---
schema_version: "1"
id: c824a1d1d7eae96aea2a1551e05af191a86631cbe350fd4e08352dcb151c53cf
title: Set Up Activity Log
collection: tableau
version: next
locale: en-us
portal_url: https://docs.salesforce.com/tableau/next/en-us/online/activity_log_setup.md
canonical_url: https://help.tableau.com/v0.0/online/en-us/activity_log_setup.htm
source_site: help.tableau.com
content_type: documentation
content_hash: 88fda64f280054183ac4e3eedf59d2def34db5c45f77ee1d64ba0bc8e7e8496c
description: Configuration steps for setting up the Activity Log.
---
[Skip to main content](#main-content)

# Set Up Activity Log

> [!TIP]
> 
> **Important:** Between March 16 and March 31, 2026, the Activity Log feature in Tableau Cloud migrated to Hyperforce. For details on required policy updates and new folder structures, see [About the Hyperforce migration](#hyperforce-migration).

The Activity Log contains detailed events for your Tableau deployment that you can use for compliance, monitoring, and auditing. You must complete the following steps in order to use Activity Log.

## Prerequisites

To use the Activity Log, you must have the following:

- Tableau Cloud with Advanced Management
- Amazon Web Services (AWS) account
- Amazon Simple Storage Service (S3) bucket to receive data
    
    - You'll create an Amazon S3 bucket as part of the setup process. Amazon S3 is currently the only supported option for a direct cloud storage sync integration.
    - You must create the Amazon S3 bucket in the same AWS region where your Tableau Cloud site is hosted. For more information about data locations, see [Security in the Cloud](https://help.tableau.com/v0.0/online/en-us/to_security.htm#data-location) and [IP addresses for data provider authorization](https://help.tableau.com/v0.0/online/en-us/to_keep_data_fresh.htm#safelist).
        
        **Important:** Pods in the Europe - Ireland region have moved to the Europe - Germany region as part of Tableau Cloud's migration to Hyperforce. If your site resided on a Europe - Ireland pod, you'll need to reconfigure Activity Log to use an AWS S3 bucket in the new region, Europe - Germany. For more information, see [AWS region change for sites on Europe - Ireland pods](#hyperforce) below.
- AWS Key Management Service (KMS) single-region key for the Amazon S3 bucket that you create during setup.

## About the Hyperforce migration

In March 2026, the Activity Log feature migrated to Hyperforce to enhance compliance and improve security, privacy, and regional availability. This infrastructure change moved Activity Log to a regional architecture, which requires the use of region-specific IAM roles for log delivery.

### Policy requirements

S3, KMS, and VPC policies require the IAM role and ID specific to the region where your site is hosted. These region-specific Hyperforce values replace the previous Tableau IAM role (`arn:aws:iam::061095916136:role/prod-replication-rule-role`) and ID (`AROAQ4OMZWJUBZG3DRFW5`). Use the [Role mapping by region](#role-mapping-by-region) table to find the correct values for your site.

For more information about the migration, see [Changes to Tableau Cloud Activity Log Due to Hyperforce Migration](https://help.salesforce.com/s/articleView?id=005232922&type=1) in Salesforce Help.

### Folder structure

The migration to Hyperforce updated the organization of event files in S3 buckets to a hierarchy based on the date and hour the events were processed.

<table style="width: 100%;" class="simple-table"><colgroup><col style="width: 20%;"> <col style="width: 40%;"> <col style="width: 40%;"></colgroup><tbody><tr><td></td><th>Before migration</th><th>After migration</th></tr><tr><th>Storage pattern</th><td><code>eventCategory={}/ts={}/FILE</code></td><td><code>y={}/m={}/d={}/h={}/eventType={}/FILE</code></td></tr><tr><th>Example S3 path</th><td><code>eventCategory=security/ts=20250802T064500Z/part-0-32708-online</code></td><td><code>y=2025/m=08/d=02/h=06/eventType=activity_log_settings_change/ActivityLog-88974c0f-d35a-4743-bd55-7fccce1d54a7-0-346425.txt</code></td></tr></tbody></table>

### Event attributes

Activity Log events recorded on Hyperforce include the `eventProcessedTime` attribute. This attribute represents the approximate timestamp of when the event became available in the Activity Log. For more information, see [Activity Log Site Event Type Reference](https://help.tableau.com/v0.0/online/en-us/activity_log_schema.htm).

## Step 1. Create an AWS account

If you don't already have an Amazon Web Services (AWS) account, you can [sign up for an AWS account](https://portal.aws.amazon.com/billing/signup?nc2=h_ct&src=header_signup&redirect_url=https%3A%2F%2Faws.amazon.com%2Fregistration-confirmation#/start/email) at the AWS website.

## Step 2. Create an Amazon S3 bucket and set up permissions

1. Create an Amazon S3 bucket to receive your log data. For more information, see [Creating a bucket](https://docs.aws.amazon.com/AmazonS3/latest/userguide/create-bucket-overview.html) at the AWS website.
2. Configure the Amazon S3 bucket with the following settings:
    
    1. Under Object Ownership, select ACLs disabled (recommended). This ensures that the bucket owner is the owner of all objects written to it.
    2. Under Bucket Versioning, select Enable. Bucket versioning must be enabled in order to replicate objects.
    3. Under Default encryption, select Enable.
    4. Choose AWS Key Management Service (SSE-KMS).
    5. Choose Enter AWS KMS key ARN.
    6. Click the Create key button that appears to create a new AWS Key Management Service (KMS) key.
        
        **Note:** KMS multi-region keys aren't supported.
    7. Select Symmetric Key type and Encrypt and decrypt Key usage.
    8. Name the key with an alias, and then click through until the Review page.
    9. Add this statement to the key policy Statement list. Use the [Role mapping by region](#role-mapping-by-region) table to find your region-specific role, and then replace `HYPERFORCE-IAM-ROLE`.
        
        {
            "Sid": "AllowTableauS3ReplicationSourceRoleToUseTheKey",
            "Effect": "Allow",
            "Principal": {
                "AWS": \[
                    "HYPERFORCE-IAM-ROLE"
                \]
            },
            "Action": \[
                "kms:GenerateDataKey",
                "kms:Encrypt"
            \],
            "Resource": "\*"
        }
        
        **Note:** This statement allows the Hyperforce IAM role to encrypt the objects placed in the Amazon S3 bucket. For more information, see [Using server-side encryption with AWS KMS keys (SSE-KMS)](https://docs.aws.amazon.com/AmazonS3/latest/userguide/UsingKMSEncryption.html) at the AWS website.
        
        - "kms:GenerateDataKey" is used to generate a data key to encrypt object replicas.
        - "kms:Encrypt" is used to encrypt object replicas created in the target S3 bucket.
        - "Resource": "\*" grants permission for the KMS key only to the replication role and doesn't allow the role to elevate its permissions.
    10. Click Finish to create the KMS key.
    11. Click Create bucket to create the Amazon S3 bucket.
3. Update permissions on the Amazon S3 bucket policy.

1. Open the Amazon S3 bucket and click the Permissions tab.
2. Locate the Bucket policy section and click Edit.
3. Add this statement to the bucket policy Statement list.
    
    - Replace `S3-BUCKET-NAME` with the name of the bucket.
    - Use the [Role mapping by region](#role-mapping-by-region) table to find your region-specific role, and then replace `HYPERFORCE-IAM-ROLE`.
    
    {
        "Sid": "TableauS3ReplicationRoleAccess",
        "Effect": "Allow",
        "Principal": {
            "AWS": \[
                "HYPERFORCE-IAM-ROLE"
            \]
        },
        "Action": \[
            "s3:ReplicateObject",
            "s3:ReplicateDelete"
        \],
        "Resource": \[
            "arn:aws:s3:::S3-BUCKET-NAME",
            "arn:aws:s3:::S3-BUCKET-NAME/\*"
        \]
    }
    
    **Note:** This statement allows the Hyperforce IAM role to replicate objects into the bucket. For more information, see [Granting permissions when the source and destination buckets are owned by different AWS accounts](https://docs.aws.amazon.com/AmazonS3/latest/userguide/setting-repl-config-perm-overview.html#setting-repl-config-crossacct) at the AWS website.
    
    - Using "\*" and "<path>/\*" grants access to all prefixes in the specified bucket and path in the bucket.
    - The "s3:ReplicateObject" and "s3:ReplicateDelete" permissions are the minimum permissions required to successfully replicate objects and delete markers.
4. Optional. If your destination bucket has a policy that restricts access through an Amazon Virtual Private Cloud (VPC) endpoint, you must change the bucket policy in addition to the TableauS3ReplicationRoleAccess that you just added. For more information, see [How do I allow only specific VPC endpoints or IP addresses to access my Amazon S3 bucket?](https://aws.amazon.com/premiumsupport/knowledge-center/block-s3-traffic-vpc-ip/) at the AWS website.
    
    If the current bucket policy contains a VPC restriction like this:
    
    {
        "Sid": "Restricted VPC Access",
        "Effect": "Deny",
        "Principal": "\*",
        "Action": "s3:\*",
        "Resource": \[
            "arn:aws:s3:::S3-BUCKET-NAME",
            "arn:aws:s3:::S3-BUCKET-NAME/\*"
        \],
        "Condition": {
            "StringNotEquals": {
                "aws:SourceVpc": "vpc-<ID>"
            }
        }
    }
    
    Then edit the "Condition" list. Use the [Role mapping by region](#role-mapping-by-region) table to find your region-specific role and role ID, and then replace `HYPERFORCE-IAM-ROLE` and `HYPERFORCE-IAM-ROLE-ID`.
    
    "StringNotLike": {
        "aws:userId": \["HYPERFORCE-IAM-ROLE-ID:\*"\]
    },
    "ArnNotLike": {
        "aws:PrincipalArn": "HYPERFORCE-IAM-ROLE"
    }
    
    The edited policy should look like this:
    
    {
        "Sid": "Restricted VPC Access",
        "Effect": "Deny",
        "Principal": "\*",
        "Action": "s3:\*",
        "Resource": \[
            "arn:aws:s3:::S3-BUCKET-NAME",
            "arn:aws:s3:::S3-BUCKET-NAME/\*"
        \],
        "Condition": {
            "StringNotLike": {
                "aws:userId": \["HYPERFORCE-IAM-ROLE-ID:\*"\]
            },
            "ArnNotLike": {
                "aws:PrincipalArn": "HYPERFORCE-IAM-ROLE"
            },
            "StringNotEquals": {
                "aws:SourceVpc": "vpc-<ID>"
            }
        }
    }
    
    This policy explicitly allows the Hyperforce IAM role to ReplicateObject and ReplicateDelete. It also excludes the role from the existing explicit VPC deny statement.
5. Click Save changes.

## Role mapping by region

Use this table to find your region-specific role and ID when configuring S3, KMS, and VPC policies.

<table style="width: 100%;" class="simple-table">
                    <colgroup><col style="width: 14%;">
                    <col style="width: 14%;">
                    <col style="width: 14%;">
                    <col style="width: 14%;">
                    <col style="width: 14%;">
                    <col style="width: 14%;">
                    </colgroup><tbody>
                        <tr>
                            <th colspan="2">Location</th>
                            <td><b>Hyperforce region</b>
                            </td>
                            <td style="font-weight: bold;">Pod (<b>Pod name</b>)</td>
                            <td><b>Hyperforce IAM role</b>
                            </td>
                            <td><b>Hyperforce IAM role ID</b>
                            </td>
                        </tr>
                        <tr>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="6">Asia Pacific</td>
                            <td>
                                <p>Australia</p>
                            </td>
                            <td>
                                <p>ap-southeast-2</p>
                            </td>
                            <td>
                                <p>prod-apsoutheast-a</p>
                            </td>
                            <td>
                                <p>arn:aws:iam::667498515984:role/prod-replication-rule-role</p>
                            </td>
                            <td>
                                <p>AROAZW2QDBYIELBSU3VDC</p>
                            </td>
                        </tr>
                        <tr>
                            <td>India</td>
                            <td>ap-south-2</td>
                            <td>prod-in-a</td>
                            <td>arn:aws:iam::119877853097:role/prod-replication-rule-role</td>
                            <td>AROARX2KG36USNTHK2AAX</td>
                        </tr>
                        <tr>
                            <td>
                                <p>Indonesia</p>
                            </td>
                            <td>
                                <p>ap-southeast-3</p>
                            </td>
                            <td>
                                <p>prod-apsoutheast-c</p>
                            </td>
                            <td>
                                <p>arn:aws:iam::892386869973:role/prod-replication-rule-role</p>
                            </td>
                            <td>
                                <p>AROA47RTHALKXJHOEM32G</p>
                            </td>
                        </tr>
                        <tr>
                            <td>
                                <p>Japan</p>
                            </td>
                            <td>
                                <p>ap-northeast-1</p>
                            </td>
                            <td>
                                <p>prod-apnortheast-a</p>
                            </td>
                            <td>
                                <p>arn:aws:iam::349070092441:role/prod-replication-rule-role</p>
                            </td>
                            <td>
                                <p>AROAVCRRS5CM6KOVJGVDJ</p>
                            </td>
                        </tr>
                        <tr>
                            <td>
                                <p>Singapore</p>
                            </td>
                            <td>
                                <p>ap-southeast-1</p>
                            </td>
                            <td>
                                <p>prod-apsoutheast-b</p>
                            </td>
                            <td>
                                <p>arn:aws:iam::005102551263:role/prod-replication-rule-role</p>
                            </td>
                            <td>
                                <p>AROAQCMBCYDP4EQ7BSYPQ</p>
                            </td>
                        </tr>
                        <tr>
                            <td>South Korea</td>
                            <td>ap-northeast-2</td>
                            <td>prod-kr-a
</td>
                            <td>arn:aws:iam::943538517075:role/prod-replication-rule-role</td>
                            <td>AROA5XL2HGRJVG2MZNCKD</td>
                        </tr>
                        <tr>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;">Canada</td>
                            <td>
                                <p>Quebec</p>
                            </td>
                            <td>
                                <p>ca-central-1</p>
                            </td>
                            <td>
                                <p>prod-ca-a</p>
                            </td>
                            <td>
                                <p>arn:aws:iam::075540750887:role/prod-replication-rule-role</p>
                            </td>
                            <td>
                                <p>AROARDFUUMITZCISXK6GD</p>
                            </td>
                        </tr>
                        <tr>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="4">Europe</td>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="2">Germany</td>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="2">eu-central-1</td>
                            <td>
                                <p>dub01 (DUB01)</p>
                            </td>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="2">arn:aws:iam::337853574888:role/prod-replication-rule-role</td>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="2">AROAU5KNEN3UM57STAJFK</td>
                        </tr>
                        <tr>
                            <td>
                                <p>eu-west-1a (EW1A)</p>
                            </td>
                        </tr>
                        <tr>
                            <td>Switzerland</td>
                            <td>eu-central-2</td>
                            <td>prod-ch-a</td>
                            <td>arn:aws:iam::623102672691:role/prod-replication-rule-role</td>
                            <td>AROAZCE6QH4Z33FOSZXGJ</td>
                        </tr>
                        <tr>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="1">UK</td>
                            <td>
                                <p>eu-west-2</p>
                            </td>
                            <td>
                                <p>prod-uk-a</p>
                            </td>
                            <td>
                                <p>arn:aws:iam::112108976196:role/prod-replication-rule-role</p>
                            </td>
                            <td>
                                <p>AROARUGRXHBCNE3KR64LZ</p>
                            </td>
                        </tr>
                        <tr>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="5">United States - West</td>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="5">Oregon</td>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="5">us-west-2</td>
                            <td>
                                <p>10ax (10AX)</p>
                            </td>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="5">arn:aws:iam::675003682462:role/prod-replication-rule-role</td>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="5">AROAZ2KK2Z2PMO2HWNLWH</td>
                        </tr>
                        <tr>
                            <td>
                                <p>10ay (10AY)</p>
                            </td>
                        </tr>
                        <tr>
                            <td>
                                <p>10az (10AZ)</p>
                            </td>
                        </tr>
                        <tr>
                            <td>
                                <p>uw2b (UW2B)</p>
                            </td>
                        </tr>
                        <tr>
                            <td>
                                <p>prod-uswest-c</p>
                            </td>
                        </tr>
                        <tr>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="4">United States - East</td>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="4">Virginia</td>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="4">us-east-1</td>
                            <td>
                                <p>prod-useast-a</p>
                            </td>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="4">arn:aws:iam::792479604904:role/prod-replication-rule-role</td>
                            <td style="vertical-align: middle;padding-left: 6px;padding-right: 6px;padding-top: 6px;padding-bottom: 6px;border-left-style: solid;border-left-width: 1px;border-left-color: #bbb;border-right-style: solid;border-right-width: 1px;border-right-color: #bbb;border-top-style: solid;border-top-width: 1px;border-top-color: #bbb;border-bottom-style: solid;border-bottom-width: 1px;border-bottom-color: #bbb;" rowspan="4">AROA3RA3XECUCMUTXI34R</td>
                        </tr>
                        <tr>
                            <td>
                                <p>prod-useast-b</p>
                            </td>
                        </tr>
                        <tr>
                            <td>
                                <p>us-east-1 (useast-1)</p>
                            </td>
                        </tr>
                        <tr>
                            <td>
                                <p>prod-useast-c</p>
                            </td>
                        </tr>
                    </tbody>
                </table>

## Step 3. Configure Tableau Cloud

1. Navigate to your Tableau site.
2. On the Settings page, select the Integrations tab.
3. In the Activity Log section, select the Enable button.
4. In the Set Up Connection dialog box, enter the following information:
    
    1. In the AWS account number box, enter your 12-digit AWS account number. This is the AWS account number associated with your Amazon S3 bucket location.
    2. In the S3 bucket name box, enter the name of the Amazon S3 bucket where Activity Log files will be delivered. This is the Amazon S3 bucket you created in [Step 2. Create an Amazon S3 bucket and set up permissions](#Step2CreateS3Bucket). This must be a valid name according to AWS bucket name requirements.
    3. In the KMS key ARN box, enter the KMS key Amazon Resource Name (ARN) that you created in [Step 2. Create an Amazon S3 bucket and set up permissions](#Step2CreateS3Bucket). The account number in the ARN must match the provided AWS account number, and be of valid format (i.e. arn:aws:kms:_<region>_:_<account-id>_:key/_<key-id>_).
5. Click Submit.
    
    The connection status column will show In progress as the system attempts to replicate a text file to the target Amazon S3 bucket to test the connection.
    
    After the file has been successfully replicated to the target Amazon S3 bucket, the connection status column will state Pending verification and display a widget to input 'Test file contents'. You might need to refresh the page to see updates.

## Verify security file replication

1. Go to the target Amazon S3 bucket and find the folder beginning with siteLuid (the remainder of the name is the site's unique identifier).
2. Find the text file named `SECURITY_VERIFICATION_FILE.txt`.
3. Download and open the text file.
4. Copy the text content inside the file.
5. Return to the Settings page and paste the text contents into the Text file contents input field, and then click Submit.
6. If the submitted content is correct, the connection status changes to Active. Activity Log is now enabled, and data will begin to replicate to the target Amazon S3 bucket.
7. If the submitted content is incorrect, an error message will be displayed. Check that the content was copied correctly without extra characters or spaces.

## Troubleshooting

### Security verification file not appearing?

- The file could take up to 15 minutes to appear in the target Amazon S3 bucket due to Amazon S3 limitations.
    
    If the connection status says "In progress", the file is still attempting to replicate. For more information, see [Troubleshooting replication](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-troubleshoot.html) at the AWS website.
- A connection status of Failed means that the file was unable to replicate successfully.
    
    Confirm that the permissions on the Amazon S3 bucket policy and the AWS Key Management Service (KMS) key policy contain the appropriate statements. For more information, see the following topics at the AWS website:
    
    - [Troubleshooting replication](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-troubleshoot.html)
    - [Configuring replication when source and destination buckets are owned by different accounts](https://docs.aws.amazon.com/AmazonS3/latest/userguide/replication-walkthrough-2.html)
    - [I set up replication between my buckets, but new objects aren't replicating. How can I troubleshoot this?](https://help.tableau.com/v0.0/online/en-us/%3Chttps://aws.amazon.com/premiumsupport/knowledge-center/s3-troubleshoot-replication/#:~:text=To troubleshoot objects that aren,object to the source bucket.>)

### Other settings that are required for log files to reach the Amazon S3 bucket

- The Amazon S3 bucket has Bucket Versioning enabled (under Properties > Bucket Versioning).
- The Amazon S3 bucket has Block all public access enabled (under Permissions > Block public access (bucket settings)).
- The Amazon S3 bucket has the following ACL permissions for only "Bucket owner" (under Permissions > Access Control List (ACL)):
    
    - Objects: List, Write
    - Bucket ACL: Read, Write
- The KMS key permissions policy contains the statement in [Step 2. Create an Amazon S3 bucket and set up permissions](#Step2CreateS3Bucket), step 2. i. (under Properties > Default encryption click on the ARN under AWS KMS Key ARN to go to the KMS key policy).
- The Amazon S3 bucket has default encryption enabled and bucket key enabled (under Properties > Default encryption).
- The Amazon S3 bucket permissions policy (under Permissions > Bucket Policy) exactly matches the one in the instructions. Ensure that you have replaced the example value "S3-BUCKET-NAME" with the Amazon S3 bucket you just created.

### AWS region change for sites on Europe - Ireland pods

Between August 2024 to March 2025, Tableau Cloud sites were migrated to Salesforce's [Hyperforce](https://help.salesforce.com/s/articleView?id=000388902&type=1). As part of the migration, pods in the Ireland region moved to the Germany region. If your site resided on a pod in the Ireland region, you'll need to reconfigure Activity Log to use an AWS S3 bucket in the new region, Germany.