# Elastic-agent AWS cloudtrail integration fails

**URL:** <https://discuss.elastic.co/t/elastic-agent-aws-cloudtrail-integration-fails/348161>\
**Category:** Elastic Agent\
**Created:** [November 28, 2023, 3:29pm UTC](https://discuss.elastic.co/t/elastic-agent-aws-cloudtrail-integration-fails/348161 "2023-11-28T15:29:58Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Merdesz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/merdesz/32/119356_2.png) [@Merdesz](https://discuss.elastic.co/u/Merdesz)\
**Post date:** [November 28, 2023, 3:29pm UTC](https://discuss.elastic.co/t/elastic-agent-aws-cloudtrail-integration-fails/348161/1 "2023-11-28T15:29:58Z")

</div>

Trying to set up Elastic-agent with the AWS cloudtrail integration, but it always fails to connect:

`[elastic_agent.filebeat][error] Input 'aws-s3' failed with: failed to initialize s3 poller: failed to get AWS region for bucket: operation error S3: GetBucketLocation, https response error StatusCode: 400, RequestID: RPJDEMPNHY0DS3VD, HostID: s/jw5VtW3D87Rh6PB2ksMuOidMorPUJ0nzq2O/Bnb6ROXl4KI5dOZ6iX7lh5NimbZcCj/ZavNog=, api error InvalidBucketName: The specified bucket is not valid.`

My integration settings:

 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/9/8904c6de1ac3bc20f854e2d6b9d601f71e27e2cf.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/6/1/6193640c57ddd9f77691d133f89964db9c066ae9.png)  
 ![image](https://us1.discourse-cdn.com/elastic/original/3X/8/a/8ac072542b6d5b253fbfa1b378bf791d9ed8af70.png)

Also using the AWS CLI from the same computer the Elastic-agent tries to reach the bucket works just fine, can list the log files.  
Anything usefull is welcomed.

---

<div class="post-metadata">

**Author:** ![sholzhauer](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/sholzhauer/32/110282_2.png) [@sholzhauer](https://discuss.elastic.co/u/sholzhauer)\
**Post date:** [November 28, 2023, 4:52pm UTC](https://discuss.elastic.co/t/elastic-agent-aws-cloudtrail-integration-fails/348161/2 "2023-11-28T16:52:47Z")

</div>

In your screenshot you mention `the correct bucket`.  
Is that the bucket name or the full `arn:aws:s3:::the correct bucket`

> a side note: I would advice to use sqs setup as this limits the AWS api calls and prevents duplicate ingestion in case your agent goes down. It also allows you to distribute the load across multiple agents.

---

<div class="post-metadata">

**Author:** ![Merdesz](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/merdesz/32/119356_2.png) [@Merdesz](https://discuss.elastic.co/u/Merdesz)\
**Post date:** [November 29, 2023, 9:35am UTC](https://discuss.elastic.co/t/elastic-agent-aws-cloudtrail-integration-fails/348161/3 "2023-11-29T09:35:43Z")

</div>

Yes, thank you that was the problem.  
Only set it up with s3://domain-name...

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 27, 2023, 9:36am UTC](https://discuss.elastic.co/t/elastic-agent-aws-cloudtrail-integration-fails/348161/4 "2023-12-27T09:36:40Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.