--- title: Securely Managing Your Audit Logs with Teleport and... description: A step-by-step tutorial explains how to centralize infrastructure audit logs by forwarding Teleport events through Fluentd, storing them in AWS S3, and... canonical: https://daily.dev/posts/securely-managing-your-audit-logs-with-teleport-and-snowflake-psflhvjzc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Securely Managing Your Audit Logs with Teleport and Snowflake | daily.dev og:description: A step-by-step tutorial explains how to centralize infrastructure audit logs by forwarding Teleport events through Fluentd, storing them in AWS S3, and... og:url: https://daily.dev/posts/securely-managing-your-audit-logs-with-teleport-and-snowflake-psflhvjzc og:image: https://api.daily.dev/og/posts/pSFlhvJzc.png og:image:alt: Securely Managing Your Audit Logs with Teleport and Snowflake og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Securely Managing Your Audit Logs with Teleport and Snowflake **[Teleport](https://daily.dev/sources/teleport)** · 12 min read · 0 upvotes · 0 comments ## Summary A step-by-step tutorial explains how to centralize infrastructure audit logs by forwarding Teleport events through Fluentd, storing them in AWS S3, and ingesting them into Snowflake via Snowpipe for secure, searchable, event-driven log management. Covers configuring the Fluentd Docker image, S3 buckets and IAM policies, Snowflake storage integrations, stages, file formats, and Snowpipe with SQS-triggered auto-ingestion, plus a sample query for finding failed events. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I forward Teleport audit logs to Snowflake? Configure Teleport's event handler plugin to send logs to Fluentd, which forwards them to an S3 bucket using the fluent-plugin-s3 gem in a custom Fluentd Docker image. Then create a Snowflake storage integration, stage, and Snowpipe pointed at the S3 bucket, and trigger ingestion automatically using an S3 event notification to an SQS queue. _daily.dev surfaces practical pipelines like this for engineers wiring up audit log ingestion._ ### How do I set up Snowpipe to auto-ingest data from an S3 bucket? Create a Snowflake storage integration referencing the IAM role ARN and allowed S3 locations, then create a stage pointing at the S3 bucket using that integration. Create a pipe with AUTO_INGEST=TRUE that copies staged files into a target table using a defined file format, then configure an S3 event notification pointing to the pipe's notification_channel_arn SQS queue. _Teams building event-driven data pipelines can find setup walkthroughs like this on daily.dev._ ### What Fluentd Docker image configuration is needed to forward logs to S3? Build a custom Fluentd image based on fluent/fluentd:v1.15-1 that installs the nokogiri and fluent-plugin-s3 gems, then copies in a custom fluent.conf and entrypoint.sh. The fluent.conf must define an output of type s3 with the target bucket, AWS credentials, and a timekey value controlling how often logs are flushed to S3. _Engineers automating log forwarding pipelines can track tooling changes like this via daily.dev._ ## Similar posts on daily.dev - [Automate PostgreSQL audit log extraction and analysis with Amazon S3](https://daily.dev/posts/automate-postgresql-audit-log-extraction-and-analysis-with-amazon-s3-gr2bxekgz) · AWS Database Blog · 1 upvotes · 0 comments - [Event-based Data Ingestion and Transformation with Snowpipe](https://daily.dev/posts/event-based-data-ingestion-and-transformation-with-snowpipe-s5pxec5nv) · Snowflake Community · 0 upvotes · 0 comments - [How to Collect Server Events Across Hundreds of Microservices](https://daily.dev/posts/how-to-collect-server-events-across-hundreds-of-microservices-orjlpldo1) · ITNEXT · 0 upvotes · 0 comments - [Yelp Publishes Blueprint for Managing S3 Server-Access Logs at Massive Scale](https://daily.dev/posts/yelp-publishes-blueprint-for-managing-s3-server-access-logs-at-massive-scale-l0en9vc0e) · InfoQ · 2 upvotes · 0 comments - [Tailscale adds log streaming for Azure Blob Storage](https://daily.dev/posts/tailscale-adds-log-streaming-for-azure-blob-storage-jthacvfth) · Tailscale · 0 upvotes · 0 comments --- Tags: [#snowflake](https://daily.dev/tags/snowflake), [#aws-s3](https://daily.dev/tags/aws-s3) [View this post on daily.dev](https://daily.dev/posts/securely-managing-your-audit-logs-with-teleport-and-snowflake-psflhvjzc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Securely Managing Your Audit Logs with Teleport and Snowflake","url":"https://daily.dev/posts/securely-managing-your-audit-logs-with-teleport-and-snowflake-psflhvjzc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/securely-managing-your-audit-logs-with-teleport-and-snowflake-psflhvjzc"},"datePublished":"2026-08-23T12:19:20.080Z","dateModified":"2026-08-23T12:37:11.239Z","description":"A step-by-step tutorial explains how to centralize infrastructure audit logs by forwarding Teleport events through Fluentd, storing them in AWS S3, and...","image":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","thumbnailUrl":"https://media.daily.dev/image/upload/s--qPvKM23u--/f_auto/v1722860399/public/Placeholder%2009","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/securely-managing-your-audit-logs-with-teleport-and-snowflake-psflhvjzc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"snowflake,aws-s3","timeRequired":"PT12M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Securely Managing Your Audit Logs with Teleport and Snowflake"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/securely-managing-your-audit-logs-with-teleport-and-snowflake-psflhvjzc#faq","mainEntity":[{"@type":"Question","name":"How do I forward Teleport audit logs to Snowflake?","acceptedAnswer":{"@type":"Answer","text":"Configure Teleport's event handler plugin to send logs to Fluentd, which forwards them to an S3 bucket using the fluent-plugin-s3 gem in a custom Fluentd Docker image. Then create a Snowflake storage integration, stage, and Snowpipe pointed at the S3 bucket, and trigger ingestion automatically using an S3 event notification to an SQS queue. daily.dev surfaces practical pipelines like this for engineers wiring up audit log ingestion."}},{"@type":"Question","name":"How do I set up Snowpipe to auto-ingest data from an S3 bucket?","acceptedAnswer":{"@type":"Answer","text":"Create a Snowflake storage integration referencing the IAM role ARN and allowed S3 locations, then create a stage pointing at the S3 bucket using that integration. Create a pipe with AUTO_INGEST=TRUE that copies staged files into a target table using a defined file format, then configure an S3 event notification pointing to the pipe's notification_channel_arn SQS queue. Teams building event-driven data pipelines can find setup walkthroughs like this on daily.dev."}},{"@type":"Question","name":"What Fluentd Docker image configuration is needed to forward logs to S3?","acceptedAnswer":{"@type":"Answer","text":"Build a custom Fluentd image based on fluent/fluentd:v1.15-1 that installs the nokogiri and fluent-plugin-s3 gems, then copies in a custom fluent.conf and entrypoint.sh. The fluent.conf must define an output of type s3 with the target bucket, AWS credentials, and a timekey value controlling how often logs are flushed to S3. Engineers automating log forwarding pipelines can track tooling changes like this via daily.dev."}}]} ```