AWS CloudTrail
Version: 2.0.0
AWS CloudTrail is a service that enables governance, compliance, operational auditing, and risk auditing of your AWS account.
Connect AWS CloudTrail with LogicHub
- Navigate to Automations > Integrations.
- Search for AWS CloudTrail.
- Click Details, then the + icon. Enter the required information in the following fields.
- Label: Enter a connection name.
- Reference Values: Define variables here to templatize integration connections and actions. For example, you can use https://www.{{hostname}}.com where, hostname is a variable defined in this input. For more information on how to add data, see 'Add Data' Input Type for Integrations.
- Verify SSL: Select option to verify connecting server's SSL certificate (Default is Verify SSL Certificate).
- Remote Agent: Run this integration using the LogicHub Remote Agent.
- Region: Enter a valid Region. Example: us-west-1.
- API key: The API key to connect to the AWS CloudTrail.
- Secret Key: Secret Key For CloudTrail.
- After you've entered all the details, click Connect.
Actions for AWS CloudTrail
Lookup Events
Looks up management events captured by CloudTrail.
Input Field
Choose a connection that you have previously created and then fill in the necessary information in the following input fields to complete the connection.
Input Name | Description | Required |
---|---|---|
Max Events | The number of events to return. Possible values are 1 through 50000 (default is 1000). | Optional |
Attribute Key | Attribute Key to lookup. | Optional |
Attribute Value | Attribute value to lookup. | Optional |
Action Timeout | Timeout in seconds (default is 360 seconds). | Optional |
Output
A JSON object containing event version details.
{
"CloudTrailEvent": "{\"eventVersion\":\"1.08\",\"userIdentity\":{\"type\":\"AssumedRole\",\"principalId\":\"AROAIXOY7ENQC3XZWEUO6:ed7eab45-8886-4294-afa2-10bca651\",\"arn\":\"arn:aws:sts::827505017847:assumed-role/obsrvbl_role/ed7eab45-8886-4294-afa2-10bca651\",\"accountId\":\"827505017847\",\"accessKeyId\":\"ASIA4BKZEQP37B6GUG6L\",\"sessionContext\":{\"sessionIssuer\":{\"type\":\"Role\",\"principalId\":\"AROAIXOY7ENQC3XZWEUO6\",\"arn\":\"arn:aws:iam::827505017847:role/obsrvbl_role\",\"accountId\":\"827505017847\",\"userName\":\"obsrvbl_role\"},\"webIdFederationData\":{},\"attributes\":{\"mfaAuthenticated\":\"false\",\"creationDate\":\"2021-01-19T12:42:12Z\"}}},\"eventTime\":\"2021-01-19T12:42:27Z\",\"eventSource\":\"cloudtrail.amazonaws.com\",\"eventName\":\"LookupEvents\",\"awsRegion\":\"us-east-2\",\"sourceIPAddress\":\"52.54.41.7\",\"userAgent\":\"Boto3/1.16.0 Python/3.6.9 Linux/4.15.0-1060-aws Botocore/1.19.0\",\"errorCode\":\"ThrottlingException\",\"errorMessage\":\"Rate exceeded\",\"requestParameters\":null,\"responseElements\":null,\"requestID\":\"304b7f68-e5e7-4244-b37c-9d6ed003985f\",\"eventID\":\"89c7cc6e-0938-433e-8502-8aa4a4c2858c\",\"readOnly\":true,\"eventType\":\"AwsApiCall\",\"managementEvent\":true,\"eventCategory\":\"Management\",\"recipientAccountId\":\"827505017847\"}",
"EventId": "89c7cc6e-0938-433e-8502-8aa4a4c2858c",
"EventName": "LookupEvents",
"EventSource": "cloudtrail.amazonaws.com",
"EventTime": "2021-01-19 12:42:27+00:00",
"Resources": [],
"Username": "ed7eab45-8886-4294-afa2-10bca651",
"error": null,
"has_error": false
}
Release Notes
v2.0.0
- Updated architecture to support IO via filesystemv1.0.11
- Added documentation link in the automation library.
Updated 12 months ago