> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cantina.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS

> Connect your AWS account to Clarion for CloudTrail events, CloudWatch alarms, GuardDuty findings, and IAM agent tools.

Clarion connects to AWS to ingest CloudTrail events, CloudWatch alarms, and GuardDuty findings, and to run agent tools (CloudTrail lookup, Route 53, CloudWatch queries) against your account.

There are a few different ways to get your AWS telemetry into Clarion. Pick the path that matches how your AWS logging is already set up - you can combine more than one.

## Choose a setup path

**AWS via EventBridge and SNS** - The complete setup. Forward CloudTrail management events and GuardDuty findings to Clarion in real time through EventBridge and SNS, wire up CloudWatch alarms, and create the IAM role for agent tools.

**CloudTrail via existing S3 bucket** - Already logging CloudTrail to S3 (or using a tool like Red Canary)? Have Clarion read each new log file from the bucket via an S3 event notification. Ideal for organization-wide, centralized logging.

## How AWS data reaches Clarion

Every path delivers events to Clarion through an **SNS topic** that publishes to a Clarion **webhook URL** over HTTPS. They differ in how events get *into* that topic:

| Path              | How events are produced                                                                                                                         | Best for                                                                          |
| ----------------- | ----------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------- |
| EventBridge & SNS | An EventBridge rule matches CloudTrail / GuardDuty events and targets an SNS topic; CloudWatch alarms and other sources publish to SNS directly | Real-time CloudTrail management events, GuardDuty findings, and CloudWatch alarms |
| CloudTrail via S3 | S3 event notifications fire when CloudTrail writes a new log file to the bucket                                                                 | Existing or consolidated CloudTrail-to-S3 logging, org-wide trails                |

> **Note:** Clarion only accepts SNS messages from topic ARNs you have saved on the matching monitor. Whichever path you choose, copy the exact SNS topic ARN into Clarion before confirming the subscription.

> **Warning:** CloudTrail via S3 sends Clarion a pointer to a log file, not the CloudTrail event body. Clarion must be able to assume an AWS role that can read that S3 object. See CloudTrail via existing S3 bucket for the required IAM setup.

## Agent tools

Running Clarion's AWS agent tools (CloudTrail lookup, Route 53, CloudWatch queries, Athena) requires an IAM role that Clarion can assume. That role is covered in the AWS via EventBridge guide and in the CloudTrail via S3 guide - set it up once per connected account.