Chapter 9. Forward to Amazon CloudWatch from STS-enabled clusters

Procedure

1. Create an IAM policy that grants permissions to write logs to CloudWatch.

   1. Create a file, for example cw-iam-role-policy.json, with the following content:

      {
          "Version": "2012-10-17",
          "Statement": [
              {
                  "Effect": "Allow",
                  "Action": [
                      "logs:PutLogEvents",
                      "logs:CreateLogGroup",
                      "logs:PutRetentionPolicy",
                      "logs:CreateLogStream",
                      "logs:DescribeLogGroups",
                      "logs:DescribeLogStreams"
                  ],
                  "Resource": "arn:aws:logs:*:*:*"
              }
          ]
      }

   2. Create the IAM policy based on the earlier policy definition by running the following command:

      $ aws iam create-policy \
          --policy-name cluster-logging-allow \
          --policy-document file://cw-iam-role-policy.json

      Note the Arn value of the created policy.

2. Create a trust policy to allow the logging service account to assume an IAM role:

   1. Create a file, for example cw-trust-policy.json, with the following content:

      {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Principal": {
                  "Federated": "arn:aws:iam::123456789012:oidc-provider/<OPENSHIFT_OIDC_PROVIDER_URL>"
              },
              "Action": "sts:AssumeRoleWithWebIdentity",
              "Condition": {
                  "StringEquals": {
                      "<OPENSHIFT_OIDC_PROVIDER_URL>:sub": "system:serviceaccount:openshift-logging:logcollector"
                  }
              }
          }
      ]
      }

3. Create an IAM role based on the trust policy defined earlier by running the following command:

   $ aws iam create-role --role-name openshift-logger --assume-role-policy-document file://cw-trust-policy.json

   Note the Arn value of the created role.

4. Attach the policy to the role by running the following command:

   $ aws iam put-role-policy \
         --role-name openshift-logger --policy-name cluster-logging-allow \
         --policy-document file://cw-role-policy.json

1. Initial Authentication: The collector authenticates to the AWS account of your cluster using Identity and Access Management (IAM) roles or access keys.
2. Role Assumption: After initial authentication, the collector assumes a role in the target AWS account.
3. Log Forwarding: The collector forwards logs to CloudWatch or S3 bucket in the target account using credentials of the assumed role.

Procedure

1. Create an initial account in your cluster account to assume the target role with the required permissions.

   The initial account can either be a user or an IAM role. This account assumes the target role.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": "sts:AssumeRole",
               "Resource": "arn:aws:iam::<target_aws_account_id>:role/target-logging-role"
           }
       ]
   }

2. In your target role, create a trust policy and specify the initial cluster role, and optionally an external id.

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Principal": {
                   "AWS": "arn:aws:iam:::<role_or_user>/<role_name_or_user_name>"
               },
               "Action": "sts:AssumeRole",
               "Condition": {
                   "StringEquals": {
                       "sts:ExternalId": "<your_unique_external_id>"
                   }
               }
           }
       ]
   }

   Set the Principal.AWS field as follows:

   • If the initial account is a user, use the format:

     arn:aws:iam::<aws_account_id>:user/<user_name>

   • If the initial account is an IAM role, use the format:

     arn:aws:iam::<aws_account_id>:role/<role_name>

3. Configure CloudWatch or S3 permissions in the target role depending on whether you want to forward logs to the CloudWatch or S3 output:

   CloudWatch permissions

   {
       "Version": "2012-10-17",
       "Statement": [
           {
               "Effect": "Allow",
               "Action": [
                   "logs:CreateLogGroup",
                   "logs:CreateLogStream",
                   "logs:PutLogEvents",
                   "logs:DescribeLogGroups",
                   "logs:DescribeLogStreams"
               ],
               "Resource": "*"
           }
       ]
   }

   S3 permissions

   {
       "Version": "2012-10-17",
       "Statement": [
           {
           "Sid": "AllowRoleToPutObjects",
           "Effect": "Allow",
           "Principal": {
               "AWS": "<assumerole_arn>"
           },
           "Action": [
               "s3:PutObject",
               "s3:PutObjectAcl"
           ],
           "Resource": [
               "arn:<aws_partition>:s3:::<s3_bucket>",
               "arn:<aws_partition>:s3:::<s3_bucket>/*"
           ]
           }
       ]
   }