Docs / Log Ingestion / AWS CloudTrail

AWS CloudTrail Ingestion

Integrate infrastructure audit logs directly from your AWS console resources, tracking user actions, console logins, and unauthorized API requests.

1. Integration Overview

Unlike server access logs, AWS CloudTrail events are published as compressed JSON files to S3 buckets. Ingestion works by setting up an S3 trigger notification that executes a Python Lambda function to push logs directly to the Sprint Log Parser ingestion endpoint.

2. AWS Lambda Shipper

Create a new Python Lambda function inside your AWS Console and deploy the following script to forward S3 JSON logs:

import json
import urllib.request
import gzip
import boto3

s3 = boto3.client('s3')

def lambda_handler(event, context):
    bucket = event['Records'][0]['s3']['bucket']['name']
    key = event['Records'][0]['s3']['object']['key']
    
    # Download compressed JSON log
    response = s3.get_object(Bucket=bucket, Key=key)
    with gzip.GzipFile(fileobj=response['Body']) as gzipfile:
        records = json.loads(gzipfile.read().decode('utf-8'))
        
    # Forward payloads
    url = "https://sprint-logparser.dev.5starcompany.com.ng/api/projects/ingest"
    headers = {
        "Content-Type": "application/json",
        "Authorization": "Bearer YOUR_INGESTION_TOKEN"
    }
    
    req = urllib.request.Request(url, data=json.dumps(records).encode(), headers=headers, method="POST")
    with urllib.request.urlopen(req) as res:
        print(f"Shipped {len(records['Records'])} CloudTrail logs. Status: {res.status}")

3. Direct Ingest API Endpoint

CloudTrail logs can also be ingested directly via standard HTTP requests:

POST /api/projects/ingest
Content-Type: application/json
Authorization: Bearer 

{
    "Records": [
        {
            "eventTime": "2026-07-15T18:00:00Z",
            "eventSource": "signin.amazonaws.com",
            "eventName": "ConsoleLogin",
            "sourceIPAddress": "1.2.3.4",
            "errorMessage": "Failed authentication"
        }
    ]
}