--- title: "Amazon S3 Activity Log Integration" slug: "amazon-s3-activity-log-events-integration" updated: 2025-07-22T17:37:11Z published: 2025-07-22T17:37:11Z canonical: "support.kandji.io/amazon-s3-activity-log-events-integration" --- > ## Documentation Index > Fetch the complete documentation index at: https://support.kandji.io/kb/llms.txt > Use this file to discover all available pages before exploring further. # Amazon S3 Activity Log Integration This integration pushes event data to your specified S3 bucket using cross-account access via a Kandji-provided IAM role, enabling centralized activity collection and analysis. ### What is the Amazon S3 Activity Log Integration? The Amazon S3 Activity Log Integration enables organizations to send tenant activity events to a self-hosted S3 bucket to share with SIEM services. This integration provides a straightforward way to collect and store Kandji activity log events without manual intervention. Once configured, it automatically captures Kandji tenant activity events and delivers them to your specified bucket, where you can access them for monitoring, compliance, or analysis purposes. Refer to our activity log [API documentation](https://api-docs.kandji.io/#06022d9d-426b-4aea-826a-d7f084e4f1e3) for a list of logged events. ### How does the Amazon S3 Activity Log Integration Work? Once configured, event data is sent to your designated S3 bucket using cross-account access through a Kandji-provided IAM role, allowing for centralized collection and analysis of activity logs. > [!NOTE] > The first log collection after the Integration is connected only includes the previous hour of activity. Subsequent activity log collection will occur hourly. ### Prerequisites Before configuring this integration, ensure the following: - You have an active AWS account. - You have permissions to create a new S3 bucket. - You have permissions to create an IAM Role with AssumeRole and S3 write permissions. ### Steps to Configure AWS Access #### Kandji Integration 1. Navigate to **Integrations** in the left-hand navigation bar. 2. Click **Discover integrations** in the upper-right of the Integrations page. 3. Under Security integrations, click **Add and configure** under Amazon S3 Activity Log Integration. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0656AM@2x.png) 4. Copy the value for **KANDJI_IAM_ROLE** and store the value in a secure location. 5. Copy the value for **KANDJI_AWS_ACCOUNT_ID** and store the value in a secure location. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0717AM@2x.png) 6. These values will be used as part of your IAM role permissions in the next section. #### Create S3 Bucket > [!NOTE] > You must create a new S3 Bucket to use the Amazon S3 Activity Log Integration. 1. Log in to AWS. 2. Navigate to Amazon S3 > Buckets. 3. Click **Create bucket**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1112AM@2x4.png) 4. Choose the **General purpose** bucket type. 5. Enter a memorable **Bucket name**. - This name will be referenced in policies. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0216PM@2x.png) 6. Under **Block Public Access settings for this bucket**, ensure that the **Block all public access** option is selected. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0905AM@2x3.png) 7. Under **Bucket Versioning**, keep the **Disable** option selected. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0906AM@2x3.png) 8. Under **Encryption type**, select **Server side encryption with Amazon S3 managed Keys (SSE-S3)**. 9. Under **Bucket Key**, select **Enabled**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0911AM@2x3.png) 10. Kandji currently only supports the default encryption options defined above. 11. Click **Create bucket**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0929AM@2x3.png) 12. Select the bucket you just created. 13. Click the **Permissions** tab. 14. Under **Bucket policy**, click **Edit**. 15. Add the following bucket policy to the role permissions. Click **Save changes**. 1. Replace all reference to **BUCKET_NAME** with the name of the bucket you just created. ```json {    "Version": "2012-10-17",    "Statement": [        {            "Sid": "AllowSSLRequestsOnly",            "Effect": "Deny",            "Principal": "*",            "Action": "s3:*",            "Resource": [              "arn:aws:s3:::BUCKET_NAME/*",              "arn:aws:s3:::BUCKET_NAME"            ],            "Condition": {                "Bool": {                    "aws:SecureTransport": "false"                }            }        }    ] } ``` ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1058AM@2x32.png) 16. In AWS, navigate to **IAM > Roles**. 17. Click **Create role**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1114AM@2x5.png) 18. Select **Custom trust policy**. 19. Add the **Custom trust policy** below to allow Kandji to assume this role when writing to your S3 bucket. - Replace the **KANDJI_AWS_ACCOUNT_ID** and **KANDJI_IAM_ROLE** text with the values you made a note of at the beginning of the article. ```json {    "Version": "2012-10-17",    "Statement": [        {            "Effect": "Allow",            "Principal": {                "AWS": "arn:aws:iam::KANDJI_AWS_ACCOUNT_ID:role/KANDJI_IAM_ROLE"            },            "Action": "sts:AssumeRole"        }    ] } ``` ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1002AM@2x3.png) 20. Click **Next**. 21. On the **Add permissions screen**, select Next without selecting any of the listed **Permissions policies**. 22. Add a **Role name** and **Description**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0222PM@2x(1).png) 23. Click **Create role**. 24. Select the **IAM Role** you just created. 25. Click on the **Permissions** tab. 26. Click **Add permissions**. 27. Click **Create inline policy**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-1011AM@2x3.png) 28. Click the **JSON** tab. 29. Enter the following for the inline policy: 1. Replace BUCKET_NAME - replace this with the name of the bucket you created that Kandji will place the activity log files in. ```json {    "Version": "2012-10-17",    "Statement": [        {            "Action": "s3:ListBucket",            "Effect": "Allow",            "Resource": "arn:aws:s3:::BUCKET_NAME"        },        {            "Action": "s3:*",            "Effect": "Allow",            "Resource": "arn:aws:s3:::BUCKET_NAME/*"        }    ] } ``` 30. Click **Next**. 31. Enter a **Policy name**. 32. Click **Create policy**. ### Steps to Set up the Amazon S3 Activity Log Integration in Kandji Once the above is configured in your AWS account, you can proceed to setting up the integration in your Kandji account. 1. Navigate to **Integrations** in the left-hand navigation bar. 2. Click **Discover integrations** in the upper-right of the Integrations page. 3. Under Security integrations, click **Add and configure** under Amazon S3 Activity Log Integration. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0656AM@2x.png) 4. Click **Next**. 5. Enter the **AWS Account ID**. 6. Enter the **S3 Bucket Name** for the bucket that was created earlier in this guide. 7. Optionally, enter a **Destination Path**. 8. Enter the **IAM Role ARN** for the IAM Role that was created earlier in this guide. 9. Enter the **AWS Region**. 10. Click **Connect to S3**. ![](https://cdn.document360.io/0844b095-d720-4a7b-bb17-ec97d9bc6e41/Images/Documentation/Kandji-Support-KB-0712AM.png) 11. Kandji will attempt to upload and delete a test file in the provided S3 bucket. If Kandji is unable to successfully integrate to your S3 bucket, you will not be able to save and will need to follow the error messages surfaced in the UI to fix the connection. 12. Verify Event Data in the S3 Bucket. - Check your S3 bucket to confirm that Kandji is pushing event data. This will take a maximum of two hours, provided that activity events have been generated. ### Considerations - Activity log events are updated hourly. - The IAM role must have the necessary permissions to allow Kandji to assume that role. - You may need to adjust the S3 Bucket policy to allow Kandji to write objects to the bucket.