CloudTrail Integration

Prerequisites

AWS account with CloudTrail enabled and logs stored in S3
Terraform 1.0+ (or OpenTofu)
Anyshift API token (generate one from the AWS integration page)

How It Works

The Anyshift Forwarder is a Lambda function that:

Triggers automatically when new CloudTrail logs are written to S3
Parses and processes the CloudTrail events
Forwards the events to Anyshift for analysis and visualization

Installation

Step 1: Store Your API Token

Create a secret in AWS Secrets Manager to store your Anyshift API token:

aws secretsmanager create-secret \
  --name anyshift-forwarder-token \
  --secret-string "YOUR_API_TOKEN" \
  --region us-east-1

Replace YOUR_API_TOKEN with your token from the AWS integration page.

Step 2: Clone the Terraform Module

git clone https://github.com/anyshift-io/anyshift-forwarder.git
cd anyshift-forwarder

Step 3: Configure Variables

Create a terraform.tfvars file:

aws_account_id            = "YOUR_AWS_ACCOUNT_ID"
aws_region                = "us-east-1"
cloudtrail_bucket_arn     = "arn:aws:s3:::YOUR_CLOUDTRAIL_BUCKET"
anyshift_token_secret_arn = "arn:aws:secretsmanager:us-east-1:YOUR_ACCOUNT:secret:anyshift-forwarder-token-XXXXXX"

# Use the pre-built Lambda layer for your region (check releases for latest version)
lambda_layer_arn = "arn:aws:lambda:us-east-1:211125758836:layer:anyshift-forwarder:3"

# Optional: If your CloudTrail bucket uses KMS encryption
# kms_key_arn = "arn:aws:kms:us-east-1:YOUR_ACCOUNT:key/YOUR_KEY_ID"

Step 4: Deploy

terraform init
terraform apply

Configuration Options

Variable	Description	Required
`aws_account_id`	Your AWS account ID	Yes
`aws_region`	AWS region for deployment	Yes
`cloudtrail_bucket_arn`	ARN of your CloudTrail S3 bucket	Yes
`anyshift_token_secret_arn`	ARN of the Secrets Manager secret containing your API token	Yes
`lambda_layer_arn`	ARN of the pre-built Lambda layer for your region	Yes
`kms_key_arn`	KMS key ARN if your bucket uses SSE-KMS encryption	No

Lambda Layer ARN

Use the following ARN format, replacing {REGION} with your AWS region:

arn:aws:lambda:{REGION}:211125758836:layer:anyshift-forwarder:3

Check the releases page for the latest version. Supported regions: us-east-1, us-east-2, us-west-1, us-west-2, eu-west-1, eu-west-2, eu-west-3, eu-central-1, eu-north-1, ap-northeast-1, ap-northeast-2, ap-southeast-1, ap-southeast-2, ap-south-1, sa-east-1, ca-central-1

Validate Installation

Check that the Lambda function is deployed:

aws lambda get-function --function-name anyshift-forwarder --region us-east-1

View Lambda logs:

aws logs tail /aws/lambda/anyshift-forwarder --follow --region us-east-1

Permissions

The Lambda function requires the following permissions:

S3: Read access to your CloudTrail bucket
Secrets Manager: Read access to the API token secret
KMS: Decrypt permission (only if using KMS-encrypted bucket)
CloudWatch Logs: Write access for logging

All permissions are automatically configured by the Terraform module.

Upgrade

To upgrade to the latest version:

cd anyshift-forwarder
git pull origin main
terraform apply

When using Lambda layers, simply update the lambda_layer_arn to the latest version from the releases page.

Uninstall

terraform destroy

Source Code

The Anyshift Forwarder is open source. View the source code, report issues, or contribute:

GitHub Repository

View source code and releases

Get Started

Product

Interfaces

Workspace

Privacy & Security

CloudTrail Integration

Prerequisites

How It Works

Installation

Step 1: Store Your API Token

Step 2: Clone the Terraform Module

Step 3: Configure Variables

Step 4: Deploy

Configuration Options

Lambda Layer ARN

Validate Installation

Permissions

Upgrade

Uninstall

Source Code

GitHub Repository

​Prerequisites

​How It Works

​Installation

​Step 1: Store Your API Token

​Step 2: Clone the Terraform Module

​Step 3: Configure Variables

​Step 4: Deploy

​Configuration Options

​Lambda Layer ARN

​Validate Installation

​Permissions

​Upgrade

​Uninstall

​Source Code

GitHub Repository

Prerequisites

How It Works

Installation

Step 1: Store Your API Token

Step 2: Clone the Terraform Module

Step 3: Configure Variables

Step 4: Deploy

Configuration Options

Lambda Layer ARN

Validate Installation

Permissions

Upgrade

Uninstall

Source Code