Data Export

Configure Data Export to send selected AgentKeeper OTLP events to your Amazon S3 bucket. Use filters to control which events are included.

Availability

Data Export is enabled per organization. Only organization owners and admins can create, edit, pause, or delete destinations.

S3 configuration

To let AgentKeeper access your S3 destination, create an IAM role named agentkeeper-data-integration. Allow arn:aws:iam::851725239579:role/agentkeeper-connect to assume the role, and grant it access only to the selected bucket and prefix. Enter your role ARN with the bucket, AWS region, and optional object prefix.

Your role trust policy must allow both sts:AssumeRole and sts:TagSession. Require the AgentKeeper Connect role ARN and the External ID shown in Data Export settings for sts:AssumeRole:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::851725239579:role/agentkeeper-connect"
      },
      "Action": "sts:AssumeRole",
      "Condition": {
        "StringEquals": {
          "sts:ExternalId": "<External ID>"
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::851725239579:role/agentkeeper-connect"
      },
      "Action": "sts:TagSession"
    }
  ]
}

Attach a permissions policy to the role that is restricted to your configured bucket and prefix. This example allows object upload, including multipart upload, without delete access:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:AbortMultipartUpload",
        "s3:ListMultipartUploadParts"
      ],
      "Resource": "arn:aws:s3:::customer-security-lake/agentkeeper/otlp/*"
    },
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::customer-security-lake",
      "Condition": {
        "StringLike": {
          "s3:prefix": "agentkeeper/otlp/*"
        }
      }
    }
  ]
}

Replace the example bucket and prefix with your destination values. Copy External ID from Data Export settings and replace the <External ID> placeholder. Keep the AgentKeeper Connect role ARN exactly as shown. Your role must be named agentkeeper-data-integration without an IAM path. Do not enter AWS access keys.

Verify access

AgentKeeper verifies S3 access when you add a destination or change its S3 settings. You can also select Verify on an existing destination at any time. Verification lists at most one object under the configured prefix. AgentKeeper does not retain or display the object name.

A successful check marks the destination Verified. A failed check marks it Needs attention and shows a safe explanation, such as a role trust, bucket permission, or region mismatch. The destination is still saved so you can correct the AWS configuration and retry.

Object layout

S3 objects use Hive-style UTC date partitions:

s3://<bucket>/<prefix>/year=YYYY/month=MM/day=DD/part-<batch-id>.jsonl.gz

Each gzip-compressed object contains one JSON event per line and uses schema version agentkeeper.data_export.claude_otlp.v1. Exported events follow your AgentKeeper prompt, tool-detail, email, and sensitive-value redaction settings.

Filters

Filters can match the canonical OTLP event.name attribute, users, workstations, departments, tools, MCP servers, and models. Event-name choices include the Claude OTLP events AgentKeeper accepts. User and workstation choices come from your AgentKeeper organization. An empty filter includes all Claude OTLP events.

Filter evaluation is fail-closed for missing attributes: an event without the selected field does not match, including for negative operators.

Status and metrics

Each destination shows its latest operational status and delivery totals for batch bytes, objects, successful deliveries, and failed deliveries. AgentKeeper records both successful and failed connection checks. Delivery attempts use the same activity trail and successful attempts include the batch size and, when available, the number of objects written.

The activity trail contains bounded operational metadata only. It does not contain exported event payloads, AWS credentials, or S3 object names.

AgentKeeper keeps these operational records for three months by default.