# Audit Logs to AWS S3 Buckets

Data collected around Audit Events can be streamed from Airkit to AWS S3 buckets, allowing you to investigate the data in external analytics platforms.

![](https://3333962744-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbnBffrSN2FHLC5cM89AM%2Fuploads%2Fgit-blob-7476b4fbcf41df7dc0848fe6fc5f00dfaef67b55%2Fstreaming-audit-logs-to-aws-s3-buckets-v183-0.png?alt=media)

> 📘 Enterprise Feature Streaming Audit Logs requires an **ENTERPRISE** license. If you would like to enable this feature for your Airkit Organization, please contact your Airkit representative or contact [support@airkit.com](mailto:support@airkit.com).

## Streaming Audit Logs to S3

Here, we walk through how to set up your S3 bucket to receive System Audit Logs logs from Airkit.

1. Create your S3 Bucket in AWS. When creating the bucket, select `ACLs disabled`.

![](https://3333962744-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbnBffrSN2FHLC5cM89AM%2Fuploads%2Fgit-blob-62c28145a283658d6599829175f173ecb6016704%2Fstreaming-audit-logs-to-aws-s3-buckets-v183-1.png?alt=media)

2. After creating your S3 Bucket, provide Airkit [permission](https://docs.aws.amazon.com/AmazonS3/latest/API/API_PutObject.html) to your S3 bucket via the following AWS IAM policy.

`{{BUCKET-NAME}}`: name of the S3 bucket you created

`{{aws_region}}`: name of the region your organization is provisioned

* US - `us-west-2`
* AP - `ap-southeast-2`
* EU - `eu-central-1`

`{{organization_id}}`: The ID of your organization. To get your org id, see [Getting Application Metadata](../administration/getting-app-metadata)

```javascript
{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Sid": "AirkitWritePermission",
         "Effect": "Allow",
         "Principal": {
            "AWS": "arn:aws:sts::113997530994:assumed-role/airkit-{{aws_region}}-reporting-export-role/{{organization_id}}"
         },
         "Action": [
            "s3:PutObject"
         ],
         "Resource": [
            "arn:aws:s3:::{{BUCKET-NAME}}/*"
         ]
      }
   ]
}
```

3. In Airkit [Console](../console/console),visit **Settings > Logs and App Notifiers**. The UI will look as follows:

![](https://3333962744-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbnBffrSN2FHLC5cM89AM%2Fuploads%2Fgit-blob-daa67ec6b6f6a21cc807f37daf403647e692c9db%2Fstreaming-audit-logs-to-aws-s3-buckets-v183-2.png?alt=media)

Under **System Audit Logs > S3 bucket**, click **edit** to set an new S3 bucket, and then insert the S3 bucket name you created previously into the pop-up window that appears:

![](https://3333962744-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FbnBffrSN2FHLC5cM89AM%2Fuploads%2Fgit-blob-8822448a872ba76d2fc1cd3092025bab9e6e39eb%2Fstreaming-audit-logs-to-aws-s3-buckets-v183-3.png?alt=media)

Click **Verify**. Airkit will write a test file named `airkit-verify-test-{{timestamp}}`

4. Once configured, every five minutes, Airkit will send relevant Events in a new file to the S3 bucket.

## Schema and Examples

The structure of the exported data depends on the type of Event being sent. There is a lot of variation to the data structure depending on the Event type, as the relevant information depends on the Event details.

There are a couple standard fields that are exported with every Audit Log Event:

* `organizationId`
* `eventTime`
* `eventId`
* `type`
* `kind` - for Audit Log Events, this will always be "Audit"

It is the `type` field that usually determines what other fields that will be part of the export. For instance, consider the following export where `type = app_created`:

```json
{
    "organizationId": "482f2a38-8e9d-4329-b2a0-e97d5bc05d36",
    "type": "app_created",
    "eventTime": "2022-11-14T14:50:02.662",
    "appId": "efb19715-9a42-4a04-81c8-a026fa882f94",
    "eventId": "1RRvwLDVfvR7wathILYtnE34XFDm",
    "elevatedOperation": false,
    "kind": "Audit"
}
```

In addition to the standard fields, this export also contains the fields `appId` and `elevatedOperation`, which contain important information pertaining to app creation.

In contrast, consider the following export where `type = user_login`:

```json
{
    "organizationId": "482f2a38-8e9d-4329-b2a0-e97d5bc05d36",
    "type": "user_login",
    "eventTime": "2022-11-14T21:29:06.062",
    "userId": "32c81dee-db98-4143-8996-888b0b0fc501",
    "eventId": "1RS7LYxhirW8RMtAG5FDB30Psviz",
    "loginType": "org-picker",
    "elevatedOperation": false,
    "kind": "Audit"
}
```

In addition to the standard fields, this export contains the fields `userId`, `loginType`, and `elevatedOperation`, two of which are relevant to a builder logging into the platform but NOT a builder creating a new app.

### Event Types

`type` has the following possible values:

| Event Types                                            |
| ------------------------------------------------------ |
| api\_key\_not\_in\_group                               |
| app\_created                                           |
| app\_deployed                                          |
| app\_undeployed                                        |
| backup\_datastore                                      |
| clone\_datastore                                       |
| created\_invite                                        |
| data\_decrypt                                          |
| data\_encrypt                                          |
| data\_export                                           |
| data\_migration                                        |
| deleted\_adapter                                       |
| deleted\_api\_key                                      |
| deleted\_datastore                                     |
| deleted\_domain\_certificate                           |
| deleted\_embed                                         |
| deleted\_encryption\_key                               |
| deleted\_notifier                                      |
| deleted\_resource                                      |
| deleted\_user                                          |
| deployment\_changed                                    |
| invalid\_api\_key                                      |
| invalid\_login                                         |
| invite\_sent                                           |
| modified\_adapter                                      |
| modified\_api\_key                                     |
| modified\_datastore                                    |
| modified\_domain\_certificate                          |
| modified\_embed                                        |
| modified\_encryption\_key                              |
| modified\_notifier                                     |
| modified\_user\_role                                   |
| new\_adapter                                           |
| new\_api\_key                                          |
| new\_datastore                                         |
| new\_domain\_certificate                               |
| new\_embed                                             |
| new\_encryption\_key                                   |
| new\_notifier                                          |
| new\_resource                                          |
| new\_saml                                              |
| org\_created                                           |
| password\_change                                       |
| portal\_page\_view                                     |
| request\_state                                         |
| saml\_assertion\_received                              |
| searched\_all\_user                                    |
| successfully\_authenticated                            |
| updated\_organization\_displayname\_whitelabelid\_type |
| updated\_organization\_license\_key                    |
| user\_created                                          |
| user\_locked                                           |
| user\_login                                            |
| user\_logout                                           |
| user\_role\_added                                      |
| user\_role\_removed                                    |
| user\_root\_scope\_assigned                            |
| user\_super\_admin\_assigned                           |
| user\_support\_admin\_assigned                         |
| user\_support\_scope\_assigned                         |
| viewed\_all\_organizations                             |
| viewed\_all\_users\_in\_organization                   |
| viewed\_filtered\_organizations                        |
| viewed\_licenses\_by\_org\_id                          |
| viewed\_organization\_by\_id                           |
