Documentation

Amazon Web Services | Insights

Depending on your preference for CloudTrail log collection, you can configure your Amazon Web Services (AWS) connector in multiple ways.

Prerequisites

Amazon Web Services access

  • You must have the ability to create IAM roles and policies in your AWS Management Account.
  • You must have familiarity with AWS CloudFormation and CloudTrail services.
  • A credit card associated with your AWS account (required by the CloudFormation template).

Identity Security Insights access

  • Administrator access to Identity Security Insights.

Configuration paths

Before you begin, determine your CloudTrail log collection preference. You will select this preference in Step 3 and it affects how you complete Steps 4 and 5.

CloudTrail preferenceWhen to use
Option A Create a new organization CloudTrailYou do not have an existing organization CloudTrail
Option B Use an existing organization CloudTrailYou already have an organization CloudTrail in the current region
Option C Use existing CloudTrails in multiple accountsCloudTrail is configured at the account level across multiple accounts
Option D No CloudTrail collectionYou do not want to enable CloudTrail log collection

Step 1: Create the AWS connector in Insights

  1. From Insights Home, select Pathfinder navigation menu > Connectors.
    The Connectors page displays.
  2. Click Total configured.
  3. Select Create Connector > AWS.
  4. Enter a human-readable name for your connector.

Step 2: Obtain your Root Organization ID from AWS

  1. Follow the AWS documentation to view the AWS organization root details.
  2. In the Root details section, copy the Root Organizational Unit ID (for example, r-ad12).

Step 3: Create the CloudFormation stack

  1. In Insights, select the region to create the CloudFormation stack.
  2. Select whether to enable AI agents collection.
  3. Click the CloudFormation Template link.
ℹ️

The template creates an IAM role and policy for Insights to use when accessing your AWS resources. To use the template provided by the AWS connector, a credit card must be associated with your AWS account.

The AWS CloudFormation Create Stack wizard opens with pre-populated parameters.

  1. In the Parameters section, verify the following parameters:

    • RootOrgUnitId: Paste the Root Organizational Unit ID copied from the Root details section in AWS.
    • BtConnectorExternalID: Ensure this matches the External ID provided by Identity Security Insights (for example, abcdef-1234567890/ABCDEF).
    • CreateAccessAnalyzer: Determine whether to create access analyzer in the management account.
    • EnableAIAgents: Determine whether to allow collecting AI Agent data, including AI data events in.
    • EnableCloudTrail: Select the option that matches your CloudTrail preference from the Configuration paths section.
      • Option A: Yes, create CloudTrail
      • Option B: Yes, use existing CloudTrail
      • Option C: Yes, use existing CloudTrails in multiple accounts
      • Option D: No
    • MemberAccountsWithCloudTrail: The list of member accounts having CloudTrail to integrate with.
      • Fill this parameter only if you select Yes, use existing CloudTrails in multiple accounts for EnableCloudTrail.

  2. In the Capabilities section, check the required boxes to acknowledge that AWS CloudFormation may create IAM resources.

  3. Click Create stack.
    Creating a stack may take several minutes.

  4. Select the CloudTrail log collection preference that correlates to your EnableCloudTrail selection in the stack parameters.

Step 4: Obtain the required values for the connector

  1. After the stack is created, in the AWS CloudFormation template, click the Outputs tab.
  2. Copy the BtOrgRoleArn value.
  3. In Insights, paste the BtOrgRoleArn value in the IAM Role ARN field (if CloudTrail log collection is enabled).
  4. Copy the CloudTrailBucketArn value.
  5. In Insights, paste the CloudTrailBucketArn value in the CloudTrail Ingest ARN field.

Step 5: Update existing CloudTrail configuration

If Use an existing trail for an AWS Organization is selected for CloudTrail log collection preference, you can update the trail configuration using either the AWS Management Console or AWS CloudShell.

Option A: Update using the console

1. Sign in to the AWS Management Console.
2. Go to CloudTrail > Trails > existing trail.
3. In CloudWatch Logs, click Edit.
4. Select Enabled for CloudWatch Logs.
5. Select Existing for Log group.
6. For the Log group name, enter BT-CloudTrailLogGroup.
7. Select Existing for IAM Role.
8. For the Role name, select BT-CloudWatch-Role.

AI agent data events (if applicable)

Complete this section only if AI agents collection is enabled.

⚠️

If there are existing basic event selectors, the following steps will remove the existing event selectors.

  1. In Data events, click Edit.

  2. In Events, click the checkbox for Data Events if not enabled.

  3. In Data events, click Switch to advanced event selectors if Basic event selectors are enabled.

  4. Add the following data event types:

    Resource Type
    AWS::Bedrock::AgentAlias
    AWS::Bedrock::AsyncInvoke
    AWS::Bedrock::FlowAlias
    AWS::Bedrock::Guardrail
    AWS::Bedrock::InlineAgent
    AWS::Bedrock::KnowledgeBase
    AWS::Bedrock::Model
    AWS::Bedrock::PromptVersion
    AWS::Bedrock::Session
    AWS::Bedrock::FlowExecution
    AWS::Bedrock::AutomatedReasoningPolicy
    AWS::Bedrock::AutomatedReasoningPolicyVersion
    AWS::Bedrock::DataAutomationProject
    AWS::Bedrock::DataAutomationInvocation
    AWS::Bedrock::DataAutomationProfile
    AWS::Bedrock::Blueprint
    AWS::BedrockAgentCore::CodeInterpreter
    AWS::BedrockAgentCore::Browser
    AWS::BedrockAgentCore::WorkloadIdentity
    AWS::BedrockAgentCore::WorkloadIdentityDirectory
    AWS::BedrockAgentCore::TokenVault
    AWS::BedrockAgentCore::APIKeyCredentialProvider
    AWS::BedrockAgentCore::Runtime
    AWS::BedrockAgentCore::RuntimeEndpoint
    AWS::BedrockAgentCore::Gateway
    AWS::BedrockAgentCore::Memory
    AWS::BedrockAgentCore::OAuth2CredentialProvider
    AWS::BedrockAgentCore::BrowserCustom
    AWS::BedrockAgentCore::CodeInterpreterCustom
    AWS::Bedrock::Tool

  5. Click Save changes.

Option B: Update using AWS CloudShell

> ⚠️

If the trail does not use Advanced event selectors, the script skips updating AI agent event selectors to avoid unintentionally modifying existing CloudTrail configurations. Configure data events manually as instructed in Option A.

  1. Enter the trail name.
  2. Download the script.
  3. Upload the script to AWS CloudShell.
  4. Enter chmod +x bt_updatecloudtrail.sh to allow script execution.
  5. Enter the provided commands to run the script.
  6. Enter rm bt_updatecloudtrail.sh to remove the script after execution.

Final step: Create the connector

  1. Review all information on the Identity Security Insights Create AWS Connector panel.
  2. Click Create Connector.

Navigate to Pathfinder navigation menu > Connectors > Total Configured to confirm the connector was successfully created and review connector settings.

Updated 2 days ago

©2003-2026 BeyondTrust Corporation. All Rights Reserved. Other trademarks identified on this page are owned by their respective owners. BeyondTrust is not a chartered bank or trust company, or depository institution. It is not authorized to accept deposits or trust accounts and is not licensed or regulated by any state or federal banking authority.