> ## Documentation Index
> Fetch the complete documentation index at: https://docs.sazabi.com/llms.txt
> Use this file to discover all available pages before exploring further.

# AWS CloudWatch

> Connect your AWS account so Sazabi can set up subscription filters on your CloudWatch log groups and stream logs in real time.

[All AWS integration capabilities](https://docs.sazabi.com/catalogs/integrations/aws)

## About

Connect your AWS account and Sazabi sets up a CloudWatch subscription filter on each log group you select. Sazabi assumes a cross-account IAM role you create in your AWS account, adds your account to the Sazabi-managed CloudWatch destination policy, and installs the subscription filter — all without you running anything.

AWS CloudWatch also has a **Send to an endpoint** path where you run your own OpenTelemetry Collector against your log groups and export OTLP to Sazabi. See [CloudWatch endpoint page](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/cloudwatch.md) for that setup.

## Prerequisites

* An AWS account with permission to create an IAM role (`iam:CreateRole`, `iam:PutRolePolicy`).
* CloudWatch log groups in the same region as your Sazabi project.

## Set up in the dashboard

The dashboard offers three ways to create the required IAM role — CloudFormation, Terraform, or the AWS CLI. All three produce the same role; choose whichever fits your workflow.

**Step 1**

### Create the IAM role

Go to [**Settings > Log streams**](https://app.sazabi.com/settings/log-source-providers), click **Add source**, and select **CloudWatch**. Choose a setup method:

**CloudFormation** — Click **Launch CloudFormation stack**. AWS opens a quick-create form with all parameters pre-filled. After the stack finishes, copy the `RoleArn` value from **Stacks > \[stack name] > Outputs**.

**Terraform** — Copy the Terraform snippet from the dashboard and add it to your configuration. Run `terraform apply`, then copy the `sazabi_role_arn` output value.

**AWS CLI** — Copy the CLI commands from the dashboard (they embed the correct Sazabi account ID and external ID for your project). Run them in your terminal; the final command prints the role ARN.

The IAM role grants Sazabi permission to:

* `logs:DescribeLogGroups` — list your log groups
* `logs:DescribeSubscriptionFilters` — inspect existing filters
* `logs:PutSubscriptionFilter` and `logs:DeleteSubscriptionFilter` — install and remove filters
* `logs:PutAccountPolicy`, `logs:DeleteAccountPolicy`, `logs:DescribeAccountPolicies` — manage account-level policies

**Step 2**

### Enter the role ARN

Paste the role ARN (format: `arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME`) into the dashboard and click **Connect**. Sazabi validates that it can assume the role using the external ID generated for your project.

**Step 3**

### Add log streams

After the connection is confirmed, click **Add log stream** to open the log group picker. Select the groups you want to forward. Sazabi installs a subscription filter on each one. Only log groups in the same region as your Sazabi project are shown.

## Set up with the CLI

You can also manage the CloudWatch log source with the [Sazabi CLI](https://docs.sazabi.com/reference/cli.md) (installed and authenticated — see [CLI reference](https://docs.sazabi.com/reference/cli/log-sources.md)).

The initial native connection is best created in the dashboard: the cross-account IAM role's trust policy must reference a Sazabi-generated external ID that the setup form (and the CloudFormation, Terraform, and AWS CLI snippets it produces) embeds for your project. Once the role exists and the connection is created, use the CLI to inspect and manage the source:

```bash theme={"system"}
sazabi log-sources list --provider cloudwatch    # Find the CloudWatch log source ID
sazabi log-sources get <log-source-id>            # Log source details and its log streams
sazabi log-sources disable <log-source-id>        # Pause ingestion for its log streams
sazabi log-sources enable <log-source-id>         # Resume ingestion
```

## Verify

Write a new log event to one of the connected log groups — for example invoke a Lambda function or trigger an application log statement.

Open the [Intake page](https://docs.sazabi.com/guides/instrument/intake.md) in the Sazabi dashboard and confirm that records attributed to the **CloudWatch** source appear. Logs typically arrive within one to two minutes of the subscription filter delivering them.

## Troubleshooting

**"Access denied" on `sts:AssumeRole`** — The IAM role trust policy does not allow Sazabi to assume the role. Verify that the `Principal` in the trust policy matches the Sazabi AWS account ID shown in the setup form, and that the `sts:ExternalId` condition matches the external ID from your project.

**"Access denied" on `logs:PutSubscriptionFilter`** — The IAM role policy is missing the `logs:PutSubscriptionFilter` permission on the target log group ARN. Check the `ManageSubscriptionFilters` policy statement.

**"Subscription filter quota exceeded"** — CloudWatch allows at most two subscription filters per log group. Remove an existing filter from the log group in the AWS console before re-adding the log stream in Sazabi.

**Only showing log groups from one region** — Sazabi only lists log groups in your project's region. To forward log groups from other regions, create a separate Sazabi project in the target region.

**Logs stop arriving** — Check whether the IAM role or the subscription filter still exists in your AWS account. A role deletion or trust-policy change prevents Sazabi from assuming the role during future provisioning.

## Further reading

> [card] [Intake](https://docs.sazabi.com/guides/instrument/intake.md)
>
> See per-source ingestion volume and health in the Intake page.

> [card] [CloudWatch (send to an endpoint)](https://docs.sazabi.com/catalogs/log-sources/send-to-an-endpoint/cloudwatch.md)
>
> Run your own OpenTelemetry Collector against CloudWatch log groups.

> [card] [Log sources](https://docs.sazabi.com/catalogs/log-sources.md)
>
> Browse the full log source catalog.

> [card] [Send Kubernetes audit logs](https://docs.sazabi.com/guides/instrument/kubernetes-audit-logs.md)
>
> Send EKS control-plane audit logs through this source.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.