How to load data from AWS CloudTrail to Apache Iceberg

Learn how to use Airbyte to synchronize your AWS CloudTrail data into Apache Iceberg within minutes.

Try Airbyte Cloud

Get a demo

Building your pipeline or Using Airbyte

Airbyte is the only open solution empowering data teams to meet all their growing custom business demands in the new AI era.

Building in-house pipelines

Bespoke pipelines are:

Inconsistent and inaccurate data
Laborious and expensive
Brittle and inflexible

Furthermore, you will need to build and maintain Y x Z pipelines with Y sources and Z destinations to cover all your needs.

After Airbyte

Airbyte connections are:

Reliable and accurate
Extensible and scalable for all your needs
Deployed and governed your way

All your pipelines in minutes, however custom they are, thanks to Airbyte’s connector marketplace and Connector Builder.

Start syncing with Airbyte in 3 easy steps within 10 minutes

Set up a AWS CloudTrail connector in Airbyte

Connect to AWS CloudTrail or one of 400+ pre-built or 10,000+ custom connectors through simple account authentication.

Set up Apache Iceberg for your extracted AWS CloudTrail data

Select Apache Iceberg where you want to import data from your AWS CloudTrail source to. You can also choose other cloud data warehouses, databases, data lakes, vector databases, or any other supported Airbyte destinations.

Configure the AWS CloudTrail to Apache Iceberg in Airbyte

This includes selecting the data you want to extract - streams and columns -, the sync frequency, where in the destination you want that data to be loaded.

Try Airbyte Cloud

Take a virtual tour

Check out our interactive demo and our how-to videos to learn how you can sync data from any source to any destination.

Demo video of Airbyte Cloud

Demo video of AI Connector Builder

Talk to our team

Old Automated Content

TL;DR

set up AWS CloudTrail as a source connector (using Auth, or usually an API key)
set up Apache Iceberg as a destination connector
define which data you want to transfer and how frequently

You can choose to self-host the pipeline using Airbyte Open Source or have it managed for you with Airbyte Cloud.

This tutorial’s purpose is to show you how.

What is AWS CloudTrail

AWS CloudTrail is a web service developed to simplify and provide assistance with AWS accounts. Enabling compliance, governance, and operational and risk auditing, it allows users to monitor, log, and document AWS account-related activity in an easily searchable format. With its comprehensive account event history function, CloudTrail helps users analyze and troubleshoot security and operational issues, detect unusual account activity, and much more by increasing visibility into customers’ user and resource activity.

What is Apache Iceberg

For huge analytical tables, Apache Iceberg is a high-performance format. Using Apache Iceberg, engines such as Spark, Trino, Flink, Presto, Hive and Impala can safely work with the same tables, at the same time, providing the reliability and simplicity of SQL tables to big data. With Apache Iceberg, you can merge new data, update existing rows, and delete specific rows. Data files can be eagerly rewritten or deleted deltas can be used to make updates faster.

Integrate AWS CloudTrail with Apache Iceberg in minutes

Try for free now

Prerequisites

A AWS CloudTrail account to transfer your customer data automatically from.
A Apache Iceberg account.
An active Airbyte Cloud account, or you can also choose to use Airbyte Open Source locally. You can follow the instructions to set up Airbyte on your system using docker-compose.

Airbyte is an open-source data integration platform that consolidates and streamlines the process of extracting and loading data from multiple data sources to data warehouses. It offers pre-built connectors, including AWS CloudTrail and Apache Iceberg, for seamless data migration.

When using Airbyte to move data from AWS CloudTrail to Apache Iceberg, it extracts data from AWS CloudTrail using the source connector, converts it into a format Apache Iceberg can ingest using the provided schema, and then loads it into Apache Iceberg via the destination connector. This allows businesses to leverage their AWS CloudTrail data for advanced analytics and insights within Apache Iceberg, simplifying the ETL process and saving significant time and resources.

Step 1: Set up AWS CloudTrail as a source connector

1. First, navigate to the AWS Management Console and log in to your account.
2. Once logged in, search for the CloudTrail service and select it.
3. In the CloudTrail dashboard, select the Trails option from the left-hand menu.
4. Click on the name of the trail you want to use as your source connector.
5. In the trail details page, scroll down to the section labeled "Management events" and click on the "Edit" button.
6. In the "Data events" section, click on the "Add data event" button.
7. Select the type of data event you want to capture and configure the settings as needed.
8. Once you have configured the data event, click on the "Save" button to save your changes.
9. Next, navigate to the Airbyte dashboard and select the "Sources" option from the left-hand menu.
10. Click on the "Create a new source" button and select the AWS CloudTrail connector.
11. Enter your AWS access key ID and secret access key in the appropriate fields.
12. Enter the name of the S3 bucket where your CloudTrail logs are stored.
13. Enter the name of the CloudTrail trail you want to use as your source connector.
14. Click on the "Test" button to ensure that your credentials are valid and that Airbyte can connect to your CloudTrail logs.
15. Once the test is successful, click on the "Create" button to create your AWS CloudTrail source connector in Airbyte.

Step 2: Set up Apache Iceberg as a destination connector

1. Open the Airbyte platform and navigate to the "Destinations" tab on the left-hand side of the screen.
2. Click on the "Apache Iceberg" destination connector and select "Create new connection."
3. Enter a name for your connection and provide the necessary credentials for your Apache Iceberg database, including the host, port, database name, username, and password.
4. Test the connection to ensure that it is successful. 5. Select the tables or data sources that you want to replicate to your Apache Iceberg database.
6. Configure any additional settings or options for your connection, such as the frequency of data replication or any transformations that you want to apply to your data.
7. Save your connection and start the replication process.
8. Monitor the progress of your data replication and troubleshoot any issues that may arise.
9. Once the replication process is complete, verify that your data has been successfully replicated to your Apache Iceberg database.
10. Use your Apache Iceberg database to analyze and query your data as needed.

Step 3: Set up a connection to sync your AWS CloudTrail data to Apache Iceberg

Once you've successfully connected AWS CloudTrail as a data source and Apache Iceberg as a destination in Airbyte, you can set up a data pipeline between them with the following steps:

Create a new connection: On the Airbyte dashboard, navigate to the 'Connections' tab and click the '+ New Connection' button.
Choose your source: Select AWS CloudTrail from the dropdown list of your configured sources.
Select your destination: Choose Apache Iceberg from the dropdown list of your configured destinations.
Configure your sync: Define the frequency of your data syncs based on your business needs. Airbyte allows both manual and automatic scheduling for your data refreshes.
Select the data to sync: Choose the specific AWS CloudTrail objects you want to import data from towards Apache Iceberg. You can sync all data or select specific tables and fields.
Select the sync mode for your streams: Choose between full refreshes or incremental syncs (with deduplication if you want), and this for all streams or at the stream level. Incremental is only available for streams that have a primary cursor.
Test your connection: Click the 'Test Connection' button to make sure that your setup works. If the connection test is successful, save your configuration.
Start the sync: If the test passes, click 'Set Up Connection'. Airbyte will start moving data from AWS CloudTrail to Apache Iceberg according to your settings.

Remember, Airbyte keeps your data in sync at the frequency you determine, ensuring your Apache Iceberg data warehouse is always up-to-date with your AWS CloudTrail data.

Use Cases to transfer your AWS CloudTrail data to Apache Iceberg

Integrating data from AWS CloudTrail to Apache Iceberg provides several benefits. Here are a few use cases:

Advanced Analytics: Apache Iceberg’s powerful data processing capabilities enable you to perform complex queries and data analysis on your AWS CloudTrail data, extracting insights that wouldn't be possible within AWS CloudTrail alone.
Data Consolidation: If you're using multiple other sources along with AWS CloudTrail, syncing to Apache Iceberg allows you to centralize your data for a holistic view of your operations, and to set up a change data capture process so you never have any discrepancies in your data again.
Historical Data Analysis: AWS CloudTrail has limits on historical data. Syncing data to Apache Iceberg allows for long-term data retention and analysis of historical trends over time.
Data Security and Compliance: Apache Iceberg provides robust data security features. Syncing AWS CloudTrail data to Apache Iceberg ensures your data is secured and allows for advanced data governance and compliance management.
Scalability: Apache Iceberg can handle large volumes of data without affecting performance, providing an ideal solution for growing businesses with expanding AWS CloudTrail data.
Data Science and Machine Learning: By having AWS CloudTrail data in Apache Iceberg, you can apply machine learning models to your data for predictive analytics, customer segmentation, and more.
Reporting and Visualization: While AWS CloudTrail provides reporting tools, data visualization tools like Tableau, PowerBI, Looker (Google Data Studio) can connect to Apache Iceberg, providing more advanced business intelligence options. If you have a AWS CloudTrail table that needs to be converted to a Apache Iceberg table, Airbyte can do that automatically.

Wrapping Up

To summarize, this tutorial has shown you how to:

Configure a AWS CloudTrail account as an Airbyte data source connector.
Configure Apache Iceberg as a data destination connector.
Create an Airbyte data pipeline that will automatically be moving data directly from AWS CloudTrail to Apache Iceberg after you set a schedule

With Airbyte, creating data pipelines take minutes, and the data integration possibilities are endless. Airbyte supports the largest catalog of API tools, databases, and files, among other sources. Airbyte's connectors are open-source, so you can add any custom objects to the connector, or even build a new connector from scratch without any local dev environment or any data engineer within 10 minutes with the no-code connector builder.

We look forward to seeing you make use of it! We invite you to join the conversation on our community Slack Channel, or sign up for our newsletter. You should also check out other Airbyte tutorials, and Airbyte’s content hub!

What should you do next?

Hope you enjoyed the reading. Here are the 3 ways we can help you in your data journey:

Easily address your data movement needs with Airbyte Cloud

Take the first step towards extensible data movement infrastructure that will give a ton of time back to your data team.

Get started with Airbyte for free

Talk to a data infrastructure expert

Get a free consultation with an Airbyte expert to significantly improve your data movement infrastructure.

Talk to sales

Improve your data infrastructure knowledge

Subscribe to our monthly newsletter and get the community’s new enlightening content along with Airbyte’s progress in their mission to solve data integration once and for all.

Subscribe to newsletter

What sets Airbyte Apart

Modern GenAI Workflows

Streamline AI workflows with Airbyte: load unstructured data into vector stores like Pinecone, Weaviate, and Milvus. Supports RAG transformations with LangChain chunking and embeddings from OpenAI, Cohere, etc., all in one operation.

Move Large Volumes, Fast

Quickly get up and running with a 5-minute setup that supports both incremental and full refreshes, for databases of any size.

An Extensible Open-Source Standard

More than 1,000 developers contribute to Airbyte’s connectors, different interfaces (UI, API, Terraform Provider, Python Library), and integrations with the rest of the stack. Airbyte’s Connector Builder lets you edit or add new connectors in minutes.

Full Control & Security

Airbyte secures your data with cloud-hosted, self-hosted or hybrid deployment options. Single Sign-On (SSO) and Role-Based Access Control (RBAC) ensure only authorized users have access with the right permissions. Airbyte acts as a HIPAA conduit and supports compliance with CCPA, GDPR, and SOC2.

Fully Featured & Integrated

Airbyte automates schema evolution for seamless data flow, and utilizes efficient Change Data Capture (CDC) for real-time updates. Select only the columns you need, and leverage our dbt integration for powerful data transformations.

Enterprise Support with SLAs

Airbyte Self-Managed Enterprise comes with dedicated support and guaranteed service level agreements (SLAs), ensuring that your data movement infrastructure remains reliable and performant, and expert assistance is available when needed.

What our users say

Jean-Mathieu Saponaro

Data & Analytics Senior Eng Manager

"The intake layer of Datadog’s self-serve analytics platform is largely built on Airbyte.Airbyte’s ease of use and extensibility allowed any team in the company to push their data into the platform - without assistance from the data team!"

Learn more

Chase Zieman

Chief Data Officer

“Airbyte helped us accelerate our progress by years, compared to our competitors. We don’t need to worry about connectors and focus on creating value for our users instead of building infrastructure. That’s priceless. The time and energy saved allows us to disrupt and grow faster.”

Learn more

Alexis Weill

Data Lead

“We chose Airbyte for its ease of use, its pricing scalability and its absence of vendor lock-in. Having a lean team makes them our top criteria. The value of being able to scale and execute at a high level by maximizing resources is immense”

Learn more

Sync with Airbyte

Step 1: Set up AWS CloudTrail as a source connector

Step 2: Set up Apache Iceberg as a destination connector

Step 3: Set up a connection to sync your AWS CloudTrail data to Apache Iceberg

Once you've successfully connected AWS CloudTrail as a data source and Apache Iceberg as a destination in Airbyte, you can set up a data pipeline between them with the following steps:

Create a new connection: On the Airbyte dashboard, navigate to the 'Connections' tab and click the '+ New Connection' button.
Choose your source: Select AWS CloudTrail from the dropdown list of your configured sources.
Select your destination: Choose Apache Iceberg from the dropdown list of your configured destinations.
Configure your sync: Define the frequency of your data syncs based on your business needs. Airbyte allows both manual and automatic scheduling for your data refreshes.
Select the data to sync: Choose the specific AWS CloudTrail objects you want to import data from towards Apache Iceberg. You can sync all data or select specific tables and fields.
Select the sync mode for your streams: Choose between full refreshes or incremental syncs (with deduplication if you want), and this for all streams or at the stream level. Incremental is only available for streams that have a primary cursor.
Test your connection: Click the 'Test Connection' button to make sure that your setup works. If the connection test is successful, save your configuration.
Start the sync: If the test passes, click 'Set Up Connection'. Airbyte will start moving data from AWS CloudTrail to Apache Iceberg according to your settings.

Remember, Airbyte keeps your data in sync at the frequency you determine, ensuring your Apache Iceberg data warehouse is always up-to-date with your AWS CloudTrail data.

How to Sync AWS CloudTrail to Apache Iceberg Manually

Step 1:

Step 2:

Step 3:

Step 4:

Step 5:

Step 6:

Step 7:

Step 8:

FAQs

What is ETL?

ETL, an acronym for Extract, Transform, Load, is a vital data integration process. It involves extracting data from diverse sources, transforming it into a usable format, and loading it into a database, data warehouse or data lake. This process enables meaningful data analysis, enhancing business intelligence.

What is AWS CloudTrail?

What data can you extract from AWS CloudTrail?

AWS CloudTrail provides access to a wide range of data related to AWS account activity and resource usage. The following are the categories of data that can be accessed through the API:

1. Event history: This includes information about all the events that have occurred in an AWS account, such as API calls, console sign-ins, and resource changes.
2. Resource activity: This category includes data related to the usage of AWS resources, such as EC2 instances, S3 buckets, and RDS databases.
3. User activity: This category includes data related to user activity in an AWS account, such as user sign-ins, password changes, and access key usage.
4. Security analysis: This category includes data related to security events in an AWS account, such as failed login attempts, unauthorized access attempts, and changes to security groups.
5. Compliance auditing: This category includes data related to compliance auditing in an AWS account, such as changes to IAM policies, CloudTrail configuration changes, and VPC network changes.

Overall, the AWS CloudTrail API provides a comprehensive view of AWS account activity and resource usage, making it a valuable tool for monitoring and managing AWS environments.

How do I transfer data from AWS CloudTrail?

This can be done by building a data pipeline manually, usually a Python script (you can leverage a tool as Apache Airflow for this). This process can take more than a full week of development. Or it can be done in minutes on Airbyte in three easy steps:
1. Set up AWS CloudTrail to Apache Iceberg as a source connector (using Auth, or usually an API key)
2. Choose a destination (more than 50 available destination databases, data warehouses or lakes) to sync data too and set it up as a destination connector
3. Define which data you want to transfer from AWS CloudTrail to Apache Iceberg and how frequently
You can choose to self-host the pipeline using Airbyte Open Source or have it managed for you with Airbyte Cloud.

What is ELT?

ELT, standing for Extract, Load, Transform, is a modern take on the traditional ETL data integration process. In ELT, data is first extracted from various sources, loaded directly into a data warehouse, and then transformed. This approach enhances data processing speed, analytical flexibility and autonomy.

Difference between ETL and ELT?

ETL and ELT are critical data integration strategies with key differences. ETL (Extract, Transform, Load) transforms data before loading, ideal for structured data. In contrast, ELT (Extract, Load, Transform) loads data before transformation, perfect for processing large, diverse data sets in modern data warehouses. ELT is becoming the new standard as it offers a lot more flexibility and autonomy to data analysts.

Back to all tutorials

Databases

Engineering Analytics

How to load data from AWS CloudTrail to Apache Iceberg

Learn how to use Airbyte to synchronize your AWS CloudTrail data into Apache Iceberg within minutes.

Try Airbyte Cloud free

Deploy Airbyte Open Source

TL;DR

What is AWS CloudTrail

What is Apache Iceberg

Prerequisites

Step 1: Setup AWS CloudTrail

Step 2: Setup Apache Iceberg

Step 3: Setup a connection Use Cases Wrapping Up

Example H2

Example H3

Sync data between AWS CloudTrail and Apache Iceberg

Get your data syncing in minutes

Try Airbyte free

TL;DR

set up AWS CloudTrail as a source connector (using Auth, or usually an API key)
set up Apache Iceberg as a destination connector
define which data you want to transfer and how frequently

You can choose to self-host the pipeline using Airbyte Open Source or have it managed for you with Airbyte Cloud.

This tutorial’s purpose is to show you how.

What is AWS CloudTrail

What is Apache Iceberg

Integrate AWS CloudTrail with Apache Iceberg in minutes

Try for free now

Prerequisites

A AWS CloudTrail account to transfer your customer data automatically from.
A Apache Iceberg account.
An active Airbyte Cloud account, or you can also choose to use Airbyte Open Source locally. You can follow the instructions to set up Airbyte on your system using docker-compose.

Step 1: Set up AWS CloudTrail as a source connector

Step 2: Set up Apache Iceberg as a destination connector

Step 3: Set up a connection to sync your AWS CloudTrail data to Apache Iceberg

Once you've successfully connected AWS CloudTrail as a data source and Apache Iceberg as a destination in Airbyte, you can set up a data pipeline between them with the following steps:

Create a new connection: On the Airbyte dashboard, navigate to the 'Connections' tab and click the '+ New Connection' button.
Choose your source: Select AWS CloudTrail from the dropdown list of your configured sources.
Select your destination: Choose Apache Iceberg from the dropdown list of your configured destinations.
Configure your sync: Define the frequency of your data syncs based on your business needs. Airbyte allows both manual and automatic scheduling for your data refreshes.
Select the data to sync: Choose the specific AWS CloudTrail objects you want to import data from towards Apache Iceberg. You can sync all data or select specific tables and fields.
Select the sync mode for your streams: Choose between full refreshes or incremental syncs (with deduplication if you want), and this for all streams or at the stream level. Incremental is only available for streams that have a primary cursor.
Test your connection: Click the 'Test Connection' button to make sure that your setup works. If the connection test is successful, save your configuration.
Start the sync: If the test passes, click 'Set Up Connection'. Airbyte will start moving data from AWS CloudTrail to Apache Iceberg according to your settings.

Remember, Airbyte keeps your data in sync at the frequency you determine, ensuring your Apache Iceberg data warehouse is always up-to-date with your AWS CloudTrail data.

Use Cases to transfer your AWS CloudTrail data to Apache Iceberg

Integrating data from AWS CloudTrail to Apache Iceberg provides several benefits. Here are a few use cases:

Advanced Analytics: Apache Iceberg’s powerful data processing capabilities enable you to perform complex queries and data analysis on your AWS CloudTrail data, extracting insights that wouldn't be possible within AWS CloudTrail alone.
Data Consolidation: If you're using multiple other sources along with AWS CloudTrail, syncing to Apache Iceberg allows you to centralize your data for a holistic view of your operations, and to set up a change data capture process so you never have any discrepancies in your data again.
Historical Data Analysis: AWS CloudTrail has limits on historical data. Syncing data to Apache Iceberg allows for long-term data retention and analysis of historical trends over time.
Data Security and Compliance: Apache Iceberg provides robust data security features. Syncing AWS CloudTrail data to Apache Iceberg ensures your data is secured and allows for advanced data governance and compliance management.
Scalability: Apache Iceberg can handle large volumes of data without affecting performance, providing an ideal solution for growing businesses with expanding AWS CloudTrail data.
Data Science and Machine Learning: By having AWS CloudTrail data in Apache Iceberg, you can apply machine learning models to your data for predictive analytics, customer segmentation, and more.
Reporting and Visualization: While AWS CloudTrail provides reporting tools, data visualization tools like Tableau, PowerBI, Looker (Google Data Studio) can connect to Apache Iceberg, providing more advanced business intelligence options. If you have a AWS CloudTrail table that needs to be converted to a Apache Iceberg table, Airbyte can do that automatically.