-
Notifications
You must be signed in to change notification settings - Fork 37
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
How to set AWS cloudtrail input from another aws account bucket #77
Comments
Hello, what version of the graylog-aws-plugin are you using and how is your input configured? |
Well, looks like some kind of permission problems. Can you describe what resources and roles(with permissions) are in each account? |
Well, your setup looks fine for me. I'll try to configure one of my graylog instances with the same setup and check what happens. |
OK,appreciate your help.I am looking forward to hear about your test result.I have stuck at this error about two month and try this lab for GDPR scenario.I think that could help graylog more suitable in enterprise environment if we resolve this error. |
Would like support for this too. It's AWS best practice to run multiple accounts and centralize CloudTrail logs into a single bucket in a logging account. It would be incredibly cumbersome to have each account's CloudTrail send SNS notifications to the logging account. The CloudTrail plugin should support parsing SQS messages sent by S3 event notifications, not just CloudTrail notifications. The format is defined here: https://docs.aws.amazon.com/AmazonS3/latest/dev/notification-content-structure.html Please add support for this format so we can keep things centralized and not needlessly rely on SNS which just inflates the cost of getting the logs to Graylog for no added value. |
@qoovsxp I got around the current limitations by putting S3 events on the CloudTrail bucket, sending them to Lambda, then restructuring them to look like the SNS log delivery messages the plugin wants. Some python code:
|
Do SNS support cross account? If yes Then I can provide my aws log account SNS topic to all my other accounts cloud trial. |
Hi,
We follow this document to set sharing CloudTrail Log Files Between AWS Accounts.
https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-sharing-logs.html
We put B AWS account’s cloudtrail logs to A AWS account bucket.
And we let cloudtrail iam user can access A AWS account bucket.
We set a assume role to input try to get log from A AWS account bucket,but a SQS error occur.
I guess it's cause by the assume role cant's access the SQS queue on B AWS account.
And it occur can’t get log from s3 bucket if we don’t set assume role to input.
Anyone can help us?
Thanks.
The text was updated successfully, but these errors were encountered: