AWS Builder Center: Learn, Build and Connect with builders in the AWS community

AWS Builder Center is the official home for builders on AWS. Share and read what others are working on, follow people who inspire you, explore training and workshops, and find tools to support what you're building.

Questo contenuto non è disponibile nella lingua selezionata

Lavoriamo costantemente per rendere disponibili i contenuti nella lingua selezionata. Ti ringraziamo per la comprensione.

How do I troubleshoot a failed export task in CloudWatch Logs?

6 minuti di lettura

My export task fails when I try to export log data from Amazon CloudWatch Logs to an Amazon Simple Storage Service (Amazon S3) bucket, even though the Amazon S3 bucket exists.

Short description

You can configure an export task for an S3 bucket within the same AWS account or a different account.

To export log data from CloudWatch Logs to a bucket, the destination bucket requires the correct permissions and must be in the same AWS Region as the log group.

If the bucket policy, AWS Identity and Access Management (IAM) permissions, or encryption settings aren't configured correctly, then the export task fails and you might receive one of the following errors:

"Could not create export task. GetBucketAcl call on the given bucket failed. Please check if CloudWatch Logs has been granted permission to perform this operation."
"Could not create export task. PutObject call on the given bucket failed. Please check if CloudWatch Logs has been granted permission to perform this operation."
"Unable to create export task. Resource limit exceeded."
"PutObject call on the given bucket failed. Please check if CloudWatch Logs has been granted permission to perform this operation. This may be a result of a KMS key or bucket encryption misconfiguration."
"GetBucketAcl call on the given bucket failed. Please check if the specified Amazon S3 Bucket is in the same AWS region as CloudWatch Logs."

Resolution

Add the required permissions policy for the export task

To run an export task, the IAM user, group, or role that calls the export task API requires the s3:PutObject permissions policy. If the destination bucket is encrypted with SSE-KMS, then also include the AWS Key Management Service (AWS KMS) policy.

Add the following permissions policy to your IAM users, groups, or roles:

{
  "Version": "2012-10-17",
  "Statement": [
      {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": arn:aws:s3:::MY-EXPORTED-LOGS/*
    },
    {
      "Effect": "Allow",
      "Action": [
      "kms:GenerateDataKey",
      "kms:Decrypt"
       ],
    "Resource": ARN_OF_KMS_KEY
    }
  ]
}

Note: Replace MY-EXPORTED-LOGS with the name of your destination bucket and replace ARN_OF_KMS_KEY with the Amazon Resource Name (ARN) of your AWS KMS key.

Attach the AmazonS3ReadOnlyAccess managed policy to the IAM role that calls the export task. Also attach a policy with the following CloudWatch Logs permissions:

logs:CreateExportTask
logs:CancelExportTask
logs:DescribeExportTasks
logs:DescribeLogStreams
logs:DescribeLogGroups

Grant permissions on the destination bucket

By default, all buckets and objects are private. Only the resource owner or the account that created the bucket can access the bucket and objects within the bucket. When necessary, the resource owner can write an access policy to grant access permissions to other resources and users.

When you set a policy, include a randomly generated string as the prefix for the bucket. This allows only the intended log streams to be exported to the bucket.

To grant permissions on the destination bucket, complete the following steps:

Open the S3 console.
Choose the bucket where you want to export the logs.
Choose Permissions, and then choose Bucket policy.

In the Bucket Policy Editor, add the following policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": "s3:GetBucketAcl",
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::exammple-s3-bucket",
      "Principal": {
        "Service": "logs.example-region.amazonaws.com"
      },
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": [
            "AccountId1",
            "AccountId2",
            ...
          ]
        },
        "ArnLike": {
          "aws:SourceArn": [
            "arn:aws:logs:Region:AccountId1:log-group:",
            "arn:aws:logs:Region:AccountId2:log-group:",
            ...
          ]
        }
      }
    },
    {
      "Action": "s3:PutObject",
      "Effect": "Allow",
      "Resource": "arn:aws:s3:::example-s3-bucket/",
      "Principal": {
        "Service": "logs.example-region.amazonaws.com"
      },
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control",
          "aws:SourceAccount": [
            "AccountId1",
            "AccountId2",
            ...
          ]
        },
        "ArnLike": {
          "aws:SourceArn": [
            "arn:aws:logs:Region:AccountId1:log-group:",
            "arn:aws:logs:Region:AccountId2:log-group:",
            ...
          ]
        }
      }
    },
    {
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::create_export_task_caller_account:role/role_name"
      },
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::example-s3-bucket/",
      "Condition": {
        "StringEquals": {
          "s3:x-amz-acl": "bucket-owner-full-control"
        }
      }
    }
  ]
}

Note: Replace example-s3-bucket with the name of your bucket. Also replace example-region with the required Region endpoint for the Principal parameter. The preceding policy is set as the access policy on your bucket. This policy allows CloudWatch Logs to export log data to your bucket and the bucket owner has full permissions on all exported objects.

Choose Save.

Export a task to a bucket encrypted with SSE-KMS

Create and configure the AWS KMS key

Complete the following steps:

Open the AWS KMS console. To change the Region, use the Region selector on the navigation bar.
In the navigation pane, choose Customer managed keys, and then choose Create Key.
For Key type, choose Symmetric.
For Key usage, choose Encrypt and decrypt.
Choose Next.
Under Add labels, enter an alias for the key. Optionally, add a description or tags, and then choose Next.
Under Key administrators, select who can administer this key, and then choose Next twice to skip to the review page.
Review the settings, and then choose Finish.
Go to the Customer managed keys page, and then choose the name of the key that you created earlier.
Choose the Key policy tab, and then choose Switch to policy view.

In the Key policy section, choose Edit, and then add the following statement to the key policy statement list:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "Allow CWL Service Principal usage",
      "Effect": "Allow",
      "Principal": {
        "Service": "logs.EXAMPLE-REGION.amazonaws.com"
      },
      "Action": [
        "kms:GenerateDataKey",
        "kms:Decrypt"
      ],
      "Resource": ""
    },
    {
      "Sid": "Enable IAM User Permissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": EXAMPLE-ACCOUNT-ARN
      },
      "Action": [
        "kms:GetKeyPolicy",
        "kms:PutKeyPolicy",
        "kms:DescribeKey",
        "kms:CreateAlias",
        "kms:ScheduleKeyDeletion",
        "kms:Decrypt"
      ],
      "Resource": "*"
    },
    {
      "Sid": "Enable IAM Role Permissions",
      "Effect": "Allow",
      "Principal": {
        "AWS": "arn:aws:iam::create_export_task_caller_account:role/role_name"
      },
      "Action": [
        "kms:GenerateDataKey",
        "kms:Decrypt"
      ],
      "Resource": ARN_OF_KMS_KEY
    }
  ]
}

Note: Replace EXAMPLE-REGION with the Region of your logs and EXAMPLE-ACCOUNT-ARN with the account ARN that owns the AWS KMS key. Replace create_export_task_caller_account with the caller's account ID and role_name with the name of the IAM role. Also replace ARN_OF_KMS_KEY with the ARN of your AWS KMS key.

Choose Save changes.

Configure the bucket encryption

Complete the following steps:

Open the Amazon S3 console.
Choose the bucket where you want to export logs.
Choose the Properties tab. Then, under Default Encryption, choose Edit.
Under Server-side Encryption, choose Enable.
Under Encryption type, choose AWS Key Management Service key (SSE-KMS).
Choose Choose from your AWS KMS keys and find the key that you created.
For Bucket key, choose Enable.
Choose Save changes.
Note: CloudWatch Logs allows one export task at a time per account per Region. If you receive the "Unable to create export task. Resource limit exceeded" error, then wait for your current export task to complete before you start a new one.