AWS imagebuilder low security documentation change

Service: imagebuilder · 2025-10-01 · Security-related low

File: imagebuilder/latest/userguide/monitor-cwlogs.md

Summary

Updated CloudWatch logging documentation with clarified log retention/streaming behavior, pipeline execution logging details, and custom log group guidance.

Security assessment

The change explicitly states logs are removed from instances before image creation, preventing sensitive log data persistence. This addresses data sanitization security concerns. Enhanced logging documentation supports security auditing.

Diff

diff --git a/imagebuilder/latest/userguide/monitor-cwlogs.md b/imagebuilder/latest/userguide/monitor-cwlogs.md
index 3e7fac34f..567ce49c6 100644
--- a//imagebuilder/latest/userguide/monitor-cwlogs.md
+++ b//imagebuilder/latest/userguide/monitor-cwlogs.md
@@ -7 +7 @@
-CloudWatch Logs support is turned on by default. Logs are retained on the instance during the build process, and streamed to CloudWatch Logs. The instance logs are removed from the instance before image creation.
+CloudWatch Logs support is turned on by default. Image Builder retains build logs on the instance during the build process, then streams the logs to CloudWatch Logs when the build is complete. Before it creates the final build image, Image Builder removes local logs from the instance.
@@ -9 +9 @@ CloudWatch Logs support is turned on by default. Logs are retained on the instan
-Build logs are streamed to following the Image Builder CloudWatch Logs group and stream:
+**Image build logs**
@@ -11 +10,0 @@ Build logs are streamed to following the Image Builder CloudWatch Logs group and
-**LogGroup:**
@@ -12,0 +12 @@ Build logs are streamed to following the Image Builder CloudWatch Logs group and
+Image build logs contain the detailed logs for an individual image build. Image Builder writes image build logs to the following Image Builder CloudWatch Logs group and stream:
@@ -14 +14 @@ Build logs are streamed to following the Image Builder CloudWatch Logs group and
-    /aws/imagebuilder/ImageName
+**LogGroup:** `/aws/imagebuilder/`ImageName``
@@ -16 +16 @@ Build logs are streamed to following the Image Builder CloudWatch Logs group and
-**LogStream (x.x.x/x):**
+**LogStream (x.x.x/x):** ``ImageVersion/ImageBuildVersion``
@@ -17,0 +18 @@ Build logs are streamed to following the Image Builder CloudWatch Logs group and
+**Pipeline execution logs**
@@ -19 +19,0 @@ Build logs are streamed to following the Image Builder CloudWatch Logs group and
-    ImageVersion/ImageBuildVersion
@@ -21 +21 @@ Build logs are streamed to following the Image Builder CloudWatch Logs group and
-You can opt out of CloudWatch Logs streaming by removing the following permissions associated with the instance profile.
+Image Builder writes pipeline execution logs when an image pipeline runs or when a pipeline skips a regularly scheduled run, along with details about why that happened. For example, when dependency updates are configured for a scheduled pipeline, the following scenarios will have associated messaging:
@@ -22,0 +23 @@ You can opt out of CloudWatch Logs streaming by removing the following permissio
+  * Image Builder writes a log entry when it skips pipeline execution because there were no dependency updates.
@@ -24,11 +25,36 @@ You can opt out of CloudWatch Logs streaming by removing the following permissio
-    "Statement": [
-        {
-            "Effect": "Allow",
-            "Action": [
-                "logs:CreateLogStream",
-                "logs:CreateLogGroup",
-                "logs:PutLogEvents"
-            ],
-            "Resource": "arn:aws:logs:*:*:log-group:/aws/imagebuilder/*"
-        }
-    ]
+  * When there is a dependency update, Image Builder logs the ARN of the resource that changed.
+
+
+
+
+Image Builder writes pipeline execution logs to the following Image Builder CloudWatch Logs group and stream:
+
+**LogGroup:** `/aws/imagebuilder/pipeline/`pipeline-name``
+
+**LogStream:** ``2025/09/01`` (the pipeline execution date in YYYY/MM/DD format)
+
+Each pipeline log is appended to the stream for that day.
+
+**Custom log groups**
+    
+
+If you've specified custom log groups for image or pipeline logging, Image Builder writes the logs to the LogGroup that you've specified in your pipeline, or in one of the create image commands if you ran the build manually. For more information about how this works in Image Builder, see [Configure pipeline logging](./schedule-pipeline.html#configure-pipeline-logging).
+
+###### Opt out
+
+You can opt out of CloudWatch Logs streaming by removing the following permissions associated with the custom role that applies for your use case.
+
+  * logs:CreateLogGroup
+
+  * logs:CreateLogStream
+
+  * logs:PutLogEvents
+
+
+
+
+Log type |  Custom role  
+---|---  
+Image build |  Execution role  
+Pipeline execution |  Execution role  
+Component logs |  Instance profile role