Activity Logs - CloudWatch Sync

You need the access key and secret access key from your Amazon CloudWatch account to allow Hevo to access the data from it.

1. Log in to the Amazon IAM Console.

2. In the left navigation bar, under Access management, click Users, and then, in the right pane, click the User name for which you want to create an access key.

   

3. In the Summary page, click the Security credentials tab, and then, click Create access key.

   

4. In the Access key best practices & alternatives page, do the following:

   

   1. Select one of the recommended methods. For example, in the image above, Command Line Interface (CLI) is selected.

   2. Select the I understand the above recommendation… check box, to proceed with creating the access key.

   3. Click Next.

5. In the Set description tag - optional page, do the following:

   

   1. (Optional) Specify a description for the access key in the Description tag value field.

   2. Click Create access key.

6. In the Retrieve access keys page, do the following:

   

   • Click the copy icon in the Access key field and save the key securely like any other password.

   • Click the copy icon in the Secret access key field and save the key securely like any other password.

     Note: Once you exit this page, you cannot access these keys again.

   • (Optional) Click Download .csv file to save the access key and the secret access key on your local machine.

To generate your IAM role-based credentials, you need to:

1. Create an IAM policy with the permission to allow Hevo to sync data with your Amazon CloudWatch logs.

2. Create an IAM role for Hevo, as the Amazon Resource Name (ARN) and the external ID from this role are required to configure Amazon CloudWatch Logs in Hevo.

These steps are explained in details below:

1. Create an IAM policy

1. Log in to the AWS IAM Console.

2. In the left navigation bar, under Access management, click Policies.

   

3. In the Policies page, click Create policy.

   

4. In the Specify permissions page, click the JSON tab and paste the following policy in the editor. The JSON statements list the permissions the policy would assign to Hevo.

   Note: Replace the placeholder values in the commands below with your own. For example, <aws_region> with us-east-1.

    {
        "Version": "2012-10-17",
        "Statement": [
            {
                "Sid": "VisualEditor0",
                "Effect": "Allow",
                "Action": "logs:CreateLogStream",
                "Resource": "arn:aws:logs:<aws_region>:<account-id>:log-group:<log-group-name>"
            },
            {
                "Sid": "VisualEditor1",
                "Effect": "Allow",
                "Action": [
                    "logs:DeleteLogStream",
                    "logs:PutLogEvents"
                ],
                "Resource": "arn:aws:logs:<aws_region>:<account-id>:log-group:<log-group-name>"
            }
        ]
    }                 
   

   

5. Click Next.

6. In the Review and policy page, specify a Policy name and Description for your policy and click Create policy.

   

You are redirected to the Policies page, where you can see the policy that you created.

2. Create an IAM role and obtain its ARN and external ID

Perform the following steps to create an IAM role:

1. Log in to the AWS IAM Console.

2. In the left navigation bar, under Access management, click Roles.

   

3. In the Roles page, click Create role.

   

4. In the Select trusted entity page:

   • In the Trusted entity type section, select AWS account.

     

   • In the An AWS account section, do the following:

     

     1. Select the Another AWS account option, and specify Hevo’s Account ID, 393309748692.

     2. In the Options section, select the Require external ID… check box, and specify an External ID of your choice.

        Note: You must save this external ID in a secure location like any other password. This is required while setting up a Pipeline in Hevo.

5. Click Next.

6. In the Permissions policies section, select the policy that you created in Create an IAM policy above and click Next at the bottom of the page.

   

7. In the Name, review, and create page, specify the Role name and click Create role.

   

8. In the Roles page, select the role that you created above.

   

9. In the <Role name> page, the Summary section, click the copy icon to copy the ARN and save it securely like any other password. Use this ARN while configuring Amazon CloudWatch logs in Hevo.

   

Refer to the following table for the list of key updates made to this page: