Hi @robj, thanks for the suggestion! That sounds like a solid option. Do you also have your heavy forwarder deployed in AWS? We ended up using the Splunk Data Manager app to ingest AWS CloudTrail logs from an AWS S3 bucket using a cross-account IAM role that can be assumed by Splunk Cloud. Splunk Data Manager documentation: https://docs.splunk.com/Documentation/DM/1.12.0/User/About Configure AWS for onboarding from a single account: https://docs.splunk.com/Documentation/DM/1.12.0/User/AWSSingleAccount You can use the above implementation to either ingest CloudTrail logs from a single AWS account or from your centralized logging account in an AWS Organization or Control Tower environment. ... View more