Wazuh has a native aws-s3 wodle that pulls logs from S3 buckets or SQS queues. It supports CloudTrail, GuardDuty, VPC Flow, WAF, Macie, Inspector and ALB access logs out of the box.
1. Create an IAM user
Create a programmatic IAM user with read access to the target S3 bucket (s3:GetObject, s3:ListBucket).
2. Store credentials on the manager
mkdir -p /root/.aws
cat > /root/.aws/credentials <<EOF
[wazuh]
aws_access_key_id = AKIA...
aws_secret_access_key = ...
EOF
chmod 600 /root/.aws/credentials3. Configure the wodle in ossec.conf
<wodle name="aws-s3">
<disabled>no</disabled>
<interval>10m</interval>
<run_on_start>yes</run_on_start>
<bucket type="cloudtrail">
<name>my-cloudtrail-bucket</name>
<aws_profile>wazuh</aws_profile>
</bucket>
</wodle>4. Restart the manager
systemctl restart wazuh-managerNote: For high-volume accounts use the SQS-based mode (notify S3 -> SNS -> SQS) instead of polling. Wazuh will only download new objects.
We build Wazuh-based CSPM and cloud detection for AWS, Azure and GCP, contact us.
Official reference
Commands and configuration in this guide are based on the official Wazuh documentation. For the canonical source, see:
WazuhAWSCloudTrailCloud