Splunk App for AWS: What are advantages of reading Cloudtrail or Config logs from S3>SNS>SQS over reading from S3 directly?

[amN0P]

What are advantage(s) of reading Cloudtrail or Config logs from S3>SNS>SQS over reading from S3 directly? Is it avoiding duplicate messages? Anything else?

[jcoates_splunk · Accepted solution]

Hi,

The primary reason is speed. The SQS path lets us receive the message as soon as AWS posts it instead of polling the bucket every few minutes.

[amN0P]

Thanks for your time!