Using aws sqs with cloudtrails

Question

Pulumi · Accepted Answer

To integrate AWS CloudTrail with an SQS queue, you would typically want CloudTrail to log API activity within your AWS account and have relevant events delivered to an SQS queue. This setup allows you to programmatically process the trail logs for auditing, real-time analysis, or archival purposes.

AWS CloudTrail records AWS API calls and delivers the log files to an Amazon S3 bucket. To get these logs into an SQS queue, you can implement a solution that involves:

1. An AWS CloudTrail trail to monitor AWS API calls and log that data to an S3 bucket.
2. An Amazon S3 event notification configuration that sends a message to an SQS queue when a new log file is delivered to the bucket.

The following Pulumi program in TypeScript demonstrates setting up AWS CloudTrail with an SQS queue:

```typescript
import * as aws from "@pulumi/aws";

// Create an SQS queue
const myQueue = new aws.sqs.Queue("myTrailQueue", {});

// Create an S3 bucket to store CloudTrail logs
const s3Bucket = new aws.s3.Bucket("myCloudTrailBucket", {
  // Bucket settings can be configured here if necessary (e.g., versioning, ACL, etc.)
});

// Create an AWS CloudTrail trail
const myTrail = new aws.cloudtrail.Trail("myTrail", {
  s3BucketName: s3Bucket.bucket,
  // Include options such as isMultiRegionTrail, eventSelectors, etc., if needed
});

// Grant CloudTrail permission to put objects in your bucket
s3Bucket.onObjectCreated("myS3Event", myQueue, {
  filterSuffix: ".json", // Assuming CloudTrail logs are in JSON format
});

// Output the names and URLs of the created resources
export const queueName = myQueue.name;
export const queueUrl = myQueue.id;
export const bucketName = s3Bucket.bucket;
export const trailName = myTrail.name;

```

### Explanation:

- We import the `aws` module, provided by Pulumi, to use AWS resources in our code.

- An SQS Queue (`myQueue`) is created, which will receive messages when new CloudTrail logs are delivered to the S3 bucket.

- An S3 Bucket (`s3Bucket`) is created to store the log files generated by CloudTrail.

- A CloudTrail (`myTrail`) is created and configured to send log files to the previously created S3 bucket. You may customize the CloudTrail according to your requirements, including setting up multi-region trails or specifying event selectors for granular control over the logging.

- The `onObjectCreated` method configures event notification on the S3 bucket, so whenever a new object is created (which will be the CloudTrail log file), an event is sent to the SQS queue.

- The `filterSuffix` option is used to specify that only objects with the suffix `.json` will trigger the event. This assumes CloudTrail logs are being delivered in JSON format. Adjust this based on the actual format of your CloudTrail logs.

- Lastly, we export some of the resource names and URLs for your reference. These can be used to reference the created resources in other parts of your Pulumi program, or for querying the details using Pulumi CLI.

This program should be run in a Pulumi project directory with AWS provider setup. It will create the necessary AWS resources to send CloudTrail logs to an SQS queue automatically whenever new logs are generated.

Remember to replace the placeholders (e.g., `"myTrailQueue"`, `"myCloudTrailBucket"`, `"myTrail"`, `"myS3Event"`) with names that fit your naming conventions and organizational practices.