> AI agents: this is one page from PostHog's docs. Full index of Markdown docs for LLMs: https://posthog.com/llms.txt

# Linking AWS CloudTrail as a source

Canonical URL: https://posthog.com/docs/data-pipelines/sources/aws-cloudtrail

> **Cloud region:** This page uses US Cloud hosts. For an EU Cloud project, use `https://eu.posthog.com` instead of `https://us.posthog.com` or `https://app.posthog.com` (app host for links).

## On this page

- [Prerequisites](#prerequisites)
- [Adding a data source](#adding-a-data-source)
- [Creating IAM credentials](#creating-iam-credentials)
- [Sync modes](#sync-modes)
- [Configuration](#configuration)
- [Supported tables](#supported-tables)
- [Troubleshooting](#troubleshooting)

**Beta release**

This source is currently in **beta**. It works end to end, but you may still hit rough edges. [Let us know](https://us.posthog.com/#panel=support%3Asupport%3Adata_warehouse%3A%3Atrue) if you do.

![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_9608fcca70)

![](https://res.cloudinary.com/dmukukwp6/image/upload/texture_tan_dark_a92b0e022d)

Let AI connect your sources for you

Skip the manual setup — run this in your project and the wizard auto-detects your databases and APIs and connects them to PostHog.

`npx @posthog/wizard warehouse`

![PostHog Wizard hedgehog](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png)

![](https://res.cloudinary.com/dmukukwp6/image/upload/wizard_3f8bb7a240.png)Let AI connect your sources for you

The AWS CloudTrail connector syncs CloudTrail events, trail settings, Insights data, and Lake query history into the PostHog data warehouse, so you can analyze AWS audit logs alongside your product data.

## Prerequisites

Credentials that can read the data you want to sync. PostHog only reads data, so read access is enough.

The IAM permissions you need depend on which tables you select:

| Table | Required permissions |
| --- | --- |
| `events` | `cloudtrail:LookupEvents` |
| `insight_events` | `cloudtrail:LookupEvents` |
| `trails` | `cloudtrail:DescribeTrails` |
| `event_data_stores` | `cloudtrail:ListEventDataStores` |
| `insights_data` | `cloudtrail:DescribeTrails`, `cloudtrail:ListInsightsData` |
| `insights_metric_data` | `cloudtrail:LookupEvents`, `cloudtrail:DescribeTrails`, `cloudtrail:ListInsightsData` |
| `lake_queries` | `cloudtrail:ListEventDataStores`, `cloudtrail:ListQueries`, `cloudtrail:DescribeQuery` |

## Adding a data source

1.  In PostHog, go to the [Sources tab](https://app.posthog.com/data-management/sources) of the data pipeline section.
2.  Click **\+ New source** and click **Link** next to this source.
3.  Enter your credentials (see [Configuration](#configuration) below) and click **Next**.
4.  Select the tables you want to sync, choose a sync method and frequency, then click **Import**.

Once the syncs are complete, you can start querying this data in PostHog.

When linking AWS CloudTrail, you'll need:

-   **AWS access key ID** – the access key ID for your IAM user or role (starts with `AKIA...`).
-   **AWS secret access key** – the corresponding secret access key.
-   **AWS session token** (optional) – only required if you are using temporary STS credentials. Temporary credentials expire, so update them before scheduled syncs run.
-   **AWS region** – the AWS region to sync data from (e.g., `us-east-1`).

## Creating IAM credentials

1.  In the AWS Console, go to **IAM** > **Users** and create a new user (or use an existing one).
2.  Attach a policy with the permissions for the tables you want. To enable all tables, use:

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "cloudtrail:LookupEvents",
        "cloudtrail:DescribeTrails",
        "cloudtrail:ListEventDataStores",
        "cloudtrail:ListInsightsData",
        "cloudtrail:ListQueries",
        "cloudtrail:DescribeQuery"
      ],
      "Resource": "*"
    }
  ]
}
```

3.  Create an access key for the user under **Security credentials** > **Access keys**.
4.  Copy the **Access key ID** and **Secret access key** – you'll need both when linking the source in PostHog.

## Sync modes

Each table can be synced in one of several modes, depending on what the source supports:

-   **Webhook** (when available) – the source pushes changes to PostHog in real time. Fastest freshness, lowest ongoing cost, and the only mode that reliably captures updates and deletes.
-   **Incremental** – only new or updated rows are synced on each run, using a cursor field (such as an `updated_at` timestamp). Cheaper than a full refresh, but deletes aren't captured.
-   **Append only** – new rows are appended using a cursor field; existing rows are never updated. Ideal for immutable, append-only tables like event logs.
-   **Full refresh** – the whole table is reloaded on every sync. Use it when a table has no reliable cursor or when you need deletions reflected.

See [sync methods](https://posthog.com/docs/data-pipelines/sources.md#sync-methods) for a full explanation of how each mode works and how to choose between them.

| Table | Sync mode | Notes |
| --- | --- | --- |
| `events` | Incremental | Past 90 days of management events. Data events are excluded. |
| `insight_events` | Incremental | Past 90 days of Insights events from trails with Insights enabled. |
| `trails` | Full refresh | Trail settings including shadow trails. |
| `event_data_stores` | Full refresh | CloudTrail Lake event store settings. Stored events are excluded. |
| `insights_data` | Incremental | Past 90 days of Insights events from trails with data event Insights enabled. |
| `insights_metric_data` | Full refresh | Hourly API call and error rates for each activity that triggered an Insights event over the past 90 days. |
| `lake_queries` | Incremental | Past 7 days of Lake query history with a 1-day lookback. Does not include query results. |

Duplicate rows are merged by primary key, so re-read periods don't create duplicates.

## Configuration

| Option | Description |
| --- | --- |
| `AWS access key ID` **Type:** text **Required:** True |  |
| `AWS secret access key` **Type:** password **Required:** True |  |
| `AWS session token` **Type:** password **Required:** False | Temporary credentials expire. Update them before scheduled imports run. |
| `AWS region` **Type:** text **Required:** True |  |

## Supported tables

| Table | Description | Sync method | Incremental field | Primary key |
| --- | --- | --- | --- | --- |
| `events` | Management events from the past 90 days in the selected AWS region. Data events are excluded. | Incremental, Full refresh | event\_time | — |
| `insight_events` | Insights events from the past 90 days for trails with Insights enabled in the selected region. | Incremental, Full refresh | event\_time | — |
| `trails` | Trail settings in the selected region, including shadow trails. | Full refresh | — | — |
| `event_data_stores` | CloudTrail Lake event store settings in the selected region. Stored events are excluded. | Full refresh | — | — |
| `insights_data` | Insights events from the past 90 days for trails with Insights enabled on data events. | Incremental, Full refresh | event\_time | — |
| `insights_metric_data` | Hourly API call and error rates from the past 90 days for each activity that triggered an Insights event. | Full refresh | — | — |
| `lake_queries` | CloudTrail Lake queries from the past 7 days, with their status, run time, and data scanned. | Incremental, Full refresh | creation\_time | — |

## Troubleshooting

-   If the connection fails with an authorization error, the AWS access key ID is wrong, expired, or has been revoked. Create a new one, then reconnect the source.
-   If you see a signature error, re-enter the secret access key. If you are using temporary credentials, the session token may have expired.
-   If a table syncs no rows, the credential may not have access to that data or the feature may not be enabled. Check that Insights is enabled on your trails for the Insights tables, and that CloudTrail Lake is set up for the Lake tables.
-   If a trail or event store is skipped during sync, PostHog logs it and continues with the remaining trails or stores. Common reasons include organization trails viewed from a member account or inactive event stores.
-   CloudTrail Lake is only available to existing customers after May 31, 2026.

If your sync is failing or data looks wrong, see the [Data warehouse troubleshooting guide](https://posthog.com/docs/data-warehouse/troubleshooting.md). If that doesn't help, [contact support](https://us.posthog.com/#panel=support%3Asupport%3Adata_warehouse%3A%3Atrue) – we're happy to help.