AWS CloudTrail via CloudWatch

Effortlessly configure AWS CloudTrail integration into Squadcast - A step-by-step guide on setting up CloudTrail with CloudWatch and SNS Endpoints.

Please use this integration guide to configure CloudTrail alerts so they can be received in Squadcast. This integration should be used only for getting CloudTrail alerts via CloudWatch and an SNS endpoint.

For CloudTrail log alerts, use the AWS CloudTrail Logs integration.

For regular AWS CloudWatch alarms (like EC2 alerts), use the AWS CloudWatch Integration.

Using AWS CloudTrail via CloudWatch as an Alert Source

1. Navigate to Services -> Service Overview -> select or search for your Service. Expand the accordion -> In the Alert Sources section, click Add.

2. Select AWS CloudTrail via CloudWatch. Copy the displayed Webhook URL to configure it within AWS CloudTrail via CloudWatch. Finish by clicking Add Alert Source -> Done.

Important:

When an alert source turns Active, it’ll show up under Configured Alert Sources. You can either generate a test alert from the integration or wait for a real-time alert to be generated by the Alert Source. An Alert Source is active if there is a recorded incident via that Alert Source for the Service.

Create CloudTrail Alarm Endpoint in AWS SNS

1. Now log in to your AWS account and proceed to SNS.

2. Click on "Create topic" to get the "Create new topic" dialogue box. Fill in the details as per your requirements and then click on "Create topic"

1. Now inside the topic, click on "Create subscription" to get the "Create subscription" dialog box. Select the protocol as "HTTPS" and in the endpoint enter the URL you obtained from the previous step. Finally, click on "Create subscription" to create the subscription.

1. The "Subscription ID" for the subscription should immediately change to "Confirmed" from "PendingConfirmation". Click on the refresh button to verify the same.

Then you can configure your CloudTrail alerts and assign this topic as the notification option and you are good to go.

Have any questions? Ask the community.