AWS AmazonCloudWatch documentation change
Summary
Restructured service quotas documentation into a standardized table format with columns for Name, Default, Adjustable, and Description. Added throttle limits for multiple API operations and clarified adjustable quotas with service quota links.
Security assessment
The changes primarily reorganize existing quota information and add operational throttle limits for API calls. While some API operations like AssociateKmsKey relate to security features, the documentation changes only specify throttle limits rather than introducing new security capabilities or addressing vulnerabilities. No concrete evidence of security vulnerability fixes or new security guidance is present.
Diff
diff --git a/AmazonCloudWatch/latest/logs/cloudwatch_limits_cwl.md b/AmazonCloudWatch/latest/logs/cloudwatch_limits_cwl.md index 74cfa9397..ec71d9ac1 100644 --- a//AmazonCloudWatch/latest/logs/cloudwatch_limits_cwl.md +++ b//AmazonCloudWatch/latest/logs/cloudwatch_limits_cwl.md @@ -15,57 +15,52 @@ If you want to request a quota increase for any of these quotas, see [the proced -Resource | Default quota ----|--- -Account-level policies | One account-level subscription filter policy per Region per account. One account-level data protection policy per Region per account. 20 account-level field index policies per account. The log group name prefixes that they apply to can't overlap. These quotas can't be changed. -Anomaly detectors | 500 anomaly detectors per account. You can request a quota increase. -Batch size | The maximum batch size is 1,048,576 bytes. This size is calculated as the sum of all event messages in UTF-8, plus 26 bytes for each log event. This quota can't be changed. -Data archiving | Up to 5 GB of data archiving for free. This quota can't be changed. -[CreateLogGroup](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateLogGroup.html) | 10 transactions per second (TPS/account/Region), after which transactions are throttled. You can request a quota increase. -[CreateLogStream](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_CreateLogStream.html) | 50 transactions per second (TPS/account/Region), after which transactions are throttled. You can request a quota increase. -Custom data identifiers | Each data protection policy can include up to 10 custom data identifiers. You can request a quota increase. Each regular expression that defines a custom data identifier can include up to 200 characters. This quota can't be changed. -[DeleteLogGroup](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteLogGroup.html) | 10 transactions per second (TPS/account/Region), after which transactions are throttled. You can request a quota increase. -[DeleteLogStream](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DeleteLogStream.html) | 15 transactions per second (TPS/account/Region), after which transactions are throttled. You can request a quota increase. -[DescribeLogGroups](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogGroups.html) | 10 transactions per second (TPS/account/Region). You can request a quota increase. -[DescribeLogStreams](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_DescribeLogStreams.html) | 25 transactions per second (TPS/account/Region). You can request a quota increase. -Discovered log fields | CloudWatch Logs Insights can discover a maximum of 1000 log event fields in a log group. This quota can't be changed. For more information, see [Supported logs and discovered fields](./CWL_AnalyzeLogData-discoverable-fields.html). -Extracted log fields in JSON logs | CloudWatch Logs Insights can extract a maximum of 200 log event fields from a JSON log. This quota can't be changed. For more information, see [Supported logs and discovered fields](./CWL_AnalyzeLogData-discoverable-fields.html). -Export task | One active (running or pending) export task at a time, per account. This quota can't be changed. -Field indexes | As many as 20 indexed fields per policy. This quota can't be changed. -[FilterLogEvents](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_FilterLogEvents.html) | 25 requests per second in US East (N. Virginia). 5 requests per second in the following Regions: - - * Asia Pacific (Jakarta) - * Asia Pacific (Osaka) - * Europe (Frankfurt) - * Canada West (Calgary) - * Israel (Tel Aviv) - -10 requests per second in other Regions. This quota can't be changed. -[GetLogEvents](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_GetLogEvents.html) | 30 requests per second in Europe (Paris). 10 requests per second in the following Regions: - - * US West (Oregon) - * Asia Pacific (Jakarta) - * Asia Pacific (Osaka) - * Canada West (Calgary) - * Europe (Ireland) - * Europe (Frankfurt) - * Israel (Tel Aviv) - -25 requests per second in all other Regions. This quota can't be changed. We recommend subscriptions if you are continuously processing new data. If you need historical data, we recommend exporting your data to Amazon S3. -Incoming data | Up to 5 GB of incoming data for free. This quota can't be changed. -Live Tail concurrent sessions. | 15 concurrent sessions. You can request a quota increase. -Live Tail: log groups searched in one session. | Maximum of 10 log groups scanned in one Live Tail session. This quota can't be changed. -Log event size | 1 MB (maximum). This quota can't be changed. -Log groups | 1,000,000 log groups per account per Region. You can request a quota increase. There is no quota on the number of log streams that can belong to one log group. -Metrics filters | 100 per log group. This quota can't be changed. -Embedded metric format metrics | 100 metrics per log event and 30 dimensions per metric. For more information about the embedded metric format, see [Specification: Embedded Metric Format](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch_Embedded_Metric_Format_Specification.html) in the Amazon CloudWatch User Guide. -[PutLogEvents](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutLogEvents.html) | The maximum batch size of a PutLogEvents request is 1MB. This size is calculated as the sum of all event messages in UTF-8, plus 26 bytes for each log event. 5000 transactions per second per account per Region You can request an increase to the per-second throttling quota by using the Service Quotas service. -Query execution timeout | Queries in CloudWatch Logs Insights time out after 60 minutes. This time limit can't be changed. -Queried log groups | A maximum of 50 log groups can be queried in a single CloudWatch Logs Insights query, when you specify log groups individually. This quota can't be changed. If you use log group criteria to choose log groups based on their name prefixes, or select to query "all log groups", you can query up to 10,000 log groups in a single query. -Query concurrency | For Standard class log groups, a maximum of 30 concurrent CloudWatch Logs Insights queries, including queries that have been added to dashboards. This maximum of 30 applies to the total number of concurrent queries, no matter the query language used. Only 15 of these concurrent queries can be in OpenSearch Service PPL and/or OpenSearch Service SQL. For Infrequent Access class log groups, a maximum of 5 concurrent CloudWatch Logs Insights queries, including queries that have been added to dashboards. These quotas can't be changed. -Queries generated from natural language | As many as five concurrent natural-language generated query requests. -Query availability | Queries constructed in the console are available for 30 days, via the **History** command. This availability period can't be changed. Query definitions created by using [PutQueryDefinition](https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutQueryDefinition.html) do not expire. -Query results availability | Results from a query are retrievable for 7 days. This availability time can't be changed. -Query results displayed in console | Up to to 10,000 rows of query results are displayed on the console. -Regular expressions | Up to 5 filter patterns containing regular expressions for each log group when creating metric filters or subscription filters. This quota can't be changed. Up to 2 regular expressions for each filter pattern, when creating a delimited or JSON filter pattern for metric filters and subscription filters or when filtering log events. -Resource policies | Up to 10 CloudWatch Logs resource policies per Region per account. This quota can't be changed. -Saved queries | You can save as many as 1000 CloudWatch Logs Insights queries, per Region per account. This quota can't be changed. -Subscription filters | 2 per log group. This quota can't be changed. -Transformers | A log transformer can have a maximum of 5 parser-type processors. It can have a maximum of 20 processors overall. Each log group can have only one log-group level transformer. Each account can have as many as 20 account-level transformers. None of these transformers can apply to identical or overlapping log group prefixes. None of these quotas can be changed. +Name | Default | Adjustable | Description +---|---|---|--- +Active export task | Each supported Region: 1 | No | The number of active (running or pending) export tasks per account +AssociateKmsKey throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of associate-kms-key calls per second per account/per region +Batch size | Each supported Region: 1 Megabytes | No | The maximum batch size in MB of a put-log-events request +CancelExportTask throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of cancel-export-task calls per second per account/per region +CreateExportTask throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of create-export-task calls per second per account/per region +CreateLogGroup throttle limit in transactions per second | Each supported Region: 10 per second | [Yes](https://console.aws.amazon.com/servicequotas/home/services/logs/quotas/L-D2832119) | The maximum number of create-log-group calls per second per account/per region +CreateLogStream throttle limit in transactions per second | Each supported Region: 50 per second | [Yes](https://console.aws.amazon.com/servicequotas/home/services/logs/quotas/L-76507CEF) | The maximum number of create-log-stream calls per second per account/per region +Data archiving | Each supported Region: 5 Gigabytes | No | The maximum size in GB of free data archiving +DeleteDestination throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of delete-destination calls per second per account/per region +DeleteLogGroup throttle limit in transactions per second | Each supported Region: 10 per second | [Yes](https://console.aws.amazon.com/servicequotas/home/services/logs/quotas/L-07A912D5) | The maximum number of delete-log-group calls per second per account/per region +DeleteLogStream throttle limit in transactions per second | Each supported Region: 15 per second | [Yes](https://console.aws.amazon.com/servicequotas/home/services/logs/quotas/L-C029A21C) | The maximum number of delete-log-stream calls per second per account/per region +DeleteMetricFilter throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of delete-metric-filter calls per second per account/per region +DeleteRetentionPolicy throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of delete-retention-policy calls per second per account/per region +DeleteSubscriptionFilter throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of delete-subscription-filter calls per second per account/per region +DeleteTransformer throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of delete-transformer calls per second per account/per region +DescribeDestinations throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of describe-destinations calls per second per account/per region +DescribeExportTasks throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of describe-export-tasks calls per second per account/per region +DescribeLogGroups throttle limit in transactions per second | Each supported Region: 10 per second | [Yes](https://console.aws.amazon.com/servicequotas/home/services/logs/quotas/L-4284EEDE) | The maximum number of describe-log-groups calls per second per account/per region +DescribeLogStreams throttle limit in transactions per second | Each supported Region: 25 per second | [Yes](https://console.aws.amazon.com/servicequotas/home/services/logs/quotas/L-3F243AD0) | The maximum number of describe-log-streams calls per second per account/per region +DescribeMetricFilters throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of describe-metric-filters calls per second per account/per region +DescribeSubscriptionFilters throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of describe-subscription-filters calls per second per account/per region +Event size | Each supported Region: 1,024 Kilobytes | No | The maximum log event size in KB +FilterLogEvents throttle limit in transactions per second | us-east-1: 25 per second ap-northeast-3: 5 per second ap-southeast-3: 5 per second eu-central-1: 5 per second Each of the other supported Regions: 10 per second | No | The maximum number of filter-log-events calls per second per account/per region +GetLogEvents throttle limit in transactions per second | us-west-2: 10 per second ap-northeast-3: 10 per second ap-southeast-3: 10 per second eu-central-1: 10 per second eu-west-1: 10 per second eu-west-3: 30 per second Each of the other supported Regions: 25 per second | No | The maximum number of get-log-events calls per second per account/per region +GetQueryResults throttle limit in transactions per second | Each supported Region: 5 | No | The maximum number of get-query-results calls per second per account/per region +GetTransformer throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of get-transformer calls per second per account/per region +ListTagsForResource throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of list-tags-for-resource calls per second per account/per region +ListTagsLogGroup throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of list-tags-log-group calls per second per account/per region +Live Tail concurrent sessions limit | Each supported Region: 15 | [Yes](https://console.aws.amazon.com/servicequotas/home/services/logs/quotas/L-D6990B80) | The maximum number of concurrent active Live Tail sessions per account +Log groups | Each supported Region: 1,000,000 | [Yes](https://console.aws.amazon.com/servicequotas/home/services/logs/quotas/L-C7B9AAAB) | The maximum number of log groups an account can have +Log groups scanned per Live Tail session | Each supported Region: 10 | No | The maximum number of log groups that can be scanned per Live Tail session +Metrics filters per log group | Each supported Region: 100 | No | The number of metric filters per log group +PutDestination throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of put-destination calls per second per account/per region +PutDestinationPolicy throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of put-destination-policy calls per second per account/per region +PutLogEvents throttle limit in transactions per second | Each supported Region: 5,000 per second | [Yes](https://console.aws.amazon.com/servicequotas/home/services/logs/quotas/L-7E1FAE88) | The maximum number of put-log-events calls per second per account/per region +PutMetricFilter throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of put-metric-filter calls per second per account/per region +PutRetentionPolicy throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of put-retention-policy calls per second per account/per region +PutSubscriptionFilter throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of put-subscription-filter calls per second per account/per region +PutTransformer throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of put-transformer calls per second per account/per region +Resource policies | Each supported Region: 10 | No | The maximum number of resource policies per account/per region +StartLiveTail throttle limit in transactions per second | Each supported Region: 5 | No | The maximum number of start-live-tail calls per second per account/per region. This limit applies independently to both console and API +StartQuery throttle limit in transactions per second | Each supported Region: 5 | No | The maximum number of start-query calls per second per account/per region +Subscription filters per log group | Each supported Region: 2 | No | The number of subscription filters per log group +TagLogGroup throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of tag-log-group calls per second per account/per region +TagResource throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of tag-resource calls per second per account/per region +TestMetricFilter throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of test-metric-filter calls per second per account/per region +TestTransformer throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of test-transformer calls per second per account/per region +UntagLogGroup throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of untag-log-group calls per second per account/per region +UntagResource throttle limit in transactions per second | Each supported Region: 5 per second | No | The maximum number of untag-resource calls per second per account/per region +logs anomaly detectors | Each supported Region: 500 | [Yes](https://console.aws.amazon.com/servicequotas/home/services/logs/quotas/L-B53B9649) | The maximum number of active log anomaly detectors