Skip to main content
Reach out to Omni support to have audit logs enabled for your instance.
Audit logs are detailed records of the activity your users are taking in Omni, which can be useful for security and performance analysis. Events included in logs are structured as JSON payloads and sent in batches to an Omni-owned cloud storage bucket a few minutes after they’re written. You can get your logs in one of two ways:

​
Option 1: Read from the Omni-hosted bucket

Omni gives you read-only access to the bucket, either through an IAM role or user in your AWS account (recommended) or through access keys.

​
Requirements

To follow the steps in this guide, you’ll need:
  • For the IAM role or user option, permissions in AWS that allow you to manage IAM roles and users

​
Setup with an IAM role or user

You send Omni the ARN of a role or user, and Omni updates the bucket policy to allow it. All credentials stay on your side.
1

Create the role or user

In your AWS account, create the role or user that will read the logs, and copy its ARN. The ARN looks like arn:aws:iam::123456789012:role/ROLE_NAME.
2

Provide Omni support with the ARN

Reach out to Omni support with the ARN.
3

Allow the role or user to read the bucket

When setup is done, Omni support sends you the bucket name and AWS region. Attach a policy like the following to your role or user. Replace BUCKET_NAME with the bucket name:

​
Setup with access keys

Omni sends you AWS access keys with permission to read from the bucket. You don’t need an AWS account for this option.
1

Request access keys from Omni support

Reach out to Omni support and tell them who should receive the keys and how to reach them, such as by Slack or email.
2

Receive your access details

Omni sends you the bucket name, the AWS region, and the access keys. For security, Omni shares the keys as a one-time-use link.

​
Option 2: Replicate to your own S3 bucket

Omni can replicate your audit logs from the Omni-owned bucket to a bucket in your AWS account. Use this option if you want to control access, encryption, or retention, or trigger alerts when new logs arrive. Omni’s bucket can’t send notifications, but your own bucket can.

​
Requirements

To follow the steps in this guide, you’ll need:
  • Permissions in AWS to create an S3 bucket and edit its bucket policy
  • A bucket with versioning enabled. Setup fails if versioning is off.
  • Optionally, a KMS key, if you want to encrypt the bucket with your own key (SSE-KMS)

​
Setup

1

Create the bucket

In your AWS account, create an S3 bucket and turn on versioning.
2

Provide Omni support with the bucket details

After the bucket exists with versioning on, reach out to Omni support with:
  • The bucket name
  • The bucket’s AWS region
  • The KMS key ARN, if you want to use SSE-KMS
3

Add the bucket policy

Omni sets up replication on its side and sends you a bucket policy. Add it to your bucket.
4

Allow the role to use your KMS key

If you use SSE-KMS, add kms:Encrypt and kms:GenerateDataKey for Omni’s replication role to the key policy.
Replication copies only files that Omni writes after replication is set up. To get earlier logs, ask Omni support to copy the files that are already in Omni’s bucket, or to reprocess older activity from a start date. Refer to Historical logs.

​
Next steps