Interface ICloudWatchLogsConfig

IGlobalConfig / ILoggingConfig / ICloudWatchLogsConfig

Description

Accelerator global CloudWatch Logs logging configuration

Remarks

You can decide to use AWS KMS CMK or server-side encryption for the log data at rest. When this encryption property is undefined, the solution will deploy AWS KMS CMK to encrypt AWS CloudWatch log data at rest. You can use deploymentTargets to control target accounts and regions for the given useCMK configuration. please see here or here for more information.

Please review CloudWatch Logs managed data identifiers for sensitive data types for more information.

Example

cloudwatchLogs:
  dynamicPartitioning: path/to/filter.json
  # default is true, if undefined this is set to true
  # if set to false, no replication is performed which is useful in test or temporary environments
  enable: true
  encryption:
    useCMK: true
    deploymentTargets:
      organizationalUnits:
        - Root
  replaceLogDestinationArn: arn:aws:logs:us-east-1:111111111111:destination:ReplaceDestination
  exclusions:
   # in these OUs do not do log replication
   - organizationalUnits:
       - Research
       - ProofOfConcept
     excludeAll: true
   # in these accounts exclude pattern testApp
   - accounts:
       - WorkloadAccount1
       - WorkloadAccount1
     logGroupNames:
       - testApp*
   # in these accounts exclude logs in specific regions
   - accounts:
       - WorkloadAccount1
       - WorkloadAccount1
     regions:
       - us-west-2
       - eu-west-1
     logGroupNames:
       - pattern1*
  dataProtection:
    managedDataIdentifiers:
      categories:
        - Credentials
    deploymentTargets:
      organizationalUnits:
        - Root
interface ICloudWatchLogsConfig {
    dataProtection?: ICloudWatchDataProtectionConfig;
    dynamicPartitioning?: string;
    dynamicPartitioningByAccountId?: boolean;
    enable?: boolean;
    encryption?: IServiceEncryptionConfig;
    exclusions?: ICloudWatchLogsExclusionConfig[];
    firehose?: ICloudWatchFirehoseConfig;
    kinesis?: ICloudWatchKinesisConfig;
    organizationIdConditionSupported?: boolean;
    replaceLogDestinationArn?: string;
    skipBulkUpdate?: ICloudWatchLogSkipBulkUpdateConfig;
    subscription?: ICloudWatchSubscriptionConfig;
}

Properties

dataProtection? dynamicPartitioning? dynamicPartitioningByAccountId? enable? encryption? exclusions? firehose? kinesis? organizationIdConditionSupported? replaceLogDestinationArn? skipBulkUpdate? subscription?

Properties

Optional ReadonlydataProtection

dataProtection?: ICloudWatchDataProtectionConfig

CloudWatch Log data protection configuration

Optional ReadonlydynamicPartitioning

dynamicPartitioning?: string

Declaration of Dynamic Partition for Kinesis Firehose.

Remarks

Kinesis firehose Dynamic Partition allows streaming Cloudwatch logs data to be assigned to a specific prefix. The input provided here is the path to log filter JSON file array. More details in the link: https://docs.aws.amazon.com/solutions/latest/landing-zone-accelerator-on-aws/centralized-logging.html Each item in the array is of the format

{ "logGroupPattern": "LogGroupName", "s3Prefix": "s3-prefix" }

The logs end up in central logs bucket under prefix CloudWatchLogs. In the above example, the log group with LogGroupName will stream to s3://<central-logs-bucket>/CloudWatchLogs/s3-prefix/

It is possible to use * for grouping log groups into same prefix. So, in the example below:

[{ "logGroupPattern": "Application*", "s3Prefix": "app" }]

The above will take log groups with name ApplicationA, ApplicationB, ApplicationC into s3 prefix app. Please make sure that logGroupPattern do not conflict each other as the logs are streamed to one destination and not replicated. For example, extending the above example to below

[{ "logGroupPattern": "Application*", "s3Prefix": "app" }, { "logGroupPattern": "App*", "s3Prefix": "apple" }]

In the above case, logs from ApplicationA can either end up in app or apple. They will not be replicated to both prefixes.

For more information on Kinesis Firehose dynamic partitioning limits please refer to:: https://docs.aws.amazon.com/firehose/latest/dev/limits.html

Optional ReadonlydynamicPartitioningByAccountId

dynamicPartitioningByAccountId?: boolean

Declaration of Dynamic Partitioning for Kinesis Firehose by Account ID.

Remarks

Kinesis firehose Dynamic Partition by Account ID will add the Account ID that produced the CloudWatch Logs to the partitioning strategy of logs. For example: s3://<central-logs-bucket>/CloudWatchLogs/<account id>/

If dynamicPartitioning is also being used the Account ID partition will come before the supplied s3 prefix. For example a dynamicPartitioning file with the format

{ "logGroupPattern": "LogGroupName", "s3Prefix": "s3-prefix" }

The resulting partitioning strategy would be s3://<central-logs-bucket>/CloudWatchLogs/<account id>/s3-prefix/

For more information on Kinesis Firehose dynamic partitioning limits please refer to:: https://docs.aws.amazon.com/firehose/latest/dev/limits.html

Optional Readonlyenable

enable?: boolean

Enable or disable CloudWatch replication

Optional Readonlyencryption

encryption?: IServiceEncryptionConfig

Encryption setting for AWS CloudWatch log group data.

Remarks

For more information please refer ServiceEncryptionConfig

Optional Readonlyexclusions

exclusions?: ICloudWatchLogsExclusionConfig[]

Exclude Log Groups during replication

Optional Readonlyfirehose

firehose?: ICloudWatchFirehoseConfig

CloudWatch Logs Firehose configuration.

See

ICloudWatchFirehoseConfig for more information.

Optional Readonlykinesis

kinesis?: ICloudWatchKinesisConfig

CloudWatch Logs Kinesis configuration.

See

ICloudWatchKinesisConfig for more information.

Optional ReadonlyorganizationIdConditionSupported

organizationIdConditionSupported?: boolean

Determines if a list of account ids is used instead of a principal organization condition in the CloudWatch Logs destination access policy. This is useful in partitions where the principal organization condition is not supported.

Optional ReadonlyreplaceLogDestinationArn

replaceLogDestinationArn?: string

Customer defined log subscription filter destination arn, that is associated with with the existing log group. Accelerator solution needs to disassociate this destination before configuring solution defined subscription filter destination.

Default

undefined

Remarks

When no value provided, accelerator solution will not attempt to remove existing customer defined log subscription filter destination. When existing log group(s) have two subscription filter destinations defined, and none of that is solution configured subscription filter destination, then solution will fail to configure log replication for such log groups and as a result pipeline will fail.

Optional ReadonlyskipBulkUpdate

skipBulkUpdate?: ICloudWatchLogSkipBulkUpdateConfig

Used to skip the bulk update of CloudWatch logs settings in the LZA pipeline

Default

undefined

Remarks

This option is used to skip bulk update of cloudwatch log groups in the LZA pipeline WARNING: This configuration option could cause CloudWatch log group configurations to become out of sync with the global configuration. Only enable this option if you fully understand the implications.

Optional Readonlysubscription

subscription?: ICloudWatchSubscriptionConfig

CloudWatch Logs subscription configuration.

Settings

Member Visibility

On This Page

Properties