Diagram of how it works

[nitrocode]

It would be nice to see how the org mode differs from the standalone

High level explanation helps too

1. Cloudtrail pushes to s3
2. S3 has an object notification to sns topic
3. Sns topic sends messages to sqs
4. Sqs has a policy to allow the sns topic to send messages to it
5. Lambda triggers off of a cloudwatch log group
6. Lambda takes messages from sqs