AWS CloudTrail to DuckDB Integration

How Datrise loads AWS CloudTrail into DuckDB

Datrise syncs AWS CloudTrail's API events, identities, resources, event sources, error codes, and request parameters into DuckDB as a typed table per source entity in a DuckDB file. Flexible or custom fields land in JSON or STRUCT columns, and timestamps such as created, updated, and status changes are typed as TIMESTAMP WITH TIME ZONE.

Sync is incremental: Datrise uses rewrites changed entities into the local database (or Parquet) on each run, so re-runs update only what changed. Hive-partitioned Parquet by load date when exporting. DuckDB is single-writer and embedded, so Datrise produces a consistent file snapshot rather than concurrent streaming writes.

Ideal for local and notebook analytics without standing up a server.

Endpoints

AWS CloudTrail: AWS account activity and API audit logging.

DuckDB: In-process analytics database for fast local OLAP.

How AWS CloudTrail entities map to DuckDB

AWS CloudTrail entity	DuckDB object	Notes
API events	`aws_cloudtrail_api_events`	TIMESTAMP WITH TIME ZONE events
identities	`aws_cloudtrail_identities`	id PK · linked to aws_cloudtrail_api_events
resources	`aws_cloudtrail_resources`	id PK · linked to aws_cloudtrail_api_events
event sources	`aws_cloudtrail_event_sources`	TIMESTAMP WITH TIME ZONE events

FAQ

How does Datrise handle AWS CloudTrail's custom fields in DuckDB?

Flexible values are stored as JSON or STRUCT columns, so new fields don't require a migration; strongly-typed fields — dates, numbers, and references — are promoted to native DuckDB types.

How does the AWS CloudTrail to DuckDB sync stay up to date?

It runs incrementally — Datrise uses rewrites changed entities into the local database (or Parquet) on each run.

Related pipelines

Early access

Connect AWS CloudTrail to DuckDB the easy way

Skip brittle scripts and manual exports. Join the waitlist to get a guided setup, AI-assisted mapping, and reliable incremental sync for this integration.