Overview

The AWS CloudWatch Logs integration uses CloudWatch Logs Insights queries to fetch entries from any log group. Common use cases:

• Lambda function execution and error logs
• ECS task and Fargate container logs
• RDS error logs
• Custom application logs delivered to CloudWatch

Prerequisites

• A CloudWatch log group containing the data you want to ingest.
• IAM credentials for a user or role with read access to that log group.

Step 1: Identify the log group

1. Open the AWS Console → CloudWatch → Logs → Log groups.
2. Locate or create the log group you want to ingest from (for example, /aws/lambda/my-function-logs).
3. Note the exact log group name and its AWS Region.

Step 2: Create an IAM user for CloudWatch Logs

1. Open IAM → Users → Create user, name it atatus-cloudwatch-reader.
2. Attach an inline policy allowing:
   • logs:DescribeLogGroups
   • logs:DescribeLogStreams
   • logs:GetLogEvents
   • logs:FilterLogEvents
   • logs:StartQuery, logs:GetQueryResults, logs:StopQuery
3. Scope the policy to the specific log group ARN(s) you want Atatus to read.
4. Open Security credentials → Create access key, choose Application running outside AWS, and copy both the Access key ID and Secret access key.

Step 3: Connect AWS CloudWatch Logs in Atatus

1. In Atatus, go to Security → Cloud SIEM → Integrations.
2. Locate the AWS CloudWatch Logs card and click Connect.
3. Fill in the form:

1. Click Connect.

Tip: Use the Query String field to filter noisy log groups — for example, fields @timestamp, @message | filter @message like /ERROR/ only ingests error entries.

Verification

• The AWS CloudWatch Logs card shows Configured.
• Log entries appear in Security → Cloud SIEM → Audit Logs → Events with source aws_cloudwatch.