이 페이지는 아직 한국어로 제공되지 않으며 번역 작업 중입니다. 번역에 관한 질문이나 의견이 있으시면 언제든지 저희에게 연락해 주십시오.
AWS CloudTrail provides an audit trail for your AWS account. Datadog reads this audit trail and creates events. Search your Datadog events explorer for these events or use them for correlation on your dashboards. Here is an example of a CloudTrail event:
For information on other AWS services, see the Amazon Web Services integration page
If you haven’t already, set up the Amazon Web Services integration
Note: The Datadog CloudTrail integration requires events to be collected in a CloudTrail bucket.
Add the following permissions to your Datadog IAM policy to collect AWS CloudTrail events. For more information on CloudTrail policies, see the AWS CloudTrail API Reference
. CloudTrail also requires some S3 permissions to access the trails. These are required on the CloudTrail bucket only. For more information on Amazon S3 policies, see the Amazon S3 API Reference
|Lists trails and the s3 bucket the trails are stored in.|
|Skips inactive trails.|
|Lists objects in the CloudTrail bucket to get available trails.|
|Obtains the bucket’s region to download trails.|
|Fetches available trails.|
|Returns information about an account’s organization (required for org trails).|
Add this policy to your existing main Datadog IAM policy:
"Action": ["s3:ListBucket", "s3:GetBucketLocation", "s3:GetObject"],
Note: The principal ARN is the one listed during the installation process for the main AWS integration. See the Resources section of How AWS CloudTrail works with IAM
for more information on CloudTrail resource ARNs. If you are updating your policy (as opposed to adding a new one), you don’t need the
SID or the
Install the Datadog - AWS CloudTrail integration
On the integration page, choose the types of events to show as normal priority (the default filter) in the Datadog events explorer. The accounts you configured in the Amazon Web Services page are also shown here. If you would like to see other events that are not mentioned here, contact Datadog support
In AWS CloudTrail, create a Trail
and select an S3 bucket to write the logs in.
Send logs to Datadog
- If you haven’t already, set up the Datadog Forwarder Lambda function
in your AWS account.
- Once set up, go to the Datadog Forwarder Lambda function. In the Function Overview section, click Add Trigger.
- Select the S3 trigger for the Trigger Configuration.
- Select the S3 bucket that contains your CloudTrail logs.
- Leave the event type as
All object create events.
- Click Add to add the trigger to your Lambda.
Go to the Log Explorer
to start exploring your logs.
For more information on collecting AWS Services logs, see Send AWS Services Logs with the Datadog Lambda Function
The AWS CloudTrail integration does not include any metrics.
The AWS CloudTrail integration creates many different events based on the AWS CloudTrail audit trail. All events are tagged with
#cloudtrail in your Datadog events explorer
. You can set their priority in the integration configuration.
CloudTrail events that can be set to a normal priority (they appear in the Event Explorer under the default filter):
The AWS CloudTrail integration does not include any service checks.
The CloudTrail tile is missing or there are no accounts listed
You need to first configure the Amazon Web Services
integration. Then the CloudTrail tile can be configured.