:Publishpermission to the bucket. - A CloudTrail S3 bucket with event notifications configured to that SNS topic.
- AWS permissions to create Lambda functions and IAM roles.
- A Coralogix Send-Your-Data API key.
Deploy the Lambda function
Go to the Coralogix AWS Shipper application page in the AWS Serverless Application Repository.
Complete the required parameters, using the table below.
Select Deploy.
Parameters
| Parameter | Description |
|---|---|
| Application Name | Stack name of the application created through AWS CloudFormation |
| ApplicationName | Application name as seen in the Coralogix UI |
| SubsystemName | Subsystem name as seen in the Coralogix UI |
| NotificationEmail | Address that receives an SNS notification if the Lambda fails. Requires a working SNS topic with a validated domain |
| SnsKmsKeyArn | Optional KMS key ARN (not an alias) encrypting the Lambda failure-notification SNS topic. Leave empty for no encryption. The key policy must allow sns.amazonaws.com and the Lambda execution role to use kms:Decrypt and kms:GenerateDataKey* |
| S3BucketName | Name of the S3 bucket holding the CloudTrail logs. Must be in the same region as the stack you create |
| SNSTopicARN | ARN of the SNS topic. Must be in the same region as the S3 bucket |
| CoralogixRegion | Region associated with your Coralogix domain |
| FunctionArchitecture | Lambda function architecture. x86_64 or arm64 |
| FunctionMemorySize | Maximum memory the Lambda may consume. Leave at the default of 1024 |
| FunctionTimeout | Maximum seconds the function may run. Leave at the default of 300 |
| PrivateKey | Your Coralogix Send-Your-Data API key |
Leave FunctionMemorySize and FunctionTimeout at their defaults. The function is sized for the volume CloudTrail produces.