AWS AmazonCloudWatch documentation change
Summary
Added new Example 4 demonstrating subscription filter integration with Amazon OpenSearch Service, including IAM role requirements and VPC access considerations.
Security assessment
The addition documents security configuration requirements (IAM policies and VPC access roles) for a new integration, but doesn't indicate resolution of a security vulnerability. It enhances security documentation for proper service configuration.
Diff
diff --git a/AmazonCloudWatch/latest/logs/SubscriptionFilters.md b/AmazonCloudWatch/latest/logs/SubscriptionFilters.md index 304550f9f..a74189417 100644 --- a/AmazonCloudWatch/latest/logs/SubscriptionFilters.md +++ b/AmazonCloudWatch/latest/logs/SubscriptionFilters.md @@ -5 +5 @@ -Example 1: Subscription filters with Kinesis Data StreamsExample 2: Subscription filters with AWS LambdaExample 3: Subscription filters with Amazon Data Firehose +Example 1: Subscription filters with Kinesis Data StreamsExample 2: Subscription filters with AWS LambdaExample 3: Subscription filters with Amazon Data FirehoseExample 4: Subscription filters with Amazon OpenSearch Service @@ -22,0 +23,2 @@ If you want to search your log data, see [Filter and pattern syntax](https://doc + * Example 4: Subscription filters with Amazon OpenSearch Service + @@ -612,0 +615,54 @@ The data in the Amazon S3 object is compressed with the gzip format. You can exa +## Example 4: Subscription filters with Amazon OpenSearch Service + +In this example, you'll create a CloudWatch Logs subscription that sends incoming log events that match your defined filters to your OpenSearch Service domain. + +###### To create a subscription filter for OpenSearch Service + + 1. Create an OpenSearch Service domain. For more information, see [ Creating OpenSearch Service domains](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createupdatedomains.html#createdomains) + + 2. Open the CloudWatch console at [https://console.aws.amazon.com/cloudwatch/](https://console.aws.amazon.com/cloudwatch/). + + 3. In the navigation pane, choose **Log groups**. + + 4. Select the name of the log group. + + 5. Choose **Actions** , **Subscription filters** , **Create Amazon OpenSearch Service subscription filter**. + + 6. Choose whether you want to stream to a cluster in this account or another account. + + * If you chose **This account** , select the domain that you created in step 1. + + * If you chose **Another account** , enter ARN and endpoint of that domain. + + 7. If you chose another account, provide the domain ARN and endpoint. + + 8. For **Lambda IAM Execution Role** , choose the IAM role that Lambda should use when executing calls to OpenSearch Service. The IAM role that you choose must fulfill these requirements: + + * It must have `lambda.amazonaws.com` in the trust relationship. + + * It must include the following policy: + + { + "Version": "2012-10-17", + "Statement": [{ + "Action": [ + "es:*" + ], + "Effect": "Allow", + "Resource": "arn:aws:es:region:account-id:domain/target-domain-name/*" + }] + } + + * If the target OpenSearch Service domain uses VPC accdess, the IAM role must also have the **AWSLambdaVPCAccessExecutionRole** policy attached. This Amazon-managed policy grants Lambda access to the customer's VPC, enabling Lambda to write to the OpenSearch endpoint in the VPC. + + 9. Choose a log format. + + 10. For **Subscription filter pattern** , enter the terms or pattern to find in your log events. This ensures that you send only the data that you're interested in to your OpenSearch Service cluster. For more information, see [Filter pattern syntax for metric filters](./FilterAndPatternSyntaxForMetricFilters.html). + + 11. (Optional) For **Select log data to test** , select a log stream and then choose **Test pattern** to verify that your search filter is returning the results you expect. + + 12. Choose **Start streaming**. + + + +