Daily Defender News
Aboutmerill.net
Microsoft Sentinel
Cloud and workloads

Connect Microsoft Sentinel to Amazon Web Services to Ingest AWS Service Log Data

4 September 2026Doc update+28 / −28 lines

In brief

The page now clarifies S3 and legacy CloudTrail connector instructions, AWS resource descriptions, Azure Government role assignment, credential locations, prerequisites, and troubleshooting links. The title and page metadata were also refreshed.

What Defender admins need to know

Administrators have clearer guidance when configuring or troubleshooting the AWS connectors; no configuration change is required.

Summaries are generated from the documentation change itself.

Documentation change

View full page diffView on Microsoft Learn

The comparison below shows only the changed extract. Use the full-page view for complete context.

title: Connect Microsoft Sentinel to Amazon Web Services to ingestIngest AWS service log dataService Log Data description: Use the AWS connector to delegate Microsoft Sentinel access to AWS resource logs, creating a trust relationship between Amazon Web Services and Microsoft Sentinel. ms.author: edbaynash author: EdB-MSFT ms.reviewer: krishsa ms.topic: how-to ms.date: 06/09/202507/01/2026 ai-usage: ai-assisted ms.custom: msecd-doc-authoring-1016

#Customer intent: As a security engineer, I want to connect AWS service logs to Microsoft Sentinel so that analysts can centralize log management and enhance threat detection capabilities.

S3 connector (new)

ThisThe S3 connector tab explains how to configure the AWS S3 connector using one of two methods:

Prerequisites

  • Installation instructions for the AWS CLI (from AWS documentation)

  • Make sure that the logs from your selected AWS service use the format accepted by Microsoft Sentinel:

    • Amazon VPC: .csv file in GZIP format with headers; delimiter: space.
    • Amazon GuardDuty: json-line and GZIP formats.
    • AWS CloudTrail: .json file in a GZIP format.
    • CloudWatch: .csv file in a GZIP format without a header. If you need to convert your logs to this format, you can use this CloudWatch lambda function.

Automatic setup

To simplify the onboarding process, Microsoft Sentinel has provided a PowerShell script to automate the setup of the AWS side of the connector -connector; the required AWS resources, credentials, and permissions.

The script:

  • Enables specified AWS services to send logs to that S3 bucket, and notification messages to that SQS queue.

  • If necessary, creates thatthe S3 bucket for log storage and thatthe SQS queue for this purpose.notifications.

  • Configures any necessary IAM permissions policies and applies them to the IAM role created above.

For Azure Government clouds, a specialized script creates a different OIDC web identity provider, to which itprovider and assigns the IAM assumed role.role to that provider.

Instructions

:::image type="content" source="media/connect-aws/aws-run-script.png" alt-text="Screenshot of command to run setup script and workspace ID." lightbox="media/connect-aws/aws-run-script.png":::

  1. When the script finishes running, copy the Role ARN and the SQS URL from the script's output (see example in first screenshot below) and paste them in their respective fields in the connector page under 2. Add connection (see second screenshot below).

    :::image type="content" source="media/connect-aws/aws-script-output.png" alt-text="Screenshot of output of A W S connector setup script." lightbox="media/connect-aws/aws-script-output.png":::

  2. Set up your AWS environment as described in Set up your Amazon Web Services environment to collect AWS logs to Microsoft Sentinel.

  3. In the AWS console:

    1. Enter the Identity and Access Management (IAM) service and navigate to the list of Roles. Select the role you created above.

  4. In the details pane for the connector, select Open connector page.

  5. Under 2. Add connection:

    1. Paste the IAM role ARN you copied two steps agofrom the AWS IAM console into the Role to add field.
    2. Paste the URL of the SQS queue URL you copied infrom the last stepAWS Simple Queue Service console into the SQS URL field.
    3. Select a data type from the Destination table drop-down list. This tells the connector which AWS service's logs this connection is being established to collect, and into which Log Analytics table it stores the ingested data.
    4. Select Add connection.

Troubleshooting

Learn how toFor troubleshooting steps, see Troubleshoot Amazon Web Services S3 connector issues.

CloudTrail connector (legacy)

ThisThe CloudTrail connector (legacy) tab explains how to configure the AWS CloudTrail connector. The process of setting it up has two parts: the AWS side and the Microsoft Sentinel side. Each side's process produces information used by the other side. This two-way authentication creates secure communication.

Connect AWS CloudTrail

Setting up this connector has two steps:

Create an AWS assumed role and grant access to the AWS Sentinel account

  1. In Microsoft Sentinel, select Data connectors from the navigation menu.

  2. Select Amazon Web Services from the data connectors gallery.

    If you don't see the connector, installverify that you installed the Amazon Web Services solution fromas described in the Content Hub in Microsoft Sentinel. For more information, see Discover and manage Microsoft Sentinel out-of-the-box contentPrerequisites.

  3. In the details pane for the connector, select Open connector page.

  4. Under Configuration, copy the Microsoft account ID and the External ID (Workspace ID) to your clipboard.

  5. In a different browser window or tab, open the AWS console. Follow the instructions in the AWS documentation for creating a role for an AWS account.

    • For the account type, instead of This account, choose Another AWS account.

Send formatted CloudWatch events to S3 using a lambda function (optional)

If your CloudWatch logs aren't in the format accepted by Microsoft Sentinel - .csv file in a GZIP format without a header - use a lambda function view the source code within AWS to send CloudWatch events to an S3 bucket in the accepted format..csv GZIP format without a header.

The lambda function uses Python 3.12 runtime and x86_64 architecture.

  1. Select Test to see how the event appears in the S3 bucket.

Next stepsRelated content

In this document, you learned how to connect to AWS resources to ingest their logs into Microsoft Sentinel. To learn more about Microsoft Sentinel, see the following articles: