> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bronto.io/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS CloudTrail Events

> Ingest AWS API activity and management events from CloudTrail — who did what, when, and from where across your AWS account.

AWS CloudTrail records API activity and management events across your AWS account — who called what, when, from which source IP, and with which result. CloudTrail is the canonical audit trail and is also the underlying source for service-level activity logs ([DynamoDB](./aws-dynamodb), [Cognito](./aws-cognito), and others).

## Recommended method

[**EventBridge API Destinations**](./aws-eventbridge) — a CloudTrail-driven EventBridge rule delivers events to Bronto in real time over HTTPS, with no intermediate storage.

## Alternatives

* [**S3 Log Forwarder**](./aws-client-s3) — CloudTrail's native destination; the forwarder Lambda subscribes to the trail's bucket and ships new objects.
* [**Kinesis Firehose**](./aws-firehose) — for very high event volumes. Enable *Send to CloudWatch Logs* on the trail, then add a subscription filter on the trail's log group targeting a Firehose stream. CloudTrail events are JSON, so Bronto flattens them into searchable fields automatically — no parser needed.

See [Ingesting AWS Data into Bronto](./aws-overview) for the full service-to-method mapping.

## References

* [AWS CloudTrail — log file examples](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-log-file-examples.html)