AWS CloudTrail Connector

AWS CloudTrail integrates with Bloo using the pull method via the AWS Management API. Once configured, Bloo collects, normalizes, and monitors CloudTrail event logs including API calls, console sign-ins, and administrative actions to help identify activity and security events across your AWS account.

Before You Begin — Prerequisites

You'll need the following before configuring the connector in Bloo. Your AWS CloudTrail trail must already be set up and sending logs to an S3 bucket, with an SQS queue configured to receive notifications from that bucket.

Requirement	Where to Get It	Notes
AWS Account	Sign in at console.aws.amazon.com	Must have IAM admin access to create users and attach policies
CloudTrail Trail	AWS Console → CloudTrail → Trails	A trail must already be configured and logging to an S3 bucket
Access Key ID	Generated from IAM → Users → Security credentials (Step 1 below)	20-character alphanumeric string
Secret Access Key	Generated alongside Access Key ID	Shown only once — copy and store securely
AWS Region	The region where your SQS queue is located	Must match the SQS queue region exactly. Example: us-east-1

ℹ For reference, see the AWS documentation on Creating a CloudTrail trail and Creating an IAM user.

Step 1 — Create an IAM User in AWS

Bloo needs an IAM user with read-only access to CloudTrail. Follow these steps to create one and generate its credentials.

1. Sign in to the AWS Management Console at

   https://console.aws.amazon.com

1. In the search bar, type IAM and select the IAM service.

2. In the left sidebar, click Users under Access management, then click Add users.

1. Enter a username (for example, cloudtrail-bloo-user) and click Next.

1. On the permissions page, select Attach policies directly. Search for CloudTrailReadOnlyAccess and check the box next to it. Click Next.

1. Review the configuration and click Create user.

2. Open the newly created user and click the Security credentials tab. Scroll down to Access keys and click Create access key.

3. Copy the Access Key ID and Secret Access Key. Store both securely, these are the credentials you will enter into Bloo.

⚠ Important: The Secret Access Key is shown only once on this screen. Copy it now or click Download .csv file to save it. You cannot retrieve it again after leaving this page.

Step 2 — Configure the Connector in Bloo

With the credentials from Step 1 and your SQS Queue URL, set up the connector on the Datasource page in Bloo.

1. In Bloo, navigate to the Datasource page and click Add Datasource.

2. Search for and select AWS CloudTrail.

3. Fill in the configuration fields as described below.

Field	Description	Example
Connector Name	A unique display name for this connector instance in Bloo.	CloudTrail-Prod
Access Key ID	Enter the Access Key ID generated in Step 1.	Paste from Step 1
Secret Access Key	Enter the Secret Access Key generated in Step 1.	Paste from Step 1
Region	Enter the AWS region where your SQS queue is located.	us-east-1

1. Click Save. The connector proceeds directly to validation.

✓ Go to Collection Status in Bloo and verify the AWS CloudTrail connector shows status Active.

Related: How to Configure Connectors Collection Status