AWS rtb-fabric documentation change
Summary
Updated logging documentation to use AWS vended logs instead of direct CloudWatch integration. Added support for multiple destinations (S3, CloudWatch Logs, Data Firehose), clarified prerequisites, updated CLI commands with standardized examples, and added validation details.
Security assessment
The changes enhance security documentation by detailing how to properly configure logging destinations for monitoring and auditing purposes. However, there's no evidence of a specific security vulnerability being addressed. The updates improve security posture by providing clearer guidance on log collection best practices.
Diff
diff --git a/rtb-fabric/latest/userguide/monitoring-cloudwatch-logs.md b/rtb-fabric/latest/userguide/monitoring-cloudwatch-logs.md index d826fdf58..a7c4a757b 100644 --- a//rtb-fabric/latest/userguide/monitoring-cloudwatch-logs.md +++ b//rtb-fabric/latest/userguide/monitoring-cloudwatch-logs.md @@ -7 +7 @@ -Log delivery setupLog delivery permissionsLog sampling +Configure log deliveryLog delivery permissionsLog sampling @@ -9 +9 @@ Log delivery setupLog delivery permissionsLog sampling -# Configuring RTB Fabric logs with Amazon CloudWatch Logs +# Logging RTB Fabric link activity using vended logs @@ -11 +11,20 @@ Log delivery setupLog delivery permissionsLog sampling -You can configure RTB Fabric to send application logs to Amazon CloudWatch Logs using log delivery. Logging is not enabled by default and requires setup. +AWS RTB Fabric publishes application logs as vended logs, an AWS-managed log-delivery pipeline. You can route the logs to: + + * _Amazon S3_ , for high-volume log retention and downstream analytics. + + * _Amazon CloudWatch Logs_ , for live querying with CloudWatch Logs Insights and CloudWatch alarms. + + * _Amazon Data Firehose_ , for streaming logs to downstream systems. + + + + +Choose the destination that fits your workload's retention, query, and cost requirements. + +For more information about vended logs, see [Enable logging from AWS services](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html) in the _Amazon CloudWatch Logs User Guide_. For pricing, see the _Vended Logs_ section on the [CloudWatch pricing page](https://aws.amazon.com/cloudwatch/pricing/). + +###### Prerequisites + +Vended-log records appear only when an active link is processing traffic. Before configuring delivery, set up a link and verify that requests reach it. For instructions, see [Testing and using links](./testing-and-using-links.html). + +The following topics describe how to set up vended-log delivery, grant the required permissions, and control log volume with sampling. @@ -15 +34 @@ You can configure RTB Fabric to send application logs to Amazon CloudWatch Logs - * Setting up log delivery for RTB Fabric + * Configure log delivery for RTB Fabric @@ -19 +38 @@ You can configure RTB Fabric to send application logs to Amazon CloudWatch Logs - * Configuring log sampling rates + * Configure log sampling rates @@ -24 +43 @@ You can configure RTB Fabric to send application logs to Amazon CloudWatch Logs -## Setting up log delivery for RTB Fabric +## Configure log delivery for RTB Fabric @@ -30 +49 @@ To enable logging for RTB Fabric, you need to create a log delivery source, dest - 1. Create a log delivery source for your link. The resource ARN must specify a link within a gateway: + 1. Register the link as a delivery source. The resource ARN must specify a link within a gateway. @@ -32,3 +51,3 @@ To enable logging for RTB Fabric, you need to create a log delivery source, dest - aws logs put-delivery-source \ - --name rtbfabric-delivery \ - --resource-arn arn:aws:rtbfabric:us-east-1:545746263314:gateway/rtb-gw-m8x4n2p9q7r5s1t6u3v8w0y2z/link/link-a9b7c5d3e1f4g8h2i6j0k4l7m \ + $ aws logs put-delivery-source \ + --name rtbfabric-delivery-source \ + --resource-arn arn:aws:rtbfabric:us-east-1:111122223333:gateway/rtb-gw-EXAMPLE1/link/link-EXAMPLE1 \ @@ -37 +56,5 @@ To enable logging for RTB Fabric, you need to create a log delivery source, dest - 2. Create a log delivery destination (such as an Amazon S3 bucket or CloudWatch log group). + 2. Create a delivery destination. The example below uses a CloudWatch Logs log group; you can also use an Amazon S3 bucket or an Amazon Data Firehose stream. + + $ aws logs put-delivery-destination \ + --name rtbfabric-delivery-destination \ + --delivery-destination-configuration "destinationResourceArn=arn:aws:logs:us-east-1:111122223333:log-group:/aws/vendedlogs/rtbfabric" @@ -39 +62 @@ To enable logging for RTB Fabric, you need to create a log delivery source, dest - 3. Create the delivery configuration to connect the source and destination. + 3. Create the delivery that ties the source to the destination. @@ -40,0 +64,3 @@ To enable logging for RTB Fabric, you need to create a log delivery source, dest + $ aws logs create-delivery \ + --delivery-source-name rtbfabric-delivery-source \ + --delivery-destination-arn arn:aws:logs:us-east-1:111122223333:delivery-destination:rtbfabric-delivery-destination @@ -44 +70,4 @@ To enable logging for RTB Fabric, you need to create a log delivery source, dest -For detailed information about log delivery setup, see [Configure standard logging](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/standard-logging.html) in the _Amazon CloudFront Developer Guide_ for a similar implementation pattern. + +For destination-specific setup, including Amazon S3 and Amazon Data Firehose targets, and for the underlying log-delivery model, see [Enable logging from AWS services](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html) in the _Amazon CloudWatch Logs User Guide_. + +After the delivery is created, CloudWatch Logs writes a single record to a stream named `log_stream_created_by_aws_to_validate_log_delivery_subscriptions` on the destination log group. This stream confirms that the delivery wiring, IAM permissions, and resource policy are valid. It does not confirm that RTB Fabric is emitting application records; for that, send traffic to the link and watch for additional streams to appear. @@ -71 +100 @@ Additionally, you need service-level permissions for the specific link resource: - "Resource": "arn:aws:rtbfabric:us-east-1:545746263314:gateway/rtb-gw-m8x4n2p9q7r5s1t6u3v8w0y2z/link/link-a9b7c5d3e1f4g8h2i6j0k4l7m" + "Resource": "arn:aws:rtbfabric:us-east-1:111122223333:gateway/rtb-gw-EXAMPLE1/link/link-EXAMPLE1" @@ -76 +105,3 @@ You can harden the resource permissions by specifying exact ARNs instead of usin -## Configuring log sampling rates +When you call `create-delivery` against a CloudWatch Logs log group, CloudWatch Logs attaches a resource policy to that log group automatically. The policy grants `delivery.logs.amazonaws.com` permission to write log events, scoped by a `SourceArn` condition that lists the link ARN. You do not need to author this policy. If you create a resource policy with the same name on the destination log group beforehand, the auto-managed policy can fail to attach. Let the service manage it. + +## Configure log sampling rates @@ -83,3 +114,3 @@ Example of setting log sampling rates when accepting a link: - aws rtbfabric accept-link \ - --link-id link-brhta7fllwkwlb3l7gbpofkn \ - --gateway-id rtb-gw-d43re9jdjmkw2r08e6psphe37 \ + $ aws rtbfabric accept-link \ + --link-id link-EXAMPLE1 \ + --gateway-id rtb-gw-EXAMPLE1 \ @@ -112 +143 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Monitoring with CloudWatch +Creating dashboards @@ -114 +145 @@ Monitoring with CloudWatch -RTB Fabric metrics +CloudTrail logs