Skip to main content

​
Forwarding command

Use beacon endpoint s3 to generate AWS S3 forwarding content for Beacon endpoint events. The generated pack keeps Beacon as a local JSONL producer and helps your customer-managed Vector agent upload runtime.jsonl to an S3 bucket as gzip-compressed NDJSON. Beacon does not store AWS credentials, profiles, IAM roles, bucket policies, lifecycle rules, or encryption settings in endpoint configuration. Keep those values in AWS, Vector, endpoint-management policy, or deployment tooling. For packaged macOS MDM deployments, the managed S3 helper can persist MDM-injected AWS provider-chain environment variables to the root-owned Vector environment file used by launchd.
Command syntax

​
Commands

beacon endpoint s3 print-config

Print a one-shot AWS CLI script that uploads the current logs to S3.

beacon endpoint s3 install-pack

Write AWS S3 forwarding content to a directory.

beacon endpoint s3 validate

Write and describe a Beacon AWS S3 validation event.

​
Runtime log paths

​
beacon endpoint s3 print-config

beacon endpoint s3 print-config prints a smoke-test script. The script uses the AWS CLI to copy the current runtime and inventory logs, once, to <prefix>/runtime/smoke-tests/ and <prefix>/inventory/smoke-tests/ in your bucket. Use it to check bucket access and IAM before you set up continuous forwarding. For the Vector configuration, use install-pack.
Print the smoke-test script

​
Examples

Print the script for the default per-user Beacon install:
Print the script for the default per-user Beacon install
Print the script for a system-mode MDM deployment:
Print the script for a system-mode MDM deployment
Print the script for a custom runtime log:
Print the script for a custom runtime log

​
Flags

​
beacon endpoint s3 install-pack

beacon endpoint s3 install-pack writes AWS S3 forwarding content to a directory.
Generate the integration pack
The pack includes setup instructions, a one-shot AWS CLI smoke-test script, a Vector aws_s3 forwarding template, and sample Beacon endpoint events. The generated Vector template preserves each Beacon event’s canonical gen_ai.usage payload and also flattens token and runtime-reported cost fields to top-level JSON columns for downstream analytics: input_tokens, output_tokens, cache_read_input_tokens, cache_creation_input_tokens, reasoning_output_tokens, and cost_usd. The packaged macOS S3 forwarder that MDM deployments use doesn’t add these columns; its objects carry gen_ai.usage only.

​
Examples

Generate a content pack for the default per-user install:
Generate a content pack for the default per-user install
Generate a content pack for a system-mode deployment:
Generate a content pack for a system-mode deployment
Generate a content pack for a custom runtime log:
Generate a content pack for a custom runtime log

​
Flags

​
beacon endpoint s3 validate

beacon endpoint s3 validate writes a Beacon validation event to the runtime JSONL log and prints the expected AWS S3 validation fields and follow-up AWS CLI checks.
Run the validation check

​
Examples

Write a validation event for the default per-user install:
Write a validation event for the default per-user install
Write a validation event for a system-mode deployment:
Write a validation event for a system-mode deployment
Write a validation event to a custom runtime log:
Write a validation event to a custom runtime log
The validation command writes the local event only. The forwarder uploads in batches, so allow up to five minutes, then confirm delivery with AWS tooling. The event lands under runtime/:
Expected validation fields:

​
Flags

​
macOS MDM credential injection

For a managed macOS package, run /opt/beacon/jamf/claude/s3/repair-hooks-and-forwarder.sh from MDM or a root shell with destination settings in the environment. The helper writes non-secret forwarding settings and any set AWS provider-chain variables to /Library/Application Support/Beacon/Forwarders/s3-vector.env with mode 0600, then starts com.beacon.endpoint.s3-forwarder. Supported provider-chain variables include AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY, AWS_SESSION_TOKEN, AWS_PROFILE, AWS_SHARED_CREDENTIALS_FILE, AWS_CONFIG_FILE, AWS_WEB_IDENTITY_TOKEN_FILE, and AWS_ROLE_ARN. These values are not written to Beacon endpoint config or s3-vector.toml.

AWS S3 with Terraform

Create the bucket and write-only IAM user with Terraform.

Beacon with Fleet and S3

Fleet software install, self-updates, and Vector forwarding to S3.

Object storage forwarding

Configure Vector forwarding from Beacon JSONL into AWS S3.

Log forwarding

Review forwarding patterns and validation steps.

Endpoint agent

Install and inspect the local endpoint agent.

Endpoint event schema

Review normalized Beacon JSONL fields and example events.