Overview
Bronto supports several methods for ingesting data from AWS environments. The right choice depends on where your logs originate, whether you need trace data, your infrastructure preferences, and cost constraints.Service-to-Method Mapping
Different AWS services suit different ingestion methods. The recommended method is the simplest path that gets the data into Bronto; alternatives may be preferable depending on your existing infrastructure or cost constraints. Each service name in the table below links to a per-source landing page with a short summary of what the service emits and the configuration entry points for that data.Ingestion Methods
Bronto supports the following AWS ingestion methods:- S3 Log Forwarder — Lambda subscribes to S3 events and forwards new log objects.
- CloudWatch Log Forwarder — Lambda subscribes to CloudWatch log groups and streams events.
- ECS FireLens — Fluent Bit sidecar in your ECS task definitions; no Lambda required.
- Fluent Bit on EKS — Fluent Bit DaemonSet that collects container logs from every EKS node.
- ADOT — ECS / EKS — AWS-managed OpenTelemetry Collector distribution for ECS and EKS workloads.
- ADOT Lambda Layer — OpenTelemetry instrumentation layer for AWS Lambda functions.
- Self-Managed OTel Collector — Your own OpenTelemetry Collector deployment for full control.
- EventBridge API Destinations — Native EventBridge rule that POSTs events directly to Bronto.
- Amazon Data Firehose for Logs — Direct delivery of high-volume AWS log records.
- Amazon Data Firehose for CloudWatch Metrics — Delivery of OpenTelemetry 1.0 CloudWatch Metric Streams.
AWS VPC Private Link
Bronto can be connected via an AWS VPC Private Link, keeping all traffic within the AWS network and avoiding public internet egress. This is available on request — contact support@bronto.io to set this up. With PrivateLink enabled, DNS in your VPC resolvesingestion.eu.bronto.io or ingestion.us.bronto.io to private IP addresses that are reachable only from within that VPC. Everything you send to Bronto from inside the VPC stays on the AWS network, whichever endpoint path or integration it uses, and you do not change any endpoint URLs. Data sent from outside the VPC is still ingested, but travels over the public internet.
AWS services outside your VPC
Whether an AWS service’s traffic to Bronto uses PrivateLink depends on whether AWS lets that service run in or connect to your VPC. For example, Lambda functions can connect to a VPC. Amazon Data Firehose cannot: its HTTP endpoint destination has no PrivateLink or VPC delivery option, so the Amazon Data Firehose for Logs and Amazon Data Firehose for CloudWatch Metrics integrations deliver over the public internet.Requesting PrivateLink
When you contact support@bronto.io, include:- your Bronto region (EU or US)
- the AWS account IDs you will connect from
- the AWS regions you will connect from