Setting up AWS CloudTrail Logs for Cloud Security Management

This page is not yet available in Spanish. We are working on its translation.
If you have any questions or feedback about our current translation project, feel free to reach out to us!

Set up AWS CloudTrail Logs to get the most out of CSM Identity Risks. AWS CloudTrail Logs provides additional insights into the actual usage of cloud resources, helping you identify users and roles with significant gaps between provisioned and utilized permissions.

Set up AWS integration using CloudFormation

Sensitive Data Scanner for cloud storage is in Limited Availability. Request Access to enroll.
  1. Go to Datadog’s AWS integration tile to install the integration.
  2. Click Automatically Using CloudFormation. If there is already an AWS account set up, click Add Another Account first.
  3. Select the AWS Region where the CloudFormation stack will be launched.
  4. Select or create the Datadog API Key used to send data from your AWS account to Datadog.
  5. To configure the Datadog Lambda Forwarder, select Yes for Send Logs to Datadog. This enables AWS CloudTrail logs to be sent to Datadog.
  6. To enable Cloud Security Management, select Yes for Detect security issues.
  7. If you select Yes for Detect security issues, the Enable Sensitive Data Scanner for Cloud Storage option appears. Turn this on to automatically identify and classify sensitive data stored in Amazon S3.
  8. Click Launch CloudFormation Template. This opens the AWS Console and loads the CloudFormation stack with the parameters filled in based on your selections in the Datadog form.
  9. Check the required boxes from AWS and click Create stack.
  10. After the CloudFormation stack is created, return to the AWS integration tile in Datadog and click Ready!

Notes:

  • The DatadogAppKey parameter enables the CloudFormation stack to make API calls to Datadog, allowing it to add and edit the configuration for this AWS account. The key is automatically generated and tied to your Datadog account.
  • For more information about Datadog’s AWS integration and CloudFormation template, see Getting Started with AWS.
  • If you need to set up the AWS integration manually, see AWS manual setup instructions.

Enable AWS CloudTrail logging

Enable AWS CloudTrail logging so that logs are sent to a S3 bucket. If you already have this setup, skip to Send AWS CloudTrail logs to Datadog.

  1. Click Create trail on the CloudTrail dashboard.
  2. Enter a name for your trail.
  3. Create a new S3 bucket or use an existing S3 bucket to store the CloudTrail logs.
  4. Create a new AWS KMS key or use an existing AWS KMS key, then click Next.
  5. Leave the event type with the default management read and write events, or choose additional event types you want to send to Datadog, then click Next.
  6. Review and click Create trail.

Send AWS CloudTrail logs to Datadog

Set up a trigger on your Datadog Forwarder Lambda function to send CloudTrail logs stored in the S3 bucket to Datadog for monitoring.

  1. Go to the Datadog Forwarder Lambda that was created during the AWS integration set up.
  2. Click Add trigger.
  3. Select S3 for the trigger.
  4. Select the S3 bucket you are using to collect AWS CloudTrail logs.
  5. For Event type, select All object create events.
  6. Click Add.
  7. See CloudTrail logs in Datadog’s Log Explorer.

See Log Explorer for more information on how to search and filter, group, and visualize your logs.