AWS CloudTrail Setup Guide

Follow our setup guide to connect AWS CloudTrail to Fivetran.

Prerequisiteslink

To connect AWS CloudTrail to Fivetran, you need:

• An S3 bucket set up to receive log files from CloudTrail (see Amazon’s CloudTrail documentation for details)
• For private buckets, an AWS account with the ability to grant Fivetran permission to read from the bucket

In Fivetranlink

1. Go to your Fivetran dashboard and click on + Connector.
2. Select the AWS CloudTrail connector to launch the setup form.
3. Find the automatically-generated External ID and make a note of it. You will need it to configure AWS to connect with Fivetran.

NOTE: The automatically-generated External ID is tied to your account. If you close and re-open the setup form, the ID will remain the same. You may wish to keep the tab open in the background while you configure your source for convenience, but closing it is also OK.

In AWSlink

Create an IAM Policylink

This step will allow Fivetran to access your S3 bucket.

1. Open the Amazon IAM console.

2. Go to Policies, then select Create Policy.

   

3. Go to the JSON tab.

   

4. Copy the following policy and paste it in the JSON tab, replacing “{your-bucket-name}” with the name of your s3 bucket.

   {
   "Version": "2012-10-17",
   "Statement": [
       {
         "Effect": "Allow",
         "Action": [
   "s3:Get*",
   "s3:List*"
         ],
         "Resource": "arn:aws:s3:::{your-bucket-name}/*"
       },
       {
         "Effect": "Allow",
         "Action": [
   "s3:Get*",
   "s3:List*"
         ],
         "Resource": "arn:aws:s3:::{your-bucket-name}"
       }
     ]
   }
   

5. Click Review Policy.

6. Name the policy “Fivetran-cloudtrail-Access.”

   

7. Click Create Policy.

Create an IAM role link

1. Go to Roles, then select Create Role.

   

2. Select Another AWS Account, then enter Fivetran’s account ID, 834469178297.

   

3. Select Require external ID checkbox.

4. Enter the External ID you got from the Fivetran AWS CloudTrailsetup form.

5. Click Next: Permissions.

   

6. Select the policy “Fivetran-cloudtrail-Access” that you created earlier.

   

7. Click Next: Tags which is optional.

8. Click Next: Review.

9. Name your new role “Fivetran” and click Create Role.

   

10. Select the Fivetran the role you just created.

    

11. Find the Role ARN and make a note of it. You will need it to fill in you Fivetran AWS CloudTrail setup form.

    

Set permissions (Optional)link

You can specify permissions for the Role ARN that you designate for Fivetran. Giving selective permissions to this Role only allows Fivetran to sync what it has permissions to see.

In Fivetranlink

1. Return to the tab with your Fivetran setup form.
2. Enter your desired destination schema name.
3. Enter your Bucket Name.
4. Enter your Role ARN.
5. Enter the prefix if you used one when setting up bucket for AWS CloudTrail.
6. Click Save & Test. Fivetran will take it from here and sync your data from AWS CloudTrail.