Stream the audit log to an Amazon S3 bucket

Administrator·3 minutes to read

What this does for you

Every new entry in your organisation's audit log is written to your S3 bucket within a minute of being written. Each batch of up to 200 entries is one NDJSON object (one JSON entry per line) at <prefix><organisation id>/<YYYY>/<MM>/<DD>/<first entry id>-<last entry id>.ndjson, which most SIEMs can read from a bucket. A batch that is retried is written to the same key, so a retry never leaves a second copy. Only an owner or an administrator can see or change audit streams.

Before you start

Your team is on Enterprise or its two-week Enterprise trial. The audit log and its streams are part of the Enterprise plan: on a Team plan, Organisation → Audit shows The audit log, its exports and the SIEM stream are part of the Enterprise plan. with a link to See Enterprise.
A general purpose bucket whose name has no dots, and its region.
An IAM user with a long-term access key whose only permission is s3:PutObject on the bucket (arn:aws:s3:::<bucket>/*). Temporary credentials are not supported. If the bucket's default encryption is SSE-KMS, the user also needs kms:GenerateDataKey on the key.

Steps

Open Organisation → Audit and find Audit streams.
Under Destination, choose Amazon S3 bucket, and give it a Name.
Enter the Bucket, the Region (such as eu-west-1) and, optionally, a Key prefix (optional).
Enter the Access key ID and Secret access key. Both are stored encrypted and never shown again.
Press Add stream.

Use the stream's switch to turn it off or back on; Remove stops it and deletes the key.

A worked example

An administrator adds a stream to the bucket acme-audit in eu-west-1 with the prefix botseon/. After a busy morning the bucket holds objects such as botseon/<organisation id>/2026/10/21/<id>-<id>.ndjson, each with up to 200 lines, and the SIEM's S3 input reads them in.

What can go wrong

The stream's row on Organisation → Audit shows the last delivery and, when the newest attempt failed, why and when it is tried again. A failed batch is never skipped: the same entries are sent again after 15 seconds, then 30 seconds, 1 minute, 5 minutes, 15 minutes, and then every hour until the destination takes them.

What the row says	What to do
the destination refused the request (HTTP 403)	the key, its policy or a bucket policy denies `s3:PutObject`, or the key was deactivated
the destination refused the request (HTTP 400), or could not be reached	the region does not match the bucket's (S3 answers a wrong region with an error or a redirect, and redirects are not followed)
the destination could not be reached / did not answer in time	S3 is unreachable from Botseon; it is retried