1. Docs
  2. Administration
  3. Security & Compliance
  4. Audit Logs
  5. Export to AWS S3

Export audit logs to AWS S3

    Automated export is only available on the Pulumi Business Critical Edition. If you don’t see it in your organization, contact sales.

    Pulumi Cloud can continuously export audit log events to an Amazon S3 bucket. Once configured, new events are delivered automatically — no manual downloads or API polling required.

    Configure export using the console

    1. Navigate to the organization’s Settings.

    2. Navigate to Audit Logs.

    3. Use the three-dot menu and select Configure Audit Logs to S3.

      Audit log export menu showing the Configure Audit Logs to S3 option

    4. Follow the instructions to create an AWS S3 bucket.

    5. Provide a bucket name and a filepath where Pulumi audit logs will be exported, e.g., Pulumi-audit-logs.

    6. Copy the provided policy.

    7. In the AWS console create an IAM role.

    8. Select Another AWS Account and check Require external ID.

    9. Provide the Account ID and External ID, then attach the policy you created.

    10. Provide the ARN of the IAM role.

    11. Test your configuration.

      Testing the audit log export configuration

    12. After a successful test, select Save and Apply.

    13. After an hour, verify that logs have successfully started exporting.

      Successful audit log export configuration