Amazon S3 Integration

Amazon S3 Integration exports ALTR audit log data to an Amazon S3 bucket in your own AWS account, where it can be ingested into logging or analytical tools or used to trigger notifications in external systems. The integration exports query audit logs, system audit logs, custom audit logs, and Policy Alerts data; data is partitioned in S3 by event time.

Configuring the integration requires access to your organization’s AWS account and a Super Administrator role in ALTR.

Note

Configuring this integration means switching between the ALTR and AWS consoles. Keep both open at the same time.

At a high level, to publish audit logs to your S3 bucket:

1. Request ALTR’s AWS account ID from ALTR Support.
2. In AWS, create an S3 bucket.
3. In AWS, create an Identity and Access Management (IAM) policy that grants write access to ALTR.
4. In AWS, create an IAM role, and attach the IAM policy, that allows ALTR to assume the role.
5. In ALTR, configure Audit Log Export with ALTR’s AWS account ID, your S3 bucket name, your AWS region, and the IAM role’s Amazon Resource Name (ARN).
6. In ALTR, select which audit log categories to export to S3.

Request ALTR’s AWS Account ID

ALTR’s AWS account ID is used to create the IAM role that grants ALTR write access to your bucket.

To request ALTR’s AWS account ID, contact ALTR Support.

Create an S3 Bucket in AWS

ALTR publishes audit logs to an S3 bucket in your AWS account. Configuring the integration requires the bucket name and the AWS region it’s created in.

To create an S3 bucket:

1. Log in to AWS S3.
2. Note the AWS region the bucket is created in — you’ll need it to configure the integration in ALTR. To view or change the region, click Region in the navigation bar.
3. Click Create bucket.
4. Enter a unique Bucket name. Bucket names are globally unique across all AWS accounts and regions. Accept the default values for the remaining settings.
5. Click Create bucket.

Start the Configuration in ALTR

Before you begin, make sure you have ALTR’s AWS account ID, your S3 bucket name, and the AWS region the bucket resides in.

To begin the configuration:

1. Select Settings > Preferences in the navigation menu.
2. Click the Organization tab.
3. Under Audit Log Export, click Configure.
4. Enter ALTR’s AWS Account ID.
5. Enter the S3 Bucket Name exactly as it was created in AWS.
6. Select the AWS Region the bucket is located in. This must match the bucket’s actual AWS region. The default is us-east-1.

Set up the IAM policy and role in AWS before finishing this configuration.

Set Up an IAM Policy and Role in AWS

ALTR needs permission to write to your S3 bucket. This is granted by creating an IAM policy and attaching it to an IAM role that ALTR assumes. ALTR generates the policy and role JSON for you, with your bucket name, ALTR organization ID, and ALTR’s AWS account ID already filled in.

Create an IAM Policy

The IAM policy grants the IAM role permission to write to your bucket, scoped to that bucket only.

To create an IAM policy in AWS:

1. From the Audit Log Export settings in ALTR, confirm the S3 Bucket Name and AWS Region are entered.
2. Copy the IAM policy JSON from ALTR.
3. In AWS IAM, click Policies.
4. Click Create policy.
5. Select S3 from the Service dropdown.
6. Click the JSON tab.
7. Paste the policy JSON copied from ALTR into the policy editor.
8. Click Next.
9. Enter a Policy name — for example, acme.s3.policy. Copy this name; you’ll need it to create the IAM role.
10. Optionally, enter a Description.
11. Click Create policy. ALTR lists the new policy as available.

Create an IAM Role

The IAM role has the IAM policy attached and allows ALTR to assume it to write to your bucket.

Note

Name the role with the prefix ALTRPublishSIEMData — for example, ALTRPublishSIEMDataMyRoleName.

To create an IAM role:

1. From the Audit Log Export settings in ALTR, confirm ALTR’s AWS Account ID is entered.
2. Copy the IAM role JSON from ALTR.
3. In AWS IAM, click Roles.
4. Click Create role.
5. Select the AWS service trusted entity type.
6. Select S3 from the Service or use case dropdown.
7. Click Next.
8. Select the checkbox next to the IAM policy you created, to attach it to the role.
9. Click Next.
10. Enter a Role name starting with ALTRPublishSIEMData — for example, ALTRPublishSIEMDataMyRoleName.
11. Optionally, enter a Description.
12. Click Create role.
13. Open the role you created.
14. Click the Trusted relationships tab.
15. Click Edit trust policy.
16. Replace the JSON with the role JSON copied from ALTR, which grants ALTR’s AWS account permission to assume the role.
17. Click Update policy.
18. Copy the role’s ARN from the role summary. You’ll need it to finish the configuration in ALTR.

Finish the Configuration in ALTR

To finish configuring Audit Log Export:

1. In ALTR, return to the Audit Log Export settings.
2. Paste the ARN for IAM Role from the role you created in AWS.
3. Select the audit log categories to export to your S3 bucket.
4. Optionally, click Test Access to confirm the integration is configured correctly. If the test fails, review the integration’s configuration; if the error persists, contact ALTR Support.
5. Click Save. ALTR tests access and, if successful, the integration is active.

Update the Configuration

Once configured, you can change which audit log categories are exported to your S3 bucket.

Caution

Changing the IAM role ARN, AWS region, or S3 bucket name requires a Change Request to ALTR Support — these can’t be updated directly in ALTR.

To update the configuration:

1. Select Settings > Preferences in the navigation menu.
2. Click the Organization tab.
3. Under Audit Log Export, click Edit.
4. Update the selected audit log categories.
5. Click Save.

Exported Data Formats

Each exported category has its own JSON schema. Field names below match the exported JSON exactly; the categories themselves are named as they appear in the ALTR export configuration.

Query Audit Logs

Show Query Audit Logs Export (JSON)

{
    "eventID": "QUERY-AUDIT-1C42465E-4BF2-4E83-90D6-F6FBCAC03634",
    "clientID": "1c42465e-4bf2-4e83-90d6-f6fbcac03634",
    "eventDetails": {
        "actor": {
            "queryTag": {},
            "roles": [
                "SAMPLE_ROLE"
            ],
            "ipAddress": "192.168.1.1",
            "client": "Go 1.1.5",
            "currentRole": "SAMPLE_ROLE",
            "username": "SAMPLE_USER"
        },
        "result": {
            "tagPolicy": {
                "queryTimeDecision": [
                    {
                        "tagValue": "Red",
                        "policyInfo": [],
                        "tagName": "EXAMPLETAG",
                        "appliedPolicy": {
                            "reason": "Allowed - no accessed tags are in any policies.",
                            "decisionType": "ALLOW",
                            "type": "user_status"
                        }
                    }
                ],
                "auditTimeDecision": [
                    {
                        "tagValue": "Red",
                        "policyInfo": [
                            {
                                "maskingType": "Full Mask",
                                "name": "EXAMPLE_POLICY_NAME",
                                "id": 1234,
                                "type": "lock"
                            }
                        ],
                        "tagName": "EXAMPLETAG",
                        "appliedPolicy": {
                            "reason": "Most permissive policy.",
                            "maskingType": "Full Mask",
                            "name": "EXAMPLE_POLICY_NAME",
                            "decisionType": "MOST_PERMISSIVE",
                            "id": 1234,
                            "type": "lock"
                        }
                    }
                ]
            },
            "columnPolicy": [],
            "rowCount": 1234
        },
        "query": {
            "warehouseSize": "X-Small",
            "completedTime": "2020-01-01 00:00:00.000000000Z",
            "completedTimeEpoch": 946702800000,
            "startTime": "2020-01-01 00:00:00.000000000Z",
            "startTimeEpoch": 946702800000,
            "id": "01b123a2-0603-e937-006a-b60300c5f902",
            "text": "SELECT FIRST_NAME FROM CUSTOMER_DATA WHERE ID = 'literal_string' LIMIT literal_number;",
            "sessionID": "30036471543391118",
            "warehouse": "ALTR_PRODUCT_WH",
            "type": "SELECT"
        },
        "account": {
            "identifier": "FYA81038",
            "region": "AWS_US_WEST_2"
        }
    },
    "eventVersion": "1.0.0",
    "eventTime": 946702800000,
    "eventSource": "SnowflakeCI",
    "eventName": "SnowflakeCI:QueryAudit",
    "userIdentity": {
        "type": "SnowflakeALTRAPI",
        "databaseID": "1234"
    }
}

System Audit Logs

See System Audit Log for what each category and field in this export means.

Show System Audit Logs Export (JSON)

{
    "eventTime": 946702800000,
    "eventVersion": "1.0.0",
    "eventSource": "Master API",
    "eventID": "1c42465e-4bf2-4e83-90d6-f6fbcac03634",
    "eventName": "Create Lock",
    "error": {},
    "clientID": "1c42465e-4bf2-4e83-90d6-f6fbcac03634",
    "responseCode": 201,
    "category": "Locks",
    "userIdentity": {
        "principalid": 123,
        "role": "SUPERADMINISTRATOR",
        "type": "JWT"
    },
    "lockAudit": {
        "id": 1234,
        "groupIds": [
            12345
        ],
        "applicationIds": [
            123
        ],
        "tags": [
            {
                "tagId": "dis-tags-1c42465e-4bf2-4e83-90d6-f6fbcac03634",
                "maskingPolicy": 10001
            }
        ]
    },
    "columnAudit": {},
    "administratorAudit": {},
    "thresholdAudit": {},
    "anomalyAudit": {},
    "applicationAudit": {},
    "databaseAudit": {},
    "usergroupAudit": {},
    "apikeysAudit": {}
}

Custom Audit Logs

See Custom Audit Logs for what this data contains and how it’s submitted.

Show Custom Audit Logs Export (JSON)

{
    "eventID": "custom-audit-1c42465e-4bf2-4e83-90d6-f6fbcac03634",
    "eventTime": 946702800000,
    "eventTimeSupplied": 946702800000,
    "eventVersion": "1.0.0",
    "eventSource": "SnowflakeCI",
    "eventName": "SnowflakeCI:CustomAudit",
    "eventType": "LOGIN",
    "clientID": "1c42465e-4bf2-4e83-90d6-f6fbcac03634",
    "userIdentity": {
        "type": "SnowflakeALTRAPI",
        "databaseID": "123"
    },
    "eventDetails": "{\"first_authentication_factor\":\"PASSWORD\",\"user_name\":\"EXAMPLE_USER\",\"client_ip\":\"192.168.1.1\"}"
}

Policy Alerts

The exported category and JSON schema are still labeled Alerts — this exports Policy Alerts data, ALTR’s legacy access-rate and time-window alerting; it doesn’t include DAM Alerting data.

Show Policy Alerts Export (JSON)

{
    "id": 1274,
    "dt": "2025-03-11T20:31:39.000Z",
    "clientId": "ae5860dc-08e6-446b-8226-848fd54e0195",
    "user": {
        "id": 346,
        "trackingId": "NOAH",
        "accessStatus": "active"
    },
    "groups": [
        {
            "id": 740668,
            "name": "FINANCE",
            "description": "",
            "groupTag": "FINANCE"
        },
        {
            "id": 740669,
            "name": "FINANCE_MANAGER",
            "description": "",
            "groupTag": "FINANCE_MANAGER"
        }
    ],
    "application": {
        "id": 0,
        "name": "",
        "description": "",
        "serverStatus": "",
        "accessStatus": "",
        "creationDate": ""
    },
    "fields": [
        {
            "columnName": "FIRST_NAME",
            "databaseName": "NOAH_DEMO_DB_0",
            "tableName": "PUBLIC.CUSTOMERS"
        },
        {
            "columnName": "SSN",
            "databaseName": "NOAH_DEMO_DB_0",
            "tableName": "PUBLIC.CUSTOMERS"
        },
        {
            "columnName": "ID",
            "databaseName": "NOAH_DEMO_DB_0",
            "tableName": "PUBLIC.CUSTOMERS"
        }
    ],
    "machineId": 0,
    "locks": [
        {
            "id": 2793,
            "name": "Finance Lock"
        }
    ],
    "rule": {},
    "threshold": {
        "id": 244,
        "name": "Finance Block Threshold",
        "accessRate": 1000,
        "accessRateUnit": "minute",
        "actionTaken": "Block"
    },
    "clientName": "Noah Live Demo Org",
    "schema_version": "v1.1.0"
}