Skip to main content
AWS CloudTrail records API activity and management events across your AWS account — who called what, when, from which source IP, and with which result. CloudTrail is the canonical audit trail and is also the underlying source for service-level activity logs (DynamoDB, Cognito, and others). EventBridge API Destinations — a CloudTrail-driven EventBridge rule delivers events to Bronto in real time over HTTPS, with no intermediate storage.
CloudTrail sends events to EventBridge only while a trail with logging enabled exists, and only to the default event bus. A rule in the default ENABLED state matches write (mutating) management events. To also receive read-only management events, set the rule state to ENABLED_WITH_ALL_CLOUDTRAIL_MANAGEMENT_EVENTS. Data events, such as S3 object or DynamoDB item activity, arrive only if the trail has data event selectors for them. See AWS service events delivered via CloudTrail.

​
Alternatives

  • S3 Log Forwarder — CloudTrail’s native destination; the forwarder Lambda subscribes to the trail’s bucket and ships new objects.
  • Amazon Data Firehose — for very high event volumes. Send CloudTrail events to CloudWatch Logs, either by enabling Send to CloudWatch Logs on the trail or with a CloudWatch telemetry enablement rule (no trail required), then add a subscription filter on the log group targeting a Firehose stream. CloudTrail events are JSON, so Bronto flattens them into searchable fields automatically — no parser needed.
See Ingesting AWS Data into Bronto for the full service-to-method mapping.

​
References