AWS firehose: Clarify S3 backup error log stream routing by S3BackupMode
Summary
Documents which CloudWatch Logs stream (BackupDelivery vs DestinationDelivery) receives S3 backup delivery errors depending on the S3BackupMode setting, with an HTTP endpoint example.
Security assessment
The change clarifies where delivery errors (including S3.AccessDenied) are logged based on S3BackupMode. It improves observability/audit accuracy but does not fix a vulnerability or document a security feature.
Evidence
+If you enable Amazon Data Firehose error logging in the Amazon Data Firehose console, a log group and corresponding log streams are created for the Firehose stream on your behalf. The format of the log group name is `/aws/kinesisfirehose/`delivery-stream-name``, where ``delivery-stream-name`` is the name of the corresponding Firehose stream. `DestinationDelivery` is the log stream that is created and used to log any errors related to the delivery to the primary destination. Another log stream called `BackupDelivery` is created only if S3 backup is enabled for the destination. However, which log stream receives S3 backup delivery errors depends on the `S3BackupMode` setting of the Firehose stream. When the `S3BackupMode` setting is `AllData` (or `Enabled` for Amazon Redshift), S3 backup delivery errors are logged to the `BackupDelivery` log stream. When the `S3BackupMode` setting is `FailedDataOnly`, S3 backup delivery errors (for example, `S3.AccessDenied`) are logged to the `DestinationDelivery` log stream along with the primary destination errors. They are not logged to the `BackupDelivery` log stream. The `FailedDataOnly` setting is available for the HTTP endpoint, Splunk, OpenSearch, Snowflake, and Iceberg destinations.
Diff
diff --git a/firehose/latest/dev/monitoring-with-cloudwatch-logs.md b/firehose/latest/dev/monitoring-with-cloudwatch-logs.md index ad43e1a53..f621f5ab4 100644 --- a//firehose/latest/dev/monitoring-with-cloudwatch-logs.md +++ b//firehose/latest/dev/monitoring-with-cloudwatch-logs.md @@ -13 +13 @@ Amazon Data Firehose integrates with Amazon CloudWatch Logs so that you can view -If you enable Amazon Data Firehose error logging in the Amazon Data Firehose console, a log group and corresponding log streams are created for the Firehose stream on your behalf. The format of the log group name is `/aws/kinesisfirehose/`delivery-stream-name``, where ``delivery-stream-name`` is the name of the corresponding Firehose stream. `DestinationDelivery` is the log stream that is created and used to log any errors related to the delivery to the primary destination. Another log stream called `BackupDelivery` is created only if S3 backup is enabled for the destination. The `BackupDelivery` log stream is used to log any errors related to the delivery to the S3 backup. +If you enable Amazon Data Firehose error logging in the Amazon Data Firehose console, a log group and corresponding log streams are created for the Firehose stream on your behalf. The format of the log group name is `/aws/kinesisfirehose/`delivery-stream-name``, where ``delivery-stream-name`` is the name of the corresponding Firehose stream. `DestinationDelivery` is the log stream that is created and used to log any errors related to the delivery to the primary destination. Another log stream called `BackupDelivery` is created only if S3 backup is enabled for the destination. However, which log stream receives S3 backup delivery errors depends on the `S3BackupMode` setting of the Firehose stream. When the `S3BackupMode` setting is `AllData` (or `Enabled` for Amazon Redshift), S3 backup delivery errors are logged to the `BackupDelivery` log stream. When the `S3BackupMode` setting is `FailedDataOnly`, S3 backup delivery errors (for example, `S3.AccessDenied`) are logged to the `DestinationDelivery` log stream along with the primary destination errors. They are not logged to the `BackupDelivery` log stream. The `FailedDataOnly` setting is available for the HTTP endpoint, Splunk, OpenSearch, Snowflake, and Iceberg destinations. @@ -16,0 +17,2 @@ For example, if you create a Firehose stream "MyStream" with Amazon Redshift as +As another example, suppose you create a Firehose stream with an HTTP endpoint as the destination and set `S3BackupMode` to `FailedDataOnly`. Errors for the records that failed delivery and were backed up to S3 (for example, `S3.AccessDenied`) are logged to the `DestinationDelivery` log stream. They are not logged to the `BackupDelivery` log stream. +