Databases
Engineering Analytics

How to load data from AWS CloudTrail to Starburst Galaxy

Learn how to use Airbyte to synchronize your AWS CloudTrail data into Starburst Galaxy within minutes.

TL;DR

This can be done by building a data pipeline manually, usually a Python script (you can leverage a tool as Apache Airflow for this). This process can take more than a full week of development. Or it can be done in minutes on Airbyte in three easy steps:

  1. set up AWS CloudTrail as a source connector (using Auth, or usually an API key)
  2. set up Starburst Galaxy as a destination connector
  3. define which data you want to transfer and how frequently

You can choose to self-host the pipeline using Airbyte Open Source or have it managed for you with Airbyte Cloud.

This tutorial’s purpose is to show you how.

What is AWS CloudTrail

AWS CloudTrail is a web service developed to simplify and provide assistance with AWS accounts. Enabling compliance, governance, and operational and risk auditing, it allows users to monitor, log, and document AWS account-related activity in an easily searchable format. With its comprehensive account event history function, CloudTrail helps users analyze and troubleshoot security and operational issues, detect unusual account activity, and much more by increasing visibility into customers’ user and resource activity.

What is Starburst Galaxy

Starburst Data is a data access and analytics company that offers a cloud-native, SQL-based query engine called Presto. Their mission is to enable organizations to access and analyze data across various sources efficiently and at scale. Starburst Data provides an enterprise-grade platform that leverages the power of Presto to query data residing in different databases, data lakes, and cloud storage systems, eliminating data silos and accelerating insights. With a focus on performance, security, and ease of use, Starburst Data empowers businesses to unlock the value of their data, enabling faster decision-making and advanced analytics capabilities.

Integrate AWS CloudTrail with Starburst Galaxy in minutes

Try for free now

Prerequisites

  1. A AWS CloudTrail account to transfer your customer data automatically from.
  2. A Starburst Galaxy account.
  3. An active Airbyte Cloud account, or you can also choose to use Airbyte Open Source locally. You can follow the instructions to set up Airbyte on your system using docker-compose.

Airbyte is an open-source data integration platform that consolidates and streamlines the process of extracting and loading data from multiple data sources to data warehouses. It offers pre-built connectors, including AWS CloudTrail and Starburst Galaxy, for seamless data migration.

When using Airbyte to move data from AWS CloudTrail to Starburst Galaxy, it extracts data from AWS CloudTrail using the source connector, converts it into a format Starburst Galaxy can ingest using the provided schema, and then loads it into Starburst Galaxy via the destination connector. This allows businesses to leverage their AWS CloudTrail data for advanced analytics and insights within Starburst Galaxy, simplifying the ETL process and saving significant time and resources.

Step 1: Set up AWS CloudTrail as a source connector

1. First, navigate to the AWS Management Console and log in to your account.
2. Once logged in, search for the CloudTrail service and select it.
3. In the CloudTrail dashboard, select the Trails option from the left-hand menu.
4. Click on the name of the trail you want to use as your source connector.
5. In the trail details page, scroll down to the section labeled "Management events" and click on the "Edit" button.
6. In the "Data events" section, click on the "Add data event" button.
7. Select the type of data event you want to capture and configure the settings as needed.
8. Once you have configured the data event, click on the "Save" button to save your changes.
9. Next, navigate to the Airbyte dashboard and select the "Sources" option from the left-hand menu.
10. Click on the "Create a new source" button and select the AWS CloudTrail connector.
11. Enter your AWS access key ID and secret access key in the appropriate fields.
12. Enter the name of the S3 bucket where your CloudTrail logs are stored.
13. Enter the name of the CloudTrail trail you want to use as your source connector.
14. Click on the "Test" button to ensure that your credentials are valid and that Airbyte can connect to your CloudTrail logs.
15. Once the test is successful, click on the "Create" button to create your AWS CloudTrail source connector in Airbyte.

Step 2: Set up Starburst Galaxy as a destination connector

1. First, navigate to the connectors page on Airbyte and select the Starburst Galaxy destination connector.
2. Next, enter the required credentials for your Starburst Galaxy account, including the host, port, database name, username, and password.
3. Once you have entered your credentials, click on the "Test Connection" button to ensure that the connection is successful.
4. If the connection is successful, you can then configure the settings for your destination connector, including the table name, schema, and any additional options.
5. After configuring your settings, you can then run a sync to transfer data from your source connector to your Starburst Galaxy destination.
6. You can monitor the progress of your sync and view any errors or warnings that may occur during the transfer process.
7. Once the sync is complete, you can then view your data in your Starburst Galaxy database and use it for analysis or other purposes.

Step 3: Set up a connection to sync your AWS CloudTrail data to Starburst Galaxy

Once you've successfully connected AWS CloudTrail as a data source and Starburst Galaxy as a destination in Airbyte, you can set up a data pipeline between them with the following steps:

  1. Create a new connection: On the Airbyte dashboard, navigate to the 'Connections' tab and click the '+ New Connection' button.
  2. Choose your source: Select AWS CloudTrail from the dropdown list of your configured sources.
  3. Select your destination: Choose Starburst Galaxy from the dropdown list of your configured destinations.
  4. Configure your sync: Define the frequency of your data syncs based on your business needs. Airbyte allows both manual and automatic scheduling for your data refreshes.
  5. Select the data to sync: Choose the specific AWS CloudTrail objects you want to import data from towards Starburst Galaxy. You can sync all data or select specific tables and fields.
  6. Select the sync mode for your streams: Choose between full refreshes or incremental syncs (with deduplication if you want), and this for all streams or at the stream level. Incremental is only available for streams that have a primary cursor.
  7. Test your connection: Click the 'Test Connection' button to make sure that your setup works. If the connection test is successful, save your configuration.
  8. Start the sync: If the test passes, click 'Set Up Connection'. Airbyte will start moving data from AWS CloudTrail to Starburst Galaxy according to your settings.

Remember, Airbyte keeps your data in sync at the frequency you determine, ensuring your Starburst Galaxy data warehouse is always up-to-date with your AWS CloudTrail data.

Use Cases to transfer your AWS CloudTrail data to Starburst Galaxy

Integrating data from AWS CloudTrail to Starburst Galaxy provides several benefits. Here are a few use cases:

  1. Advanced Analytics: Starburst Galaxy’s powerful data processing capabilities enable you to perform complex queries and data analysis on your AWS CloudTrail data, extracting insights that wouldn't be possible within AWS CloudTrail alone.
  2. Data Consolidation: If you're using multiple other sources along with AWS CloudTrail, syncing to Starburst Galaxy allows you to centralize your data for a holistic view of your operations, and to set up a change data capture process so you never have any discrepancies in your data again.
  3. Historical Data Analysis: AWS CloudTrail has limits on historical data. Syncing data to Starburst Galaxy allows for long-term data retention and analysis of historical trends over time.
  4. Data Security and Compliance: Starburst Galaxy provides robust data security features. Syncing AWS CloudTrail data to Starburst Galaxy ensures your data is secured and allows for advanced data governance and compliance management.
  5. Scalability: Starburst Galaxy can handle large volumes of data without affecting performance, providing an ideal solution for growing businesses with expanding AWS CloudTrail data.
  6. Data Science and Machine Learning: By having AWS CloudTrail data in Starburst Galaxy, you can apply machine learning models to your data for predictive analytics, customer segmentation, and more.
  7. Reporting and Visualization: While AWS CloudTrail provides reporting tools, data visualization tools like Tableau, PowerBI, Looker (Google Data Studio) can connect to Starburst Galaxy, providing more advanced business intelligence options. If you have a AWS CloudTrail table that needs to be converted to a Starburst Galaxy table, Airbyte can do that automatically.

Wrapping Up

To summarize, this tutorial has shown you how to:

  1. Configure a AWS CloudTrail account as an Airbyte data source connector.
  2. Configure Starburst Galaxy as a data destination connector.
  3. Create an Airbyte data pipeline that will automatically be moving data directly from AWS CloudTrail to Starburst Galaxy after you set a schedule

With Airbyte, creating data pipelines take minutes, and the data integration possibilities are endless. Airbyte supports the largest catalog of API tools, databases, and files, among other sources. Airbyte's connectors are open-source, so you can add any custom objects to the connector, or even build a new connector from scratch without any local dev environment or any data engineer within 10 minutes with the no-code connector builder.

We look forward to seeing you make use of it! We invite you to join the conversation on our community Slack Channel, or sign up for our newsletter. You should also check out other Airbyte tutorials, and Airbyte’s content hub!

What should you do next?

Hope you enjoyed the reading. Here are the 3 ways we can help you in your data journey:

flag icon
Easily address your data movement needs with Airbyte Cloud
Take the first step towards extensible data movement infrastructure that will give a ton of time back to your data team. 
Get started with Airbyte for free
high five icon
Talk to a data infrastructure expert
Get a free consultation with an Airbyte expert to significantly improve your data movement infrastructure. 
Talk to sales
stars sparkling
Improve your data infrastructure knowledge
Subscribe to our monthly newsletter and get the community’s new enlightening content along with Airbyte’s progress in their mission to solve data integration once and for all.
Subscribe to newsletter

What should you do next?

Hope you enjoyed the reading. Here are the 3 ways we can help you in your data journey:

flag icon
Easily address your data movement needs with Airbyte Cloud
Take the first step towards extensible data movement infrastructure that will give a ton of time back to your data team. 
Get started with Airbyte for free
high five icon
Talk to a data infrastructure expert
Get a free consultation with an Airbyte expert to significantly improve your data movement infrastructure. 
Talk to sales
stars sparkling
Improve your data infrastructure knowledge
Subscribe to our monthly newsletter and get the community’s new enlightening content along with Airbyte’s progress in their mission to solve data integration once and for all.
Subscribe to newsletter

Frequently Asked Questions

What data can you extract from AWS CloudTrail?

AWS CloudTrail provides access to a wide range of data related to AWS account activity and resource usage. The following are the categories of data that can be accessed through the API:  

1. Event history: This includes information about all the events that have occurred in an AWS account, such as API calls, console sign-ins, and resource changes.  
2. Resource activity: This category includes data related to the usage of AWS resources, such as EC2 instances, S3 buckets, and RDS databases.  
3. User activity: This category includes data related to user activity in an AWS account, such as user sign-ins, password changes, and access key usage.  
4. Security analysis: This category includes data related to security events in an AWS account, such as failed login attempts, unauthorized access attempts, and changes to security groups.  
5. Compliance auditing: This category includes data related to compliance auditing in an AWS account, such as changes to IAM policies, CloudTrail configuration changes, and VPC network changes.  

Overall, the AWS CloudTrail API provides a comprehensive view of AWS account activity and resource usage, making it a valuable tool for monitoring and managing AWS environments.

What data can you transfer to Starburst Galaxy?

You can transfer a wide variety of data to Starburst Galaxy. This usually includes structured, semi-structured, and unstructured data like transaction records, log files, JSON data, CSV files, and more, allowing robust, scalable data integration and analysis.

What are top ETL tools to transfer data from AWS CloudTrail to Starburst Galaxy?

The most prominent ETL tools to transfer data from AWS CloudTrail to Starburst Galaxy include:

  • Airbyte
  • Fivetran
  • Stitch
  • Matillion
  • Talend Data Integration

These tools help in extracting data from AWS CloudTrail and various sources (APIs, databases, and more), transforming it efficiently, and loading it into Starburst Galaxy and other databases, data warehouses and data lakes, enhancing data management capabilities.