Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

Logging that requires additional permissions [V2]

Some AWS services use a new method to send their logs. This is a flexible method that enables you to set up log delivery from these services to one or more of the following destinations: CloudWatch Logs, Amazon S3, or Firehose and X-Ray for trace delivery.

A working log delivery consists of three elements:

To configure logs delivery between a supported AWS service and a destination, you must do the following:

Log delivery setup examples

The following examples create the delivery source and delivery destination in the same AWS account. Replace the source resource ARN and log type with values supported by the service that generates the logs. These examples don't require a delivery destination policy.

Create a delivery source

Create the delivery source, and then use one of the destination examples that follow.

aws logs put-delivery-source \
    --name my-delivery-source \
    --resource-arn source-resource-arn \
    --log-type log-type

Create a delivery to CloudWatch Logs

Create a delivery destination for an existing log group.

aws logs put-delivery-destination \
    --name my-cwl-delivery-destination \
    --delivery-destination-configuration \
    "destinationResourceArn=arn:aws:logs:region:account-id:log-group:log-group-name"

Create the delivery.

aws logs create-delivery \
    --delivery-source-name my-delivery-source \
    --delivery-destination-arn arn:aws:logs:region:account-id:delivery-destination:my-cwl-delivery-destination

Create a delivery to Amazon S3

Create a delivery destination for an existing bucket.

aws logs put-delivery-destination \
    --name my-s3-delivery-destination \
    --delivery-destination-configuration \
    "destinationResourceArn=arn:aws:s3:::bucket-name"

Create the delivery.

aws logs create-delivery \
    --delivery-source-name my-delivery-source \
    --delivery-destination-arn arn:aws:logs:region:account-id:delivery-destination:my-s3-delivery-destination

To configure a destination prefix, suffix path, or Hive-compatible path, see Amazon S3 object key format.

Create a delivery to Firehose

Create a delivery destination for an existing DirectPut delivery stream.

aws logs put-delivery-destination \
    --name my-firehose-delivery-destination \
    --delivery-destination-configuration \
    "destinationResourceArn=arn:aws:firehose:region:account-id:deliverystream/delivery-stream-name"

Create the delivery.

aws logs create-delivery \
    --delivery-source-name my-delivery-source \
    --delivery-destination-arn arn:aws:logs:region:account-id:delivery-destination:my-firehose-delivery-destination

Create a delivery to X-Ray

For trace delivery, use a source service and log type that supports delivery to X-Ray. Create the logical X-Ray delivery destination.

aws logs put-delivery-destination \
    --name my-xray-delivery-destination \
    --delivery-destination-type XRAY

Create the delivery.

aws logs create-delivery \
    --delivery-source-name my-delivery-source \
    --delivery-destination-arn arn:aws:logs:region:account-id:delivery-destination:my-xray-delivery-destination

To verify the delivery, use the following command.

aws logs describe-deliveries \
    --delivery-source-name-prefix my-delivery-source

The following sections provide the details of the permissions you need to have when you are signed in to set up log delivery to each type of destination, using the V2 process. These permissions can be granted to an IAM role that you are signed in with.