Configuring the Cluster Log Forwarder for CloudWatch Logs and STS

This guide shows how to deploy the Cluster Log Forwarder operator and configure it to use STS authentication to forward logs to CloudWatch.

Prerequisites

• A ROSA cluster (configured with STS)
• The jq cli command
• The aws cli command

Environment Setup

1. Configure the following environment variables

   Change the cluster name to match your ROSA cluster and ensure you’re logged into the cluster as an Administrator. Ensure all fields are outputted correctly before moving on.

Prepare AWS Account

1. Create an IAM Policy for OpenShift Log Forwarding

2. Create an IAM Role trust policy for the cluster

3. Attach the IAM Policy to the IAM Role

Deploy Operators

1. Deploy the Cluster Logging operator

2. Create a secret

Configure Cluster Logging

1. Create a cluster log forwarding resource

2. Create a cluster logging resource

Check AWS CloudWatch for logs

1. Use the AWS console or CLI to validate that there are log streams from the cluster

   Note: If this is a fresh cluster you may not see a log group for application logs as there are no applications running yet.

Cleanup

1. Delete the Cluster Log Forwarding resource

2. Delete the Cluster Logging resource

3. Detach the IAM Policy to the IAM Role

4. Delete the IAM Role

5. Delete the IAM Policy

   Only run this command if there are no other resources using the Policy

6. Delete the CloudWatch Log Groups