AWS msk documentation change
Summary
Modified broker logging availability and clarified dynamic log level settings are only available for Standard brokers
Security assessment
The change documents expanded logging capabilities (now available on Express brokers) and clarifies operational constraints for DEBUG/TRACE logging. Logging is a security feature for monitoring, but no specific vulnerability is addressed.
Diff
diff --git a/msk/latest/developerguide/msk-logging.md b/msk/latest/developerguide/msk-logging.md index 24c59f607..59163b79e 100644 --- a//msk/latest/developerguide/msk-logging.md +++ b//msk/latest/developerguide/msk-logging.md @@ -13 +13 @@ You can deliver Apache Kafka broker logs to one or more of the following destina -Broker logs are not available on Express brokers. +Broker logs are available on both MSK Standard and Express brokers. @@ -98 +98 @@ You can specify the optional `loggingInfo` structure in the JSON that you pass t -By default, when broker logging is enabled, Amazon MSK logs `INFO` level logs to the specified destinations. However, users of Apache Kafka 2.4.X and later can dynamically set the broker log level to any of the [log4j log levels](https://logging.apache.org/log4j/1.2/apidocs/org/apache/log4j/Level.html). For information about dynamically setting the broker log level, see [ KIP-412: Extend Admin API to support dynamic application log levels](https://cwiki.apache.org/confluence/display/KAFKA/KIP-412%3A+Extend+Admin+API+to+support+dynamic+application+log+levels). If you dynamically set the log level to `DEBUG` or `TRACE`, we recommend using Amazon S3 or Firehose as the log destination. If you use CloudWatch Logs as a log destination and you dynamically enable `DEBUG` or `TRACE` level logging, Amazon MSK may continuously deliver a sample of logs. This can significantly impact broker performance and should only be used when the `INFO` log level is not verbose enough to determine the root cause of an issue. +By default, when broker logging is enabled, Amazon MSK logs `INFO` level logs to the specified destinations. However for Standard brokers, users of Apache Kafka 2.4.X and later can dynamically set the broker log level to any of the [log4j log levels](https://logging.apache.org/log4j/1.2/apidocs/org/apache/log4j/Level.html). For information about dynamically setting the broker log level, see [ KIP-412: Extend Admin API to support dynamic application log levels](https://cwiki.apache.org/confluence/display/KAFKA/KIP-412%3A+Extend+Admin+API+to+support+dynamic+application+log+levels). If you dynamically set the log level to `DEBUG` or `TRACE`, we recommend using Amazon S3 or Firehose as the log destination. If you use CloudWatch Logs as a log destination and you dynamically enable `DEBUG` or `TRACE` level logging, Amazon MSK may continuously deliver a sample of logs. This can significantly impact broker performance and should only be used when the `INFO` log level is not verbose enough to determine the root cause of an issue.