Moving specific Logs from AWS Cloudtrail to S3

Question

tI want to send a Cloudtrail log (Specifically when an secrets manager key rotates) to an S3 bucket. We already have the logs in Cloudtrail, is there an easy way to configure Cloudtrail to send these logs to S3 as soon as it happens? I was thinking of setting up a Lambda function that runs on a CRON schedule to do this for me, but would there be an easier way?

Answer 1

If you want to get specific events from CT in real-time as they happen, then you should setup CloudWatch Event rule for them:

• Creating a CloudWatch Events Rule That Triggers on an AWS API Call Using AWS CloudTrail

The rule could be:

{
  "source": [
    "aws.secretsmanager"
  ],
  "detail-type": [
    "AWS API Call via CloudTrail"
  ],
  "detail": {
    "eventSource": [
      "secretsmanager.amazonaws.com"
    ],
    "eventName": [
      "RotateSecret"
    ]
  }
}

With a target of Firehose delivery stream set for S3 bucket of your choise.