Moving specific Logs from AWS Cloudtrail to S3

Question

tI want to send a Cloudtrail log (Specifically when an secrets manager key rotates) to an S3 bucket. We already have the logs in Cloudtrail, is there an easy way to configure Cloudtrail to send these logs to S3 as soon as it happens? I was thinking of setting up a Lambda function that runs on a CRON schedule to do this for me, but would there be an easier way?

Answer 1

If you want to get specific events from CT in real-time as they happen, then you should setup CloudWatch Event rule for them:

• Creating a CloudWatch Events Rule That Triggers on an AWS API Call Using AWS CloudTrail

The rule could be:

{
  "source": [
    "aws.secretsmanager"
  ],
  "detail-type": [
    "AWS API Call via CloudTrail"
  ],
  "detail": {
    "eventSource": [
      "secretsmanager.amazonaws.com"
    ],
    "eventName": [
      "RotateSecret"
    ]
  }
}

With a target of Firehose delivery stream set for S3 bucket of your choise.

Answer 2

There is a slightly easier way, although not necessarily cost-effective (depends on your case) and you won't avoid using Lambda. Instead of setting up a cron, you can enable CloudWatch export for your trail, from where you can set a Lambda subscription filter. This way you can export to S3 exactly the events you want (don't have to code the filters into function) as soon as they come. But - you have to pay extra for the CloudWatch Logs, so it's not a good option if you have a large trail.