Integrations

Integrations connect a workspace to external services. Open Integrations in a workspace to see the catalog and add one.

Available: AWS IAM role

The AWS integration (AWS IAM Role Access) delegates access to your AWS account through an IAM role that Relay assumes. Relay uses it for:

• Backup export — copying a cluster's backups to an S3 bucket you own.
• Log streaming — streaming audit, activity, and cluster logs to your S3 bucket.

Set it up

1. In the workspace, open Integrations → Add integration and choose AWS.
2. In the AWS IAM console choose Create role → Custom trust policy and paste the trust policy Relay shows. It lets only Relay's AWS account assume the role, and only with your organization's External ID.
3. Add the permissions policy Relay shows as an inline policy. Replace YOUR_BUCKET with each bucket you will export to; you can add more later.
4. Paste the Role ARN (for example arn:aws:iam::123456789012:role/relay-access) and a name, then connect. Relay calls sts:AssumeRole with your External ID to confirm the trust policy. Bucket permissions are checked later, when you pick a bucket in an export.

Creating, changing, and removing integrations needs the org.cloud_integrations.* permissions (admin and owner); member and viewer can view them. See RBAC.

Log destinations (SIEM streaming)

Log destinations push the audit and activity streams to your SIEM as events happen, instead of in one-minute batches to S3. Open Audit or Activity in a workspace and choose Destinations. Each destination receives the streams you pick (audit, activity, or both).

How delivery works:

• Latency. Relay polls every 2 seconds; an event normally lands within about 5 seconds.
• At least once. Relay keeps a cursor per destination and stream and only moves it after the destination accepted the batch, so a restart or an outage never skips events. A batch can arrive twice: deduplicate on the event id.
• Retries. Network errors, timeouts, 408, 429 and 5xx responses are retried with backoff (up to 5 minutes between attempts) and the events wait. When the destination rejects an event as invalid (400, 413, 422) while accepting the rest, that event is skipped and counted as skipped; a destination that rejects everything stops the stream and shows the error instead.
• Batches hold up to 500 events or 1 MiB. Requests time out after 10 seconds.
• Integrity. Events keep the hash-chain fields (chain_seq, prev_hash, row_hash) where the trail is chained (Relay Agent Edition), so the SIEM can check continuity.
• Secrets (signing secret, HEC token, API key) are encrypted at rest and never shown again after you save them.

Each destination has a Test action that sends one synthetic event (schema: relay.test.v1) and reports the result, and shows its health: the last successful delivery, the last error, how far behind it is (lag), and the counts of delivered and skipped events.

Webhook signatures

Every webhook request carries:

To verify a request, recompute the HMAC over the timestamp, a ., and the raw body, compare it in constant time with the v1 value, and reject requests whose timestamp is more than 5 minutes from your clock (this stops replays). If you leave the signing secret empty, Relay generates one and shows it once.

import hashlib, hmac, time

def verify(secret: bytes, headers, body: bytes, window=300) -> bool:
    ts = headers["X-Relay-Timestamp"]
    if abs(time.time() - int(ts)) > window:
        return False
    want = hmac.new(secret, ts.encode() + b"." + body, hashlib.sha256).hexdigest()
    got = [p.split("=", 1)[1] for p in headers["X-Relay-Signature"].split(",") if p.startswith("v1=")]
    return any(hmac.compare_digest(want, g) for g in got)

Network rules

In Relay Cloud, destinations must be public: https only, and Relay refuses private, loopback, link-local, carrier-grade NAT and cloud metadata addresses. The check runs on the address the hostname resolves to, at connection time, and redirects are not followed. In Relay Agent Edition the control plane runs in your network, so private addresses and plain http are allowed and the standard HTTPS_PROXY settings apply. For an endpoint whose certificate comes from a private CA, paste the CA in Custom CA (PEM).

Availability and permissions

• Relay Cloud: log destinations are being rolled out; contact support to enable them for your organization.
• Relay Agent Edition: included when your license has the siem_export feature (the same feature as the /audit/export endpoint).

Viewing destinations needs org.cloud_integrations.read. Creating, changing, testing and removing them need org.cloud_integrations.create, .update and .delete; creating and changing also need permission to read the audit log.

Not yet available

These appear in the catalog but cannot be connected yet: Azure, Google Cloud, Slack, Microsoft Teams, PagerDuty, and Prometheus. Datadog Logs and HTTPS webhooks are available as log destinations.