# AWS CloudTrail log collection via SNS trigger

Copy as Markdown[Open in ChatGPT](https://chatgpt.com/?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fintegrations%2Faws%2Faws-coudtrail-log-collection-via-sns-trigger.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)[Open in Claude](https://claude.ai/new?q=Read%20https%3A%2F%2Fdocs-docusaurus.kinsta.page%2Fintegrations%2Faws%2Faws-coudtrail-log-collection-via-sns-trigger.md%20and%20help%20me%20with%20my%20question%20about%20this%20Coralogix%20documentation%20page.)

Warning

The legacy `Coralogix-CloudTrail-via-SNS` SAR app is deprecated. For new deployments, use the unified **[Coralogix AWS Shipper](https://serverlessrepo.aws.amazon.com/applications/eu-central-1/597078901540/coralogix-aws-shipper)**, which supports CloudTrail-via-SNS using the `IntegrationType` and `SNSTopicArn` parameters. The parameter set differs from the legacy app described below; see the [coralogix-aws-shipper repository](https://github.com/coralogix/coralogix-aws-shipper) for the current reference. These instructions will be migrated in a follow-up.

Coralogix provides a predefined Lambda function to easily forward your CloudTrail logs through SNS to the Coralogix platform. For easy setup, use our app in the [AWS serverless application repository](https://serverlessrepo.aws.amazon.com/applications/eu-central-1/597078901540/coralogix-aws-shipper).

## Prerequisites[​](#prerequisites "Direct link to Prerequisites")

* Active CloudTrail account

* Ready-made SNS topic with permissions `SNS:Publish` to the bucket

* Ready-made CloudTrail S3 bucket with configured event notifications to the above SNS topic

* AWS permissions to create Lambdas and IAM roles

## Installation[​](#installation "Direct link to Installation")

**STEP 1**. Navigate to the [Coralogix AWS Shipper application page](https://serverlessrepo.aws.amazon.com/applications/eu-central-1/597078901540/coralogix-aws-shipper).

**STEP 2**. Fill in the required parameters.

**STEP 3**. Click **Deploy**.

## Parameters[​](#parameters "Direct link to Parameters")

| Parameter            | Description                                                                                                                                                             |
| -------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Application Name     | Stack name of the application created via AWS CloudFormation                                                                                                            |
| ApplicationName      | [Application name](https://docs-docusaurus.kinsta.page/user-guides/account-management/account-settings/application-and-subsystem-names/.md) as seen in the Coralogix UI |
| SubsystemName        | [Subsystem name](https://docs-docusaurus.kinsta.page/user-guides/account-management/account-settings/application-and-subsystem-names/.md) as seen in the Coralogix UI   |
| NotificationEmail    | A notification email will be sent to this address via SNS if the Lambda fails. Requires you have a working SNS with a validated domain                                  |
| S3BucketName         | Name of the S3 bucket with CloudTrail logs to watch. Must be in the same region as the stack that you create                                                            |
| SNSTopicARN          | ARN of the SNS topic. Must be in the same region as the S3 bucket                                                                                                       |
| CoralogixRegion      | Region associated with your Coralogix [domain](https://docs-docusaurus.kinsta.page/user-guides/account-management/account-settings/coralogix-domain/.md)                |
| FunctionArchitecture | Lambda function architecture. Possible options: x86\_64, arm64                                                                                                          |
| FunctionMemorySize   | Maximum allocated memory this Lambda may consume. Do not change default, which is set to 1024.                                                                          |
| FunctionTimeout      | Maximum time (seconds) that the function may be allowed to run. Do not change default, which is set to 300.                                                             |
| PrivateKey           | Coralogix [Send-Your-Data API Key](https://docs-docusaurus.kinsta.page/user-guides/account-management/api-keys/send-your-data-api-key/.md)                              |

**Notes**:

* Do not change the `**FunctionMemorySize**` and `**FunctionTimeout**` parameters.

## Additional Resources[​](#additional-resources "Direct link to Additional Resources")

|               |                                                                                           |
| ------------- | ----------------------------------------------------------------------------------------- |
| Documentation | [AWS CloudTrail](https://docs-docusaurus.kinsta.page/integrations/aws/aws-cloudtrail/.md) |