Integration with AWS Cognito

• OpenObserve account (Cloud or Self-Hosted)
• AWS account with:
  • Cognito User Pool
  • Permissions to create EventBridge rules and Firehose streams

1. Go to AWS CloudTrail → Trails
2. Ensure you have a trail that logs management events
3. If not:
   • Click Create trail
   • Name it (e.g., CognitoTrail)
   • Enable Management events (Read/Write or Write-only)
   • Choose a destination S3 bucket (new or existing)
   • Complete trail creation

1. In OpenObserve: go to Data > Data sources > Recommended > Amazon Web Services(AWS). The Manual Configuration block shows the HTTP endpoint and Access Key
2. Copy the ingestion URL and Access Key

The endpoint shown ends in /default/_kinesis_firehose. Replace default with your stream name:

https://<your-openobserve-domain>/aws/<org_id>/<stream_name>/_kinesis_firehose

1. In AWS Kinesis Firehose, Create delivery stream with Source: Direct PUT and Destination: HTTP Endpoint.
2. Provide OpenObserve's HTTP Endpoint URL and Access Key, and set an S3 backup bucket.
3. Give the stream a meaningful name and Create it.

1. Go to EventBridge > Rules and click Create rule
2. Name the rule (e.g., CognitoToOpenObserve)
3. Set event pattern:

{
    "source": ["aws.cognito-idp"]
}

4. Set the target to Kinesis Firehose and choose the delivery stream
5. Click Create rule

1. Go to Logs → select your log stream → Set time range → Click Run Query

No logs appearing?

• Ensure your CloudTrail is capturing management events
• Confirm your EventBridge rule has matched events recently
• Check if Firehose is delivering logs (see monitoring tab in Firehose)
• Verify that the OpenObserve URL and Access Key are valid
• Look for failed logs in your backup S3 bucket