AWS pcs documentation change
Summary
Restructured documentation for scheduler logs configuration, consolidating console/CLI setup instructions and updating IAM policy requirements
Security assessment
The change adds explicit guidance about required IAM permissions (pcs:AllowVendedLogDeliveryForResource) and provides a sample policy, improving security documentation. However, there's no evidence this addresses a specific security vulnerability.
Diff
diff --git a/pcs/latest/userguide/monitoring_scheduler-logs.md b/pcs/latest/userguide/monitoring_scheduler-logs.md index 518893bcd..b463c0917 100644 --- a//pcs/latest/userguide/monitoring_scheduler-logs.md +++ b//pcs/latest/userguide/monitoring_scheduler-logs.md @@ -5 +5 @@ -PrerequisitesSetting up scheduler logs using the AWS PCS consoleSetting up scheduler logs using the AWS CLIScheduler log stream paths and namesExample AWS PCS scheduler log record +PrerequisitesSet up scheduler logsScheduler log stream paths and namesExample scheduler log record @@ -7 +7 @@ PrerequisitesSetting up scheduler logs using the AWS PCS consoleSetting up sched -# AWS PCS scheduler logs +# Scheduler logs in AWS PCS @@ -9 +9 @@ PrerequisitesSetting up scheduler logs using the AWS PCS consoleSetting up sched -You can configure AWS PCS to send detailed logging data from your cluster scheduler to Amazon CloudWatch Logs, Amazon Simple Storage Service (Amazon S3), and Amazon Data Firehose. This can assist with monitoring and troubleshooting. You can set up AWS PCS scheduler logs using the AWS PCS console, as well as programmatically using the AWS CLI or SDK. +You can configure AWS PCS to send detailed logging data from your cluster scheduler to Amazon CloudWatch Logs, Amazon Simple Storage Service (Amazon S3), and Amazon Data Firehose. This can assist with monitoring and troubleshooting. @@ -15,9 +15 @@ You can configure AWS PCS to send detailed logging data from your cluster schedu - * [Setting up scheduler logs using the AWS PCS console](./monitoring_scheduler-logs.html#monitoring_scheduler-logs_console) - - * [Setting up scheduler logs using the AWS CLI](./monitoring_scheduler-logs.html#monitoring_scheduler-logs_cli) - - * [Create a delivery destination](./monitoring_scheduler-logs.html#monitoring_scheduler-logs_cli_create-destination) - - * [Enable the AWS PCS cluster as a delivery source](./monitoring_scheduler-logs.html#monitoring_scheduler-logs_cli_enable-source) - - * [Connect the cluster delivery source to the delivery destination ](./monitoring_scheduler-logs.html#monitoring_scheduler-logs_cli_connect-dest) + * [Set up scheduler logs](./monitoring_scheduler-logs.html#monitoring_scheduler-logs_setup) @@ -27 +19 @@ You can configure AWS PCS to send detailed logging data from your cluster schedu - * [Example AWS PCS scheduler log record](./monitoring_scheduler-logs.html#monitoring_scheduler-logs_record) + * [Example scheduler log record](./monitoring_scheduler-logs.html#monitoring_scheduler-logs_record) @@ -34 +26,3 @@ You can configure AWS PCS to send detailed logging data from your cluster schedu -The IAM principal used to manage the AWS PCS cluster must allow `pcs:AllowVendedLogDeliveryForResource`. Here is a sample AWS IAM policy that enables it. +The IAM principal that manages the AWS PCS cluster must allow the `pcs:AllowVendedLogDeliveryForResource` action. + +The following example IAM policy grants the required permissions. @@ -51,20 +45 @@ The IAM principal used to manage the AWS PCS cluster must allow `pcs:AllowVended -## Setting up scheduler logs using the AWS PCS console - -To set up AWS PCS scheduler logs in the console, follow these steps: - - 1. Open the [AWS PCS console](https://console.aws.amazon.com/pcs). - - 2. Choose **Clusters** and navigate to the detail page for the AWS PCS cluster where you will enable logging. - - 3. Choose **Logs**. - - 4. Under **log deliveries – Scheduler Logs** – _optional_ - - 1. Add up to three log delivery destinations. Choices include CloudWatch Logs, Amazon S3, or Firehose. - - 2. Choose **Update log deliveries**. - - - - -You can reconfigure, add, or remove log deliveries by revisiting this page. +## Set up scheduler logs @@ -72 +47 @@ You can reconfigure, add, or remove log deliveries by revisiting this page. -## Setting up scheduler logs using the AWS CLI +You can set up scheduler logs for your AWS PCS cluster with the AWS Management Console or AWS CLI. @@ -74 +49 @@ You can reconfigure, add, or remove log deliveries by revisiting this page. -To accomplish this, you need at least one delivery destination, one delivery source (the PCS cluster), and one delivery, which is a relationship that connects a source to a destination. +AWS Management Console @@ -76 +50,0 @@ To accomplish this, you need at least one delivery destination, one delivery sou -### Create a delivery destination @@ -78 +52 @@ To accomplish this, you need at least one delivery destination, one delivery sou -You need at least one delivery destination to receive scheduler logs from an AWS PCS cluster. You can learn more about this topic in the PutDeliveryDestination section of the CloudWatch API User Guide. +###### To set up scheduler logs with the console @@ -80,3 +54 @@ You need at least one delivery destination to receive scheduler logs from an AWS -###### To create a delivery destination using the AWS CLI - - * Create a destination with the command that follows. Before running the command, make the following replacements: + 1. Open the [AWS PCS console](https://console.aws.amazon.com/pcs). @@ -84 +56 @@ You need at least one delivery destination to receive scheduler logs from an AWS - * Replace `region-code` with the AWS Region where you will create your destination. This will generally be the same region as where the AWS PCS cluster is deployed. + 2. In the navigation pane, choose **Clusters**. @@ -86 +58 @@ You need at least one delivery destination to receive scheduler logs from an AWS - * Replace `pcs-logs-destination` with your preferred name. It must be unique for all delivery destinations in your account. + 3. Choose the cluster where you want to add scheduler logs. @@ -88 +60 @@ You need at least one delivery destination to receive scheduler logs from an AWS - * Replace `resource-arn` with the ARN for an existing log group in CloudWatch Logs, an S3 bucket, or a delivery stream in Firehose. Examples include: + 4. On the cluster details page, choose the **Logs** tab. @@ -90 +62 @@ You need at least one delivery destination to receive scheduler logs from an AWS - * **CloudWatch Logs group** + 5. Under **Scheduler Logs** , choose **Add** to add up to 3 log delivery destinations from among CloudWatch Logs, Amazon S3, and Firehose. @@ -92 +64 @@ You need at least one delivery destination to receive scheduler logs from an AWS - arn:aws:logs:region-code:account-id:log-group:/log-group-name:* + 6. Choose **Update log deliveries**. @@ -94 +65,0 @@ You need at least one delivery destination to receive scheduler logs from an AWS - * **S3 bucket** @@ -96 +66,0 @@ You need at least one delivery destination to receive scheduler logs from an AWS - arn:aws:s3:::bucket-name @@ -98 +67,0 @@ You need at least one delivery destination to receive scheduler logs from an AWS - * **Firehose delivery stream** @@ -100 +69 @@ You need at least one delivery destination to receive scheduler logs from an AWS - arn:aws:firehose:region-code:account-id:deliverystream/stream-name +AWS CLI @@ -102,0 +72 @@ You need at least one delivery destination to receive scheduler logs from an AWS +###### To set up scheduler logs with the AWS CLI @@ -103,0 +74 @@ You need at least one delivery destination to receive scheduler logs from an AWS + 1. Create a log delivery destination: @@ -105,2 +76 @@ You need at least one delivery destination to receive scheduler logs from an AWS - - aws logs put-delivery-destination --region region-code \ + aws logs put-delivery-destination --region region \ @@ -108,11 +78,2 @@ You need at least one delivery destination to receive scheduler logs from an AWS - --delivery-destination-configuration destinationResourceArn=resource-arn - -Take note of the ARN for the new delivery destination, since you will need it to configure deliveries. - -### Enable the AWS PCS cluster as a delivery source - -To collect scheduler logs from AWS PCS, configure the cluster as a delivery source. For more information, see [PutDeliverySource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDeliverySource.html) in the _Amazon CloudWatch Logs API Reference_. - -###### To configure a cluster as a delivery source using the AWS CLI - - * Enable logs delivery from your cluster with the command that follows. Before running the command, make the following replacements: + --delivery-destination-configuration \ + destinationResourceArn=resource-arn @@ -120 +81 @@ To collect scheduler logs from AWS PCS, configure the cluster as a delivery sour - * Replace `region-code` with the AWS Region where your cluster is deployed. +Replace: @@ -122 +83 @@ To collect scheduler logs from AWS PCS, configure the cluster as a delivery sour - * Replace `cluster-logs-source-name` with a name for this source. It must be unique for all delivery sources in your AWS account. Consider incorporating the name or ID of the AWS PCS cluster. + * `region` — The AWS Region where you want to create the destination, such as `us-east-1` @@ -124 +85 @@ To collect scheduler logs from AWS PCS, configure the cluster as a delivery sour - * Replace `cluster-arn` with the ARN for your AWS PCS cluster + * `pcs-logs-destination` — A name for the destination @@ -125,0 +87 @@ To collect scheduler logs from AWS PCS, configure the cluster as a delivery sour + * `resource-arn` — The Amazon Resource Name (ARN) of a CloudWatch Logs log group, S3 bucket, or Firehose delivery stream. @@ -126,0 +89 @@ To collect scheduler logs from AWS PCS, configure the cluster as a delivery sour +For more information, see [PutDeliveryDestination](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDeliveryDestination.html) in the _Amazon CloudWatch Logs API Reference_. @@ -127,0 +91 @@ To collect scheduler logs from AWS PCS, configure the cluster as a delivery sour + 2. Set the PCS cluster as a log delivery source: @@ -129,3 +93 @@ To collect scheduler logs from AWS PCS, configure the cluster as a delivery sour - - aws logs put-delivery-source \ - --region region-code \ + aws logs put-delivery-source --region region \ @@ -136 +98 @@ To collect scheduler logs from AWS PCS, configure the cluster as a delivery sour -### Connect the cluster delivery source to the delivery destination +Replace: @@ -138 +100 @@ To collect scheduler logs from AWS PCS, configure the cluster as a delivery sour -For scheduler log data to flow from the cluster to the destination, you must configure a delivery that connects them. For more information, see [CreateDelivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateDelivery.html) in the _Amazon CloudWatch Logs API Reference_. + * `region` — The AWS Region of your cluster, such as `us-east-1` @@ -140 +102 @@ For scheduler log data to flow from the cluster to the destination, you must con -###### To create a delivery using the AWS CLI + * `cluster-logs-source-name` — A name for the source @@ -142 +104 @@ For scheduler log data to flow from the cluster to the destination, you must con - * Create a delivery using the command that follows. Before running the command, make the following replacements: + * `cluster-arn` — the ARN of your AWS PCS cluster @@ -144 +106 @@ For scheduler log data to flow from the cluster to the destination, you must con - * Replace `region-code` with the AWS Region where your source and destination exist. +For more information, see [PutDeliverySource](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutDeliverySource.html) in the _Amazon CloudWatch Logs API Reference_. @@ -146 +108 @@ For scheduler log data to flow from the cluster to the destination, you must con - * Replace `cluster-logs-source-name` with the name of your delivery source from above. + 3. Connect the delivery source to the delivery destination: @@ -148 +110,3 @@ For scheduler log data to flow from the cluster to the destination, you must con - * Replace `destination-arn` with the ARN from a delivery destination where you want logs to be delivered. + aws logs create-delivery --region region \ + --delivery-source-name cluster-logs-source \ + --delivery-destination-arn destination-arn @@ -149,0 +114 @@ For scheduler log data to flow from the cluster to the destination, you must con +Replace: @@ -150,0 +116,7 @@ For scheduler log data to flow from the cluster to the destination, you must con + * `region` — The AWS Region, such as `us-east-1` + + * `cluster-logs-source` — The name of your delivery source + + * `destination-arn` — The ARN of your delivery destination + +For more information, see [CreateDelivery](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateDelivery.html) in the _Amazon CloudWatch Logs API Reference_. @@ -154,4 +125,0 @@ For scheduler log data to flow from the cluster to the destination, you must con - aws logs create-delivery \ - --region region-code \ - --delivery-source-name cluster-logs-source \ - --delivery-destination-arn destination-arn @@ -194 +162 @@ The path and name for AWS PCS scheduler logs depend on the destination type. -## Example AWS PCS scheduler log record +## Example scheduler log record @@ -218 +186 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Logging and monitoring +Job completion logs