How to Monitor AWS CloudTrail with a SIEM for Better Security

If you're running applications on AWS, you need to know what's happening in your environment. AWS CloudTrail logs every action taken in your account, but those logs aren't very useful sitting in an S3 bucket. That's where SIEM (Security Information and Event Management) systems come in.

This guide walks you through setting up CloudTrail monitoring with a SIEM so you can actually catch security issues before they become problems.

Why Connect CloudTrail to Your SIEM?

CloudTrail records every API call made in your AWS account—who logged in, what resources were created or deleted, and when configuration changes happened. Without proper monitoring, you're essentially flying blind.

A SIEM system takes those CloudTrail logs and:

• Alerts you to suspicious activity in real-time
• Correlates events across your entire infrastructure
• Helps you meet compliance requirements
• Makes it easier to investigate security incidents

For small businesses, this isn't about having a massive security operations center. It's about getting automated alerts when something unusual happens, like someone creating a new admin user at 3 AM or deleting a production database.

Prerequisites

Before you start, make sure you have:

• AWS account with admin access (or appropriate IAM permissions)
• CloudTrail already enabled (if not, we'll cover that)
• A SIEM solution (popular options include Splunk, Elastic Stack, Sumo Logic, or open-source tools like Wazuh)
• Basic familiarity with AWS console and S3

Step 1: Enable and Configure CloudTrail

If you haven't already enabled CloudTrail, here's how:

1. Log into the AWS Console and navigate to CloudTrail
2. Click "Create trail"
3. Give your trail a name (something like "company-security-trail")
4. Choose "Apply trail to all regions" - this is important for complete visibility
5. Create a new S3 bucket for log storage or select an existing one
6. Enable log file validation (this prevents tampering)
7. Optionally enable CloudWatch Logs integration for faster access

Important configuration tips:

• Enable management events (these track control plane operations)
• Consider enabling data events for sensitive S3 buckets or Lambda functions
• Set up a reasonable retention policy for your S3 bucket (90 days minimum for most compliance frameworks)
• Enable encryption at rest using AWS KMS

Step 2: Set Up S3 Bucket Access for Your SIEM

Your SIEM needs permission to read CloudTrail logs from S3. The cleanest approach is creating a dedicated IAM role.

1. Go to IAM in the AWS Console
2. Create a new IAM user or role (role is preferred for security)
3. Attach a policy that allows:
   • s3:GetObject on your CloudTrail bucket
   • s3:ListBucket on your CloudTrail bucket
   • Optionally kms:Decrypt if you're using KMS encryption

Here's a sample policy (replace YOUR-BUCKET-NAME with your actual bucket):

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "s3:GetObject", "s3:ListBucket" ], "Resource": [ "arn:aws:s3:::YOUR-BUCKET-NAME", "arn:aws:s3:::YOUR-BUCKET-NAME/*" ] } ] }

Step 3: Configure Your SIEM to Ingest CloudTrail Logs

The specific steps vary by SIEM platform, but the general process is similar:

For most SIEM platforms:

1. Add a new data source or input
2. Select AWS CloudTrail or S3 as the source type
3. Enter your AWS credentials (access key or assume role ARN)
4. Specify your CloudTrail S3 bucket and prefix
5. Set the polling interval (every 5-10 minutes is typical)
6. Configure the AWS region

For Splunk specifically:

• Install the Splunk Add-on for AWS
• Configure an AWS account input with your credentials
• Set up a CloudTrail input pointing to your S3 bucket
• Verify data is flowing by searching for sourcetype=aws:cloudtrail

For Elastic Stack:

• Use Filebeat with the AWS S3 input
• Configure the CloudTrail processor in your Filebeat config
• Set up the appropriate Elasticsearch index template

Step 4: Create Meaningful Alerts

Raw logs are useless without actionable alerts. Here are some essential alerts every small business should configure:

High-priority alerts:

• Root account usage (this should almost never happen)
• IAM policy changes
• Security group modifications that open ports to the internet
• CloudTrail logging disabled
• MFA disabled for any user
• New IAM users or roles created

Medium-priority alerts:

• Failed login attempts (especially multiple failures)
• S3 bucket policy changes
• EC2 instances launched in unusual regions
• Unusual API call volumes from a single user

Example alert logic:

For "Root account usage," you'd search for:

• Event name: Any AWS API call
• User identity type: Root
• Alert threshold: Any occurrence

Most SIEMs let you set up these rules through their UI without writing complex queries.

Step 5: Test Your Setup

Don't wait for a real incident to find out your monitoring isn't working.

1. Make a test change in AWS (like creating a test security group)
2. Wait for the polling interval to pass
3. Check your SIEM to verify the event appears
4. Trigger one of your alerts intentionally
5. Confirm you receive the notification

If logs aren't appearing, check:

• IAM permissions are correct
• S3 bucket name and region are accurate
• CloudTrail is actually writing logs (check the S3 bucket directly)
• Your SIEM's AWS credentials haven't expired

Ongoing Maintenance

Setting this up once isn't enough. Plan to:

• Review alerts weekly to reduce false positives
• Update alert rules as your AWS environment changes
• Monitor your S3 storage costs (CloudTrail logs can add up)
• Test your alerts quarterly
• Review who has access to CloudTrail logs

If managing cloud security feels overwhelming, you're not alone. Many small businesses find that having expert help makes the difference between a checkbox exercise and actual protection.

Need Help With AWS Security Monitoring?

Setting up CloudTrail and SIEM integration is just one piece of a comprehensive cloud security strategy. If you'd like help designing a monitoring solution that fits your business, get in touch with our team. We specialize in practical security solutions for small and medium businesses.

FAQ

How much does CloudTrail cost?

The first copy of management events is free in each region. After that, you pay for S3 storage (typically a few dollars per month for small businesses) and optional data events if you enable them. Most small businesses spend $10-50/month on CloudTrail.

Can I use CloudWatch instead of a SIEM?

You can use CloudWatch Logs and CloudWatch Alarms for basic monitoring, and it's better than nothing. However, a SIEM provides much better correlation, search capabilities, and long-term retention. For businesses with compliance requirements, a SIEM is usually necessary.

How long should I retain CloudTrail logs?

It depends on your compliance requirements. Most frameworks require 90 days minimum, but many businesses keep logs for 1-7 years. Use S3 lifecycle policies to move older logs to cheaper storage tiers like S3 Glacier to reduce costs.