On This Page

Home / Stream/ Integrations/ Integrating with Other Services/ Amazon/AWS Cloud Connections

AWS Cloud Connections ​

AWS Cloud Connections lets you connect your AWS account to Cribl Stream, automatically discover eligible data sources, and onboard those sources as inputs without Cribl modifying your environment.

This feature is available only on Cribl.Cloud deployments with an AWS-hosted Leader and at least one AWS-hosted Worker Group.

Overview ​

Onboarding cloud telemetry has traditionally required knowing exactly which AWS services you have, where logs are stored, and how to configure each one manually. AWS Cloud Connections removes that upfront investigation by doing the inventory for you and walking you through configuration in a single flow.

Once connected to your AWS account, Cribl performs a read-only scan to discover eligible data sources. You then select the resources you want to onboard, and Cribl generates the configuration needed to route data into your Worker Group. The workflow uses two CloudFormation templates; one to establish the connection and one to route data from your selected resources into Cribl.

Prerequisites ​

Confirm that your environment meets all of these requirements:

  • Cribl.Cloud: Your deployment runs on Cribl.Cloud. AWS Cloud Connections is not available in self-hosted deployments.
  • AWS-hosted Leader and Worker Group: Your Cribl Stream deployment includes an AWS-hosted Leader and at least one AWS-hosted Worker Group.
  • Admin role: You must be assigned the Cribl Stream Admin role to add or manage AWS connections.

Discovered AWS Services ​

Cribl scans for resources from the following AWS services:

Add an AWS Connection ​

In your Worker Group, select Data > Sources. The Cloud Connections tile appears at the top of the Sources page. Select the Cloud Connections AWS tile, then select Add Connection. The wizard guides you through the following steps:

Enter Details ​

Enter the details for the AWS account you want to connect.

Connected account scope: Select AWS Account to connect a standalone AWS account. Organization-scoped connections will be available at a later date.

Assumed role name: The name of the IAM role Cribl will assume in your AWS account. For example, CriblRole.

AWS account ID: Your 12-digit AWS account ID.

AWS STS External ID: An external ID for additional security when Cribl assumes the role via STS. If you leave this blank, Cribl generates one automatically.

Display Name: Optionally, set a friendly name for this connection as it appears in the Cribl UI.

Grant Permissions ​

Cribl generates a CloudFormation template that creates the required read-only IAM role in your AWS account. Before deploying, confirm the following:

  • You can view the AWS Stacks console to confirm your stack deployments.
  • This browser is logged in to your AWS account.
  • Your account has appropriate permissions to create a CloudFormation stack.

Copy or download the template using the icons to the right of the template, add and apply it to your AWS account, then select Continue.

Establish Connection ​

During this step, Cribl validates that the CloudFormation stack deployed successfully and that the IAM role is reachable. Your connected AWS account appears as a tile showing the account name and account ID. Select Continue to proceed.

This step can take up to 15 minutes for large accounts. You can safely navigate away during the scan. To return, go to the Cloud Connections AWS screen and select Account details > Add Sources on your connected account.

Onboard Data ​

After the connection is established, Cribl scans your AWS account and presents a filterable table of discovered resources. Each row shows:

  • Resource ID: The unique identifier of the discovered AWS resource.
  • Region: The AWS region where the resource is located.
  • Resource Type: The type of AWS resource, such as S3 Bucket or VPC Flow Logs.
  • Source ARN: The Amazon Resource Name of the source resource Cribl will read from.
  • Destination ARN: The Amazon Resource Name of the destination resource, such as an SQS queue, where data will be delivered before Cribl ingests it.

Use the Filter by ID, Filter by resource type, and Filter by region controls to narrow the list. You can only select resources from a single region at a time. Select the resources you want to onboard and select Continue.

Configure Integrations ​

Cribl can ingest AWS logs through S3 buckets or through Kinesis Data Firehose delivery streams. This step ensures the selected resources are configured to deliver data into Cribl.

Data Grouping: Choose how Cribl creates Sources for the selected resources:

  • Individual: Each discovered resource gets its own Cribl Source. An S3 bucket Source is created where delivery is to a bucket, and a Kinesis Data Firehose Source is created where delivery is to a stream. This option is more flexible but creates more Sources.
  • Grouped by service and delivery type: Resources that share the same AWS origin service and the same delivery type (S3 or Firehose) share one set of integration names. Cribl creates one Source configuration per group.

Integration settings: For each resource, review and optionally edit the following fields:

  • Source ID: The name Cribl will use for the Source. Pre-populated based on the discovered resource.
  • Bucket Name: The S3 bucket where logs are delivered. Pre-populated from discovery and cannot be changed if using an existing bucket.
  • SQS Queue Name: The SQS queue Cribl will poll for S3 event notifications. Pre-populated with a generated name.
  • Assume Role Name: The IAM role Cribl will assume to access the resource. Pre-populated based on the role created during the Grant Permissions step.

Deploy Template ​

Cribl generates a CloudFormation template that provisions the components needed to route data from your selected resources into Cribl. Depending on the resources you selected, this may include SQS queues, S3 event notifications, flow log configurations, and IAM permissions.

The template includes metadata with manual steps and AWS CLI commands for cases where an existing resource needs to be updated rather than created. Review any notes in the Metadata section before deploying.

Manage Connected Accounts ​

Connected accounts appear on the main Cloud Connections AWS screen. Each account listing shows the inputs configured from that account, and those inputs also appear on the standard Sources pages for their respective input types (S3 or Kinesis Data Firehose, depending on the originating AWS service).

Select Account details on an account listing to:

  • Add Sources: Re-enter the onboarding flow to discover and onboard additional resources from this account.
  • Refresh Scan: Re-scan the account to update the inventory of discovered resources.
  • Account Settings: View or modify the account’s connection configuration.
  • Disconnect Account: Remove the account and its associated connection credentials from Cribl. Any inputs that were created from this account remain in your Worker Group and continue to function after you disconnect. Any AWS resources that were created via CloudFormation Stacks remain until you manually delete the Stack in your AWS Console.

Security Considerations ​

AWS Cloud Connections is read-only. Cribl does not write to, modify, or delete any resources in your AWS environment.

The IAM role provisioned by the initial CloudFormation template grants only the permissions needed to identify resources and read their configurations. Cribl intentionally avoids AWS managed policies, which would grant broader access than necessary.

The role’s trust policy restricts assumption to a role that is local to your Cribl tenant. Your Cribl Leader stores the associated secret in encrypted form. The resource scanning service runs within your tenant and assumes the tenant-local role before assuming the role in your AWS account.

Scan results are stored securely within your Cribl tenant and are automatically deleted after a short retention period.