
AWS CloudTrail Lake now supports ingesting activity events from non-AWS sources like Google Cloud Platform, enabling centralized audit logging and SQL-based querying across hybrid environments.


<div><p>This article demonstrates how to ingest non-AWS activity events into AWS CloudTrail Lake, using Google Cloud Platform audit logs as an example.</p><ul><li>CloudTrail Lake now supports ingesting activity events from non-AWS sources for unified audit logging</li><li>Solution uses Lambda, EventBridge Scheduler, and Secrets Manager to poll GCP Pub/Sub and ingest logs</li><li>Failed ingestions are forwarded to SQS FIFO queue for error handling and retry</li><li>Requires GCP Pub/Sub topic, sink configuration, and service account key setup</li><li>Deploy using SAM CLI with CloudFormation stack parameters for customization</li><li>Query ingested events using SQL-based CloudTrail Lake queries for security analysis</li><li>Lambda function scheduled to run every 5 minutes for continuous log ingestion</li></ul><p>This solution enables organizations to consolidate audit logs from hybrid environments into a single managed data lake for compliance and security investigations.</p></div>


Related articles