---
title: AWS CloudTrail monitoring integration
source: https://docs.newrelic.com/docs/infrastructure/amazon-integrations/aws-integrations-list/aws-cloudtrail-monitoring-integration
---

[New Relic integrations](https://docs.newrelic.com/docs/infrastructure/introduction-infra-monitoring) include an integration for reporting your AWS CloudTrail events to New Relic. This document explains how to activate this integration and describes the data that can be reported.

## Features

This integration collects information from [AWS CloudTrail](https://aws.amazon.com/documentation/cloudtrail/), which captures and records AWS account activity, mainly for audit and governance purposes.

New Relic's AWS CloudTrail integration collects events that represent errors and AWS console logins. Errors give you awareness about API calls and services that have failed, and console logins help you monitor console activity and potential intrusion attempts.

Besides these two types of data, New Relic does not collect any other data.

## Activate integration [#requirements]

> #### ⚠️ IMPORTANT
>
> The AWS CloudTrail integration collects data from **us-east-1 region only** by default. To enable all AWS regions please contact us at [support.newrelic.com](https://support.newrelic.com/).

To enable this integration follow standard procedures to [Connect AWS services to New Relic](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/get-started/connect-aws-new-relic-infrastructure-monitoring/).

## Configuration and polling [#polling]

You can change the polling frequency and filter data using [configuration options](https://docs.newrelic.com/docs/integrations/new-relic-integrations/getting-started/configure-polling-frequency-data-collection-cloud-integrations).

[Default polling](https://docs.newrelic.com/docs/infrastructure/amazon-integrations/aws-integrations-list/aws-polling-intervals-infrastructure-integrations) information for the AWS CloudTrail integration:

-   New Relic polling interval: 5 minutes

## Find and use data [#find-data]

To find your integration data in infrastructure, go to **[one.newrelic.com > All capabilities](https://one.newrelic.com/all-capabilities) > Infrastructure > AWS** and select one of the AWS CloudTrail integration links.

This integration does not provide metrics: only [event data](https://docs.newrelic.com/docs/telemetry-data-platform/understand-data/new-relic-data-types/#events-new-relic). In our infrastructure UI, you can use the [**Events** page](https://docs.newrelic.com/docs/infrastructure/new-relic-infrastructure/infrastructure-ui-pages/infrastructure-events-page-live-feed-every-config-change) to view a timeline of these events.

You can [query and explore your data](https://docs.newrelic.com/docs/using-new-relic/data/understand-data/query-new-relic-data) using the `InfrastructureEvent` [event type](https://docs.newrelic.com/docs/data-apis/understand-data/new-relic-data-types/#event-data), with a `provider` value of `CloudTrail`.

For general information about how to find and use integration data, see [Understand integration data](https://docs.newrelic.com/docs/infrastructure/integrations/find-use-infrastructure-integration-data).

## Event attributes

Here are attributes that can be reported with CloudTrail events:

| Metadata              | Description                                                                                                                                                                                                             |
| --------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| `awsRegion`           | The AWS region the request was made of.                                                                                                                                                                                 |
| `cloudTrailEventType` | Identifies the type of event that generated the event record. This can be the one of the following values: `AwsApiCall`, `AwsServiceEvent`, `ConsoleSignin`.                                                            |
| `errorCode`           | The AWS service error (if the request returns an error). For a list of the most common errors, see the [AWS CloudTrail documentation](https://docs.aws.amazon.com/awscloudtrail/latest/APIReference/CommonErrors.html). |
| `errorMessage`        | If the request returns an error, the description of the error.                                                                                                                                                          |
| `eventId`             | The unique identifier of the event.                                                                                                                                                                                     |
| `eventName`           | The requested action.                                                                                                                                                                                                   |
| `eventSource`         | The AWS service the request was made of.                                                                                                                                                                                |
| `sourceIpAddress`     | The IP address from which the request was made.                                                                                                                                                                         |
| `userAgent`           | The agent through which the request was made, such as the AWS Management Console, an AWS service, the AWS SDKs, or the AWS CLI.                                                                                         |
| `userName`            | The user name or role name of the requester that called the API in the event returned.                                                                                                                                  |

## Query examples [#example-queries]

You can use New Relic to run queries of AWS CloudTrail data, and optionally use New Relic alerts to set alerts on that data.

**Query example: Count of failed API calls**

Query for a count of failed API calls, aggregated by the AWS service that the request was made to:

````
SELECT count(*) from InfrastructureEvent WHERE provider = 'CloudTrail'
    AND cloudTrailEventType = 'AwsApiCall'
    FACET eventSource
```

````

**Query example: Count of console login errors**

Query to find all console login errors:

````
SELECT * from InfrastructureEvent WHERE provider = 'CloudTrail'
    AND cloudTrailEventType = 'AwsConsoleSignIn'
    AND errorMessage IS NOT NULL
```

````