# AWS CloudTrail Logs

Please use this integration guide to configure CloudTrail log alerts so they can be received in Squadcast. This integration should be used only for getting CloudTrail log alerts via an SNS endpoint.

For CloudTrail alerts, use the [<mark style="color:blue;">AWS CloudTrail via CloudWatch integration</mark>](https://github.com/punit-squadcast/sq-doc/blob/main/integrations/alert-source-integrations-native/aws-cloudtrail-via-cloudwatch/README.md)<mark style="color:blue;">.</mark>

For regular AWS CloudWatch alarms (like EC2 alerts), use the [<mark style="color:blue;">AWS CloudWatch Integration</mark>](https://github.com/punit-squadcast/sq-doc/blob/main/integrations/alert-source-integrations-native/amazon-cloudwatch-aws/README.md)<mark style="color:blue;">.</mark>

## Using AWS CloudTrail Logs via SNS as an Alert Source

1. Navigate to **Services** -> **Service Overview** -> select or search for your Service. Expand the accordion -> In the Alert Sources section, click **Add**.

<figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-4fbd74e7ca0b30173c47a1d58ed6a0804a0465aa%2FAlert_Sources.png?alt=media&#x26;token=aaca6610-9d18-4dd4-9cf5-320042f326f1" alt="How to configure AWS CloudTrail Logs integration in Squadcast" width="563"><figcaption></figcaption></figure>

2\. Select **AWS CloudTrail Logs**. Copy the displayed **Webhook URL** to [configure](#create-cloudtrail-logs-endpoint-in-aws-sns) it within **AWS CloudTrail Logs.** Finish by clicking **Add Alert Source** -> **Done**.

<figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-ed9bae7c2d737546afafc17ab0446293719c7365%2FAWS%20CloudTrail%20Logs.png?alt=media&#x26;token=7f3b6bd5-81ff-4679-948e-dca321be9b9e" alt="Steps to add AWS CloudTrail Logs integration to a service in Squadcast" width="563"><figcaption></figcaption></figure>

{% hint style="warning" %} <mark style="color:orange;">**Important**</mark>**:**

When an alert source turns <mark style="color:green;">Active</mark>, it’ll show up under Configured Alert Sources. You can either generate a test alert from the integration or wait for a real-time alert to be generated by the Alert Source.\
\
An Alert Source is <mark style="color:green;">active</mark> if there is a recorded incident via that Alert Source for the Service.
{% endhint %}

## Create CloudTrail logs Endpoint in AWS SNS

1. Now log in to your AWS account and proceed to SNS.
2. Click on "**Create topic**" to get "Create new topic" dialog box. Fill in the details as per your requirements and then click on "**Create topic**"

<figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-2ddce3975280c2c2036c3ed674fff89e8533a0ca%2Fcloudtrail_2.png?alt=media&#x26;token=b320b5de-196e-467b-896f-93858c226c9f" alt="Create CloudTrail Logs Endpoint - AWS SNS: Create Topic" width="563"><figcaption></figcaption></figure>

3. Now inside the topic, click on "**Create subscription**" to get "Create subscription" dialog box. Select the protocol as "**HTTPS**" and in the endpoint enter the URL you obtained from previous step. Finally, click on "**Create subscription**" to create the subscription.

<figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-a082ae74db7f00990e0386302df34a418ad708cf%2Fcloudtrail_3.png?alt=media&#x26;token=4508974e-706f-4b1b-a8e7-0be358740a3a" alt="Create Subscription - AWS SNS: HTTPS Endpoint URL" width="563"><figcaption></figcaption></figure>

4. The "**Subscription ID**" for the subscription should to "**Confirmed**" immediately change from "**PendingConfirmation**". Click on the refresh button to verify the same.

<figure><img src="https://1574591692-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F8TaWz01jmUJl58p4ZVel%2Fuploads%2Fgit-blob-78d648f3d92a886e79a94a1bc72a19fc7e094274%2Fcloudtrail_4.png?alt=media&#x26;token=dcdc554e-5309-41f3-8339-026ee67e1472" alt="Verify Subscription Confirmation - AWS SNS: Refresh Subscription Status" width="563"><figcaption></figcaption></figure>

Then you can [configure your CloudTrail log alerts](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/configure-sns-notifications-for-cloudtrail.html) and assign this topic as the notification option and you are good to go.

*Have any questions?* [*Ask the community*](https://community.squadcast.com/view/home)*.*