Skip to main content
All AWS integration capabilities

​
About

Run your own OpenTelemetry Collector to forward AWS WAF logs without granting Sazabi a cross-account IAM role. The Collector’s awscloudwatch receiver picks up every log group whose name starts with aws-waf-logs- and exports OTLP to your Sazabi intake URL. Your AWS credentials stay with the Collector. To have Sazabi set up subscription filters for you instead, see AWS WAF (connect your account).

​
Prerequisites

  • Each web ACL logs to a CloudWatch Logs log group named aws-waf-logs-…. In the AWS WAF console, open the web ACL, go to Logging and metrics, and pick a CloudWatch Logs log group as the destination. CloudFront web ACLs log in us-east-1.
  • An AWS identity for the Collector with logs:DescribeLogGroups, logs:FilterLogEvents, and logs:GetLogEvents on those log groups.

​
Set up in the dashboard

1

​
Get your intake URL

Go to Settings > Log streams, click Add source, select AWS WAF, and choose the endpoint setup. Copy the collector configuration; it already contains your intake URL.
2

​
Configure the Collector

The generated configuration looks like this, with your project’s region and intake host filled in:
Use the opentelemetry-collector-contrib distribution; the awscloudwatch receiver ships there. The key is embedded in the endpoint hostname, so no auth header is needed.
3

​
Deploy the Collector

Run the Collector anywhere with AWS credentials from the standard SDK chain (environment variables, an instance or task role, or a named profile).

​
Set up with the CLI

Create the source and print the generated collector configuration with the Sazabi CLI:

​
Verify

Send a request through the web ACL, then open the Intake page and confirm records attributed to the AWS WAF source appear. The Collector polls once a minute, so allow a few minutes.

​
Troubleshooting

No records arrive — Check the Collector logs for AccessDenied from CloudWatch Logs or export errors, and confirm the log groups are in the region the receiver reads. Only some web ACLs appear — Every log group must start with aws-waf-logs-; AWS WAF rejects other names as logging destinations.

​
Further reading

AWS WAF (connect your account)

Let Sazabi set up subscription filters on your WAF log groups.

AWS WAF logging

AWS documentation for web ACL logging destinations and fields.