AWS CloudTrail records account activity and API calls across your AWS infrastructure, capturing who made each call, the source IP address, and when it occurred for auditing, security analysis, and compliance. The CloudTrail API lets you manage trails, event data stores, CloudTrail Lake queries, channels, and dashboards, and look up recorded management events programmatically.
Power end-to-end data operations for your AWS CloudTrail API with Nexla. Our bi-directional AWS CloudTrail connector is purpose-built for AWS CloudTrail, making it simple to ingest data, sync it across systems, and deliver it anywhere — all with no coding required. Nexla turns API-sourced data into ready-to-use, reusable data products and makes it easy to send data to AWS CloudTrail or any other destination. With comprehensive monitoring, lineage tracking, and access controls, Nexla keeps your AWS CloudTrail workflows fast, secure, and fully governed.
Features
Type: API
SourceDestination
Seamless API Integration: Connect to any endpoint as source or destination without coding, with automatic data product creation
Visual Composition & Chaining: Build complex integrations using visual templates, chain API calls, and compose workflows with data validation and filtering
API Proxy: Expose curated slices of your data securely with a secure and customizable API proxy that validates and transforms data on the fly
Request optimization with intelligent batching, retry, and caching to minimize API calls and costs
Before creating an AWS CloudTrail credential, you need AWS credentials that are authorized to call the CloudTrail API. CloudTrail requests are authenticated using AWS Identity and Access Management (IAM) and signed with AWS Signature Version 4. Access is controlled through IAM policies attached to the user or role whose credentials you use.
To prepare access for Nexla, complete the following steps:
Sign in to the AWS Management Console with an account that has permission to manage IAM.
Create or select an IAM user or role that Nexla will use to connect to CloudTrail.
Attach an IAM policy that grants the CloudTrail actions your flows require. The AWS-managed AWSCloudTrail_ReadOnlyAccess policy covers read operations such as DescribeTrails, GetTrailStatus, LookupEvents, and CloudTrail Lake query actions. To create, update, or manage trails, event data stores, channels, or dashboards, grant the corresponding write actions (for example, cloudtrail:CreateTrail, cloudtrail:PutEventSelectors, or cloudtrail:StartQuery).
Generate the credential value that Nexla will send in the Authorization header when signing requests to the CloudTrail endpoint, and store it securely.
Grant only the CloudTrail permissions your integration needs. LookupEvents requests are limited to two per second per account, per Region, and events can be looked up for up to the last 90 days. For complete information about CloudTrail actions, request signing, and IAM permissions, see the AWS CloudTrail API Reference.
After selecting the data source/destination type, click the Add Credential tile to open the Add New Credential overlay.
Enter a name for the credential in the Credential Name field and a short, meaningful description in the Credential Description field.
Enter your token in the API Key Value field. This value is sent in the Authorization header to authenticate each request to the CloudTrail API and must be kept confidential.
Click the Save button at the bottom of the overlay. The newly added credential will now appear in a tile on the Authenticate screen during data source/destination creation.
To create a new data flow, navigate to the Integrate section, and click the New Data Flow button. Select the AWS CloudTrail connector tile, then select the credential that will be used to connect to CloudTrail, and click Next; or, create a new AWS CloudTrail credential for use in this flow.
Nexla provides pre-built templates that can be used to rapidly configure data sources to ingest data from common AWS CloudTrail endpoints. Select the endpoint from which this source will fetch data from the Endpoint pulldown menu. Available endpoint templates are listed in the expandable boxes below.
[Rest API] List trails associated with the current region/account
This endpoint template lists the trails associated with the current Region and account, returning trail names and ARNs. Use it to enumerate configured trails before retrieving their settings or status.
[Rest API] Retrieve settings for one or more trails
This endpoint template retrieves the configuration settings for one or more trails, such as the S3 bucket, logging options, and multi-Region settings. Use it to audit or export how your trails are configured.
[Rest API] Get settings for a single trail
This endpoint template returns the settings for a single specified trail. Use it when you need the full configuration of one trail rather than all trails in the account.
[Rest API] Get status of a trail (logging on/off, latest delivery times)
This endpoint template returns the status of a trail, including whether logging is currently on or off and the latest log-file delivery times and any delivery errors. Use it to monitor the health of a trail.
[Rest API] Look up management events captured by CloudTrail
This endpoint template looks up management events (and CloudTrail Insights events) captured by CloudTrail. Use it to retrieve recorded account activity for analysis, reporting, or security investigations.
Lookup requests are limited to two per second, per account, per Region, and events can be looked up for up to the last 90 days. For details, see the LookupEvents API Reference.
[Rest API] Get event selectors configured for a trail
This endpoint template returns the event selectors, including advanced event selectors, configured for a trail. Use it to review which management, data, and network activity events a trail is set to capture.
[Rest API] Get insight selectors configured for a trail or event data store
This endpoint template returns the CloudTrail Insights selectors configured for a trail or event data store. Use it to review which Insights types, such as API call rate or error rate, are enabled.
[Rest API] List unusual activity insights data
This endpoint template lists the CloudTrail Insights data that identifies unusual API activity in your account. Use it to retrieve detected anomalies for monitoring or alerting.
[Rest API] List insights metric data for a given metric and event source
This endpoint template lists Insights metric data for a specified metric and event source. Use it to retrieve time-series metric values that support unusual-activity analysis.
[Rest API] List tags for CloudTrail resources
This endpoint template lists the tags applied to CloudTrail resources such as trails, event data stores, dashboards, and channels. Use it to inventory resource tagging for governance and cost allocation.
[Rest API] List public keys used for digest file validation
This endpoint template lists the public keys whose private keys were used to sign the digest files within a given time range. Use it when validating the integrity of CloudTrail log files.
[Rest API] Get details of an event data store
This endpoint template returns details about a specified CloudTrail Lake event data store, including its status, retention period, and configuration. Use it to inspect a single event data store.
[Rest API] List event data stores in the account
This endpoint template lists the CloudTrail Lake event data stores in the current account and Region. Use it to enumerate event data stores before querying or managing them.
[Rest API] Start a CloudTrail Lake SQL query
This endpoint template starts a CloudTrail Lake SQL query against one or more event data stores and returns a query ID. Use it to run ad hoc SQL analysis over your recorded events.
[Rest API] Cancel a running CloudTrail Lake query
This endpoint template cancels a running CloudTrail Lake query by its query ID. Use it to stop a long-running or unneeded query.
[Rest API] Get metadata about a CloudTrail Lake query
This endpoint template returns metadata about a CloudTrail Lake query, including its status and statistics. Use it to check the progress of a submitted query.
[Rest API] List queries run on an event data store
This endpoint template lists the queries that have been run on a specified event data store, optionally filtered by time range and status. Use it to review query history.
[Rest API] Get results of a CloudTrail Lake query
This endpoint template returns the result rows of a completed CloudTrail Lake query by its query ID. Use it to ingest the output of a Lake SQL query.
[Rest API] Generate a SQL query from a natural language prompt
This endpoint template generates a CloudTrail Lake SQL query from a natural-language prompt. Use it to draft queries without writing SQL by hand.
[Rest API] Search sample queries relevant to a natural-language phrase
This endpoint template searches CloudTrail's library of sample queries for those relevant to a natural-language phrase. Use it to discover example queries you can adapt.
[Rest API] Get details of an import
This endpoint template returns details about a specified import of logged events into an event data store, including its status. Use it to monitor an in-progress or completed import.
[Rest API] List imports of an account
This endpoint template lists the imports for the account, optionally filtered by destination or status. Use it to enumerate historical and active imports.
[Rest API] List failures for an import
This endpoint template lists the failures encountered during a specified import. Use it to troubleshoot events that could not be imported.
[Rest API] Get details of a channel
This endpoint template returns details about a specified CloudTrail channel used for service-linked integrations. Use it to inspect a channel's configuration.
[Rest API] List channels in the account
This endpoint template lists the channels in the current account and Region. Use it to enumerate channels before inspecting or managing them.
[Rest API] Get details of a dashboard
This endpoint template returns details about a specified CloudTrail Lake dashboard, including its widgets and refresh schedule. Use it to inspect a single dashboard.
[Rest API] List dashboards in the account
This endpoint template lists the CloudTrail Lake dashboards in the current account and Region. Use it to enumerate dashboards before inspecting or refreshing them.
[Rest API] Start a refresh of a dashboard's widgets
This endpoint template starts a refresh of a dashboard's widgets so their underlying queries run and update. Use it to bring a dashboard's data up to date on demand.
[Rest API] Get the resource-based policy attached to a resource
This endpoint template returns the resource-based policy attached to a CloudTrail channel or event data store. Use it to review the access policy governing a resource.
[Rest API] Get event configuration for an event data store
This endpoint template returns the event configuration, including context key selectors, for a specified event data store. Use it to review how events are configured for the store.
[Rest API] Enable Lake query federation for an event data store
This endpoint template enables CloudTrail Lake query federation for an event data store, making it queryable through the AWS Glue Data Catalog and Amazon Athena. Use it to turn on federation for cross-service querying.
[Rest API] Disable Lake query federation for an event data store
This endpoint template disables CloudTrail Lake query federation for an event data store. Use it to turn off federated querying for the store.
Once the selected endpoint template has been configured, click the Test button to the right of the endpoint selection menu to retrieve a sample of the data that will be fetched. Sample data will be displayed in the Endpoint Test Result panel on the right, allowing you to verify that the source is configured correctly before saving.
AWS CloudTrail data sources can also be manually configured to ingest data from any valid CloudTrail API endpoint, including endpoints not covered by the pre-built templates, chained API calls, or custom request parameters. Select the Advanced tab at the top of the configuration screen, and follow the instructions in Connect to Any API to configure the API method, endpoint URL, date/time and lookup macros, path to data, metadata, and request headers.
Once all of the relevant settings have been configured, click the Create button in the upper right corner of the screen to save and create the new AWS CloudTrail data source. Nexla will now begin ingesting data from the configured endpoint and will organize any data that it finds into one or more Nexsets.
Click the + icon on the Nexset that will be sent to the AWS CloudTrail destination, and select the Send to Destination option from the menu. Select the AWS CloudTrail connector from the list of available destination connectors, then select the credential that will be used to connect to CloudTrail, and click Next; or, create a new AWS CloudTrail credential for use in this flow.
Nexla provides pre-built templates that can be used to rapidly configure destinations to send data to common AWS CloudTrail endpoints. Select the endpoint to which data will be sent from the Endpoint pulldown menu. Then, click on the template in the list below to expand it, and follow the instructions to configure additional endpoint settings.
[Rest API] Create a trail to log AWS API/console activity
This endpoint template creates a trail that records AWS API and console activity and delivers log files to an Amazon S3 bucket. Each record from your Nexset is sent as a request to create a trail with the specified settings.
[Rest API] Update trail configuration settings
This endpoint template updates the configuration settings of an existing trail, such as its S3 bucket, logging options, or multi-Region settings. Use it to modify trails from your Nexla flows.
[Rest API] Delete a trail
This endpoint template deletes a specified trail. Use it to remove trails that are no longer needed based on data from your Nexla flows.
[Rest API] Start recording AWS API calls for a trail
This endpoint template starts logging for a specified trail so CloudTrail begins recording AWS API calls. Use it to turn on log delivery for a trail.
[Rest API] Stop recording AWS API calls for a trail
This endpoint template stops logging for a specified trail so CloudTrail stops recording AWS API calls. Use it to pause log delivery for a trail.
[Rest API] Configure event selectors for a trail
This endpoint template configures the event selectors, including advanced event selectors, that specify which management, data, and network activity events a trail captures. Use it to control what a trail logs.
[Rest API] Configure insight selectors for a trail or event data store
This endpoint template configures the CloudTrail Insights selectors for a trail or event data store, enabling Insights types such as API call rate or error rate. Use it to turn Insights detection on or off.
[Rest API] Add one or more tags to a trail, event data store, dashboard, or channel
This endpoint template adds one or more tags to a CloudTrail resource such as a trail, event data store, dashboard, or channel. Use it to apply tags for governance and cost allocation.
[Rest API] Remove one or more tags from a resource
This endpoint template removes one or more tags from a specified CloudTrail resource. Use it to clean up or update resource tagging.
[Rest API] Create a new event data store
This endpoint template creates a new CloudTrail Lake event data store for retaining and querying events. Use it to provision event data stores from your Nexla flows.
[Rest API] Update an event data store
This endpoint template updates the configuration of an existing event data store, such as its retention period or advanced event selectors. Use it to modify event data stores.
[Rest API] Disable and delete an event data store
This endpoint template disables and deletes a specified event data store. Use it to decommission event data stores that are no longer needed.
[Rest API] Restore a soft-deleted event data store
This endpoint template restores an event data store that was soft-deleted and is still within its recovery window. Use it to recover a deleted event data store.
[Rest API] Start ingestion on an event data store
This endpoint template starts ingestion on an event data store so it begins collecting new events. Use it to resume event collection.
[Rest API] Stop ingestion on an event data store
This endpoint template stops ingestion on an event data store so it stops collecting new events. Use it to pause event collection.
[Rest API] Start an import of logged events into an event data store
This endpoint template starts an import of previously logged events from an Amazon S3 source into an event data store. Use it to backfill historical events.
[Rest API] Stop an ongoing import
This endpoint template stops an import that is currently in progress. Use it to halt an ongoing import.
[Rest API] Create a channel for CloudTrail service integrations
This endpoint template creates a channel used to ingest events from a partner or external source into CloudTrail. Use it to provision channels for service integrations.
[Rest API] Update a channel
This endpoint template updates the configuration of an existing channel, such as its destinations. Use it to modify channels from your Nexla flows.
[Rest API] Delete a channel
This endpoint template deletes a specified channel. Use it to remove channels that are no longer needed.
[Rest API] Create a CloudTrail Lake dashboard
This endpoint template creates a CloudTrail Lake dashboard composed of widgets backed by Lake queries. Use it to provision dashboards from your Nexla flows.
[Rest API] Update a dashboard
This endpoint template updates the configuration of an existing dashboard, such as its widgets or refresh schedule. Use it to modify dashboards.
[Rest API] Delete a dashboard
This endpoint template deletes a specified dashboard. Use it to remove dashboards that are no longer needed.
[Rest API] Attach a resource-based policy to a channel or event data store
This endpoint template attaches a resource-based policy to a channel or event data store to control access to it. Use it to set access policies from your Nexla flows.
[Rest API] Delete the resource-based policy attached to a resource
This endpoint template deletes the resource-based policy attached to a specified resource. Use it to remove an access policy.
[Rest API] Configure context key selectors for an event data store
This endpoint template configures the context key selectors that determine which enriched context is stored with events in an event data store. Use it to set event configuration for the store.
[Rest API] Register a member account as delegated administrator for CloudTrail
This endpoint template registers a member account as the delegated administrator for CloudTrail across an AWS Organization. Use it to delegate organization-wide CloudTrail administration.
[Rest API] Remove a member account as delegated administrator for CloudTrail
This endpoint template removes a member account as the delegated administrator for CloudTrail across an AWS Organization. Use it to revoke delegated organization administration.
AWS CloudTrail destinations can also be manually configured to send data to any valid CloudTrail API endpoint. Select the Advanced tab at the top of the configuration screen, and follow the instructions in Connect to Any API to configure the API method, data format, endpoint URL, request headers, attribute exclusions, record batching, and response webhooks.
Once all endpoint settings have been configured, click the Done button in the upper right corner of the screen to save and create the destination. To send the data to the configured AWS CloudTrail endpoint, open the destination resource menu, and select Activate.
The Nexset data will not be sent to the AWS CloudTrail endpoint until the destination is activated. Destinations can be activated immediately or at a later time, providing full control over data movement.
