Overview

The AWS CloudTrail integration ingests logs that record every AWS API call across services, including:

• IAM user, role, and policy changes
• EC2, S3, RDS, and Lambda configuration events
• Console sign-in attempts and MFA activity
• AssumeRole and cross-account access events

Atatus reads CloudTrail log files from the S3 bucket that the trail writes to.

Prerequisites

• An AWS CloudTrail trail that delivers logs to an S3 bucket.
• IAM credentials (access key + secret) for a user or role with read access to that bucket.

Step 1: Confirm or create a CloudTrail trail

1. Sign in to the AWS Console and open CloudTrail.
2. Go to Trails and either select an existing trail or click Create trail.
3. If creating a trail:
   • Choose a Trail name (for example, atatus-trail).
   • Select an S3 bucket to receive logs (new or existing).
   • Enable Management events (Read and Write).
   • Optionally enable Data events for S3, Lambda, etc.
4. Note the Trail name and S3 bucket name.

Step 2: Create an IAM user with read-only access

1. In the AWS Console, open IAM → Users → Create user.
2. Name it atatus-cloudtrail-reader. Do not enable console access.
3. Attach a policy granting:
   • s3:GetObject and s3:ListBucket on the CloudTrail bucket
   • cloudtrail:LookupEvents, cloudtrail:GetTrail, cloudtrail:DescribeTrails
4. After creating the user, open Security credentials → Create access key and choose Application running outside AWS.
5. Download or copy the Access key ID and Secret access key.

Tip: For multi-account setups, deploy the IAM user in the management account and reference the trail's S3 bucket via cross-account policies.

Step 3: Connect AWS CloudTrail in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the AWS CloudTrail card and click Connect.
3. Fill in the form:

1. Click Connect.

Verification

• The AWS CloudTrail card shows Configured.
• CloudTrail events appear in Security → Cloud SIEM → Audit Logs → Events with source aws_cloudtrail.