Ingestion of AWS CloudWatch data to Microsoft Sentinel using S3 connector

Adding additional information what is done and with all steps:
Since automation script in powershell gives you capability to automatically create aws resources necessary, i tried this on test environment:

1. Downloaded AWS CLI, ran aws config, provided keys necessary with default location of my resources.

2.Run Automation Script from powershell as documentation mentioned, filled out all fields necessary.

2.1 Automation script created:

2.1.1 S3 Bucket with Access policy:

• allow IAM role to read S3 bucket and s3GetObject from s3 bucket
• Allow CloudWatch to upload objects to bucket with S3PutObject, AWS Cloud Watch ACLCheck Allowed from CloudWatch to S3 bucket.

2.1.2 Notification event for S3 bucket to send all logs from specified S3 bucket to SQS for objects with suffix .gz (Later edited this manually and added all event types to make sure events are sent)

2.1.3 SQS Queue with Access Policy - Allow S3 bucket to SendMessage to SQS service.

2.1.4 IAM user with Sentinel Workspace ID and Sentinel RoleID

Since this was deployed via Automation script, in order to send logs with CloudWatch it is necessary to configure Lambda function. Since script itself does not create these resources i have created it manually:

1. Added IAM role assignments for Permission policies:

• S3 Full Access, AWS Lambda Execute, CloudWatchFullAccess, CloudWatchLogsFullAccess (even later i added: CloudWatchFullAccessV2, S3ObjectLambdaExecutionRolePolicy to try it out)

1.2 Added lambda.amazonaws.com in trust relationship policy so i can use this role for Lambda execution.

2. Created a CloudWatch log group and log stream - created log group per subscription filter for lambda function

3.Created Lambda function as per Microsoft documentation - tried newest article
https://techcommunity.microsoft.com/t5/microsoft-sentinel-blog/enhance-the-ingestion-of-aws-cloudwatch-logs-into-microsoft/ba-p/4100565
(Choose Lambda Python 3.12 , used existing role created above);
(Took CloudWatchLambdaFunction_V2.py and there is an issue with pandas module, i managed to overcome this using the document:
https://medium.com/@shandilya90apoorva/aws-cloud-pipeline-step-by-step-guide-241aaf059918

but even then i get error:

Response {   "errorMessage": "Unable to import module 'lambda_function': Error importing numpy: you should not try to import numpy from\n        its source directory; please exit the numpy source tree, and relaunch\n        your python interpreter from there.",   "errorType": "Runtime.ImportModuleError",   "requestId": "",   "stackTrace": [] }

Anyway this is what i tried and i eventually get to same error regarding lambda function provided from Microsoft.

I will update topic briefly if i find anything important.

@Vasilije Djurovic Thank you for reaching out to us, would recommend to raise the query on GitHub as well which will give more visibility to GitHub repro owner/content authors.