Skip to main content

Overview

Bronto supports several methods for ingesting data from AWS environments. The right choice depends on where your logs originate, whether you need trace data, your infrastructure preferences, and cost constraints.

Service-to-Method Mapping

Different AWS services suit different ingestion methods. The recommended method is the simplest path that gets the data into Bronto; alternatives may be preferable depending on your existing infrastructure or cost constraints. Each service name in the table below links to a per-source landing page with a short summary of what the service emits and the configuration entry points for that data.
Where the OpenTelemetry SDK supports your runtime, prefer OTel-based instrumentation — it sends logs and traces through one pipeline, gives you consistent service.name / service.namespace routing, and avoids CloudWatch ingestion fees. The ADOT Lambda Layer covers Lambda; ADOT or a Self-Managed OTel Collector cover ECS, EKS, and EC2 workloads.
AWS ServiceRecommended MethodAlternatives
AWS Lambda (logs + traces)ADOT Lambda Layer (OTel-supported runtimes)CloudWatch Log Forwarder (for stdout/stderr capture or unsupported runtimes)
Amazon ECS / FargateADOT (OTel)ECS FireLens, CloudWatch Log Forwarder
Amazon EKSADOT (OTel)Fluent Bit on EKS, Self-Managed OTel Collector, CloudWatch Log Forwarder (control plane logs)
Amazon RDS / Aurora (PostgreSQL)CloudWatch Log ForwarderKinesis Firehose (high-volume)
Amazon RDS / Aurora (MySQL)CloudWatch Log ForwarderKinesis Firehose (high-volume)
AWS CloudTrailEventBridge API DestinationsS3 Log Forwarder, Kinesis Firehose (high-volume)
Amazon API GatewayCloudWatch Log ForwarderKinesis Firehose (high-volume access logs)
ALB / NLB access logsS3 Log Forwarder
VPC Flow LogsS3 Log ForwarderCloudWatch Log Forwarder, Kinesis Firehose (custom parser required)
AWS WAFS3 Log ForwarderKinesis Firehose (native JSON), CloudWatch Log Forwarder
Amazon DynamoDBEventBridge API Destinations (via CloudTrail)CloudWatch Log Forwarder
Amazon ElastiCacheCloudWatch Log ForwarderKinesis Firehose (high-volume)
Amazon CloudFront (real-time logs)Kinesis FirehoseS3 Log Forwarder (standard logs)
Amazon Route 53CloudWatch Log Forwarder (public zone query logs)Kinesis Firehose (Resolver query logs, JSON), S3 Log Forwarder (Resolver query logs)
AWS GuardDutyEventBridge API DestinationsS3 Log Forwarder
Amazon SESKinesis Firehose (full event bodies)
AWS Step FunctionsCloudWatch Log ForwarderEventBridge API Destinations
Amazon CognitoCloudWatch Log Forwarder

Ingestion Methods

Bronto supports the following AWS ingestion methods:
Bronto can be connected via an AWS VPC Private Link, keeping all traffic within the AWS network and avoiding public internet egress. This is available on request — contact support@bronto.io to set this up.