Exporting Audit Logs
In addition to viewing audit logs in the OX platform, you can export audit logs to an external Amazon S3 bucket. Audit logs are written to the S3 bucket using a structured folder hierarchy that is created automatically by OX.
Audit log export is typically used when you need to perform the following:
Centralized logging: Consume audit logs using existing log processing pipelines.
Compliance and retention: Store audit logs in customer-managed, long-term storage.
Automation: Enable automated analysis outside the OX platform.
How audit log export works
Audit logs are exported as JSON files to a customer-managed S3 bucket.
Each export includes all audit log events generated since the previous export.
If no user or system activity occurred during the export window, the exported file still contains a system-generated event indicating that the export ran successfully.
Audit log export uses an AWS role-based connector. During the setup, OX generates a unique external ID and uses an AWS IAM role, which is created in AWS with permission to write to the specified S3 bucket. The role ARN and external ID are used together to securely authenticate export operations.
Prerequisites
OX admin permissions
AWS admin account with permissions to add an IAM role
Step 1: Generating an AWS IAM role [AWS]
In OX, go to Connectors, and search for S3 Audit Log Exporter.
Select CLOUD FORMATION ASSUME ROLE.
You are redirected to the Quick create stack page.
In the Quick create stack page, set the following parameters:
Stack name
Provide a unique stack name.
S3 Bucket Name
The Amazon S3 bucket where audit logs are exported: Amazon S3 > Buckets > your S3 bucket name.
S3 bucket prefix
Optional, folder inside the bucket where audit logs are stored. This allows working with separate folders, and is useful if you want to grant permissions to a specific folder only.
Select I acknowledge that AWS CloudFormation might create IAM resources with custom names.
Select Create stack. The new stack appears in Outputs.
Save the value RoleArn in a safe location for later use in OX.
Step 2: Connecting to S3 Audit Logs Exporter [OX]
In OX, go to Connectors > S3 Audit Log Exporter.
AWS External ID
A unique ID automatically provided by OX.
AWS Role ARN
The RoleArn value you saved in Step 1.
Select CONNECT.
Step 3: Configure Audit Log Export Settings [OX]
Go to Settings > Audit Logs.
S3 Bucket Name
The Amazon S3 bucket where audit logs are exported: Amazon S3 > Buckets > your S3 bucket name.
S3 region
The AWS region where the bucket is located. Check in the S3 bucket, in the Properties tab.
S3 bucket prefix (optional)
Defines the folder in the bucket where audit logs are written. If a prefix is specified, OX stores the exported logs under that folder; if it is left empty, logs can be written anywhere in the bucket based on the permissions granted to the role. When a prefix is provided, OX creates the folder and automatically generates the internal subfolder structure used to store the audit log files.
Export Frequency
Determines how often audit logs are written to the S3 bucket and can be set from 1 to 24 hours.
The first export runs at the beginning of the next full hour after configuration is saved, and each export includes all audit log events generated since the previous export.
If no activity occurs during the interval, the exported file still contains a system entry confirming that the export completed successfully. Default: 1 hour.
Select VERIFY CONNECTIVITY and then select SAVE.
Last updated