# Cloudtrail integration with Graylog

**URL:** <https://community.graylog.org/t/cloudtrail-integration-with-graylog/3988>\
**Category:** Graylog Central (peer support)\
**Created:** [January 30, 2018, 4:22pm UTC](https://community.graylog.org/t/cloudtrail-integration-with-graylog/3988 "2018-01-30T16:22:22Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![rsahu](https://avatars.discourse-cdn.com/v4/letter/r/f07891/32.png) [@rsahu](https://community.graylog.org/u/rsahu)\
**Post date:** [January 30, 2018, 4:22pm UTC](https://community.graylog.org/t/cloudtrail-integration-with-graylog/3988/1 "2018-01-30T16:22:22Z")

</div>

I need to setup Graylog to parse logs it receives from CloudTrail  
Have done the following steps for my account in eu-west -2 but in the grayling stream i can see the us-east-1 logs([sts.amazonaws.com](http://sts.amazonaws.com):AssumeRole in us-east-1 by [logs.amazonaws.com](http://logs.amazonaws.com) / null)  
– Create SNS Topic  
– Create SQS and subscribe to that SNS topic  
– Enable CloudTrail Logs and use the SNS topic  
– Install aws plugin for graylog.  
– Create IAM User and attach the relevant Policies to that user  
Configure Graylog plugin to use the user access key and secret key  
can someone please let me know if i have missed any step.

---

<div class="post-metadata">

**Author:** ![jochen](https://sea2.discourse-cdn.com/flex016/user_avatar/community.graylog.org/jochen/32/8_2.png) [@jochen](https://community.graylog.org/u/jochen)\
**Post date:** [January 30, 2018, 5:37pm UTC](https://community.graylog.org/t/cloudtrail-integration-with-graylog/3988/2 "2018-01-30T17:37:18Z")

</div>

Have you read and followed the instructions in the Graylog AWS Plugin README?

> **[Graylog2/graylog-plugin-aws](https://github.com/Graylog2/graylog-plugin-aws/tree/2.4.3#general-setup)**
>
> Several bundled Graylog plugins to integrate with different AWS services like CloudTrail and FlowLogs. - Graylog2/graylog-plugin-aws

---

<div class="post-metadata">

**Author:** ![rsahu](https://avatars.discourse-cdn.com/v4/letter/r/f07891/32.png) [@rsahu](https://community.graylog.org/u/rsahu)\
**Post date:** [January 31, 2018, 9:35am UTC](https://community.graylog.org/t/cloudtrail-integration-with-graylog/3988/3 "2018-01-31T09:35:24Z")

</div>

Yes I have read and followed all the instructions mentioned in the README but still no luck. Do i have to check anything else which can help me to troubleshoot this issue.

---

<div class="post-metadata">

**Author:** ![rsahu](https://avatars.discourse-cdn.com/v4/letter/r/f07891/32.png) [@rsahu](https://community.graylog.org/u/rsahu)\
**Post date:** [January 31, 2018, 10:56am UTC](https://community.graylog.org/t/cloudtrail-integration-with-graylog/3988/4 "2018-01-31T10:56:05Z")

</div>

The graylog server is configured in the management VPC. VPC peering is configured between the mgmt vpc and my vpc. The SNS and SQS is configured in the mgmt vpc.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex016/uploads/graylog/original/3X/c/7/c7c09c6b5099570133d6502b83f50ba4430de5b6.png) [@system](https://community.graylog.org/u/system)\
**Post date:** [February 14, 2018, 10:56am UTC](https://community.graylog.org/t/cloudtrail-integration-with-graylog/3988/5 "2018-02-14T10:56:12Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.