All checks
High ElasticBeanstalk · regional

Elastic Beanstalk should stream logs to CloudWatch

Confirms that the Elastic Beanstalk environment streams its instance logs to CloudWatch Logs, so they outlive the instance that wrote them. It reads the setting, not whether logs arrive: the instance profile needs logs:CreateLogStream and logs:PutLogEvents, which AWSElasticBeanstalkWebTier and AWSElasticBeanstalkWorkerTier include.

service
ElasticBeanstalk
severity
High
scope
evaluated in every region

How to fix it

In the console

Elastic Beanstalk → Environments → the environment → Configuration → Updates, monitoring, and logging → Instance log streaming to CloudWatch Logs

Log streaming
Enable
Retention
As long as your log retention policy requires (the default is 7 days)
Lifecycle
Keep logs after terminating environment

With the AWS CLI

aws elasticbeanstalk update-environment --environment-name <environment-name> --option-settings Namespace=aws:elasticbeanstalk:cloudwatch:logs,OptionName=StreamLogs,Value=true --region <region>

With Terraform

resource "aws_elastic_beanstalk_environment" "this" {
  name        = var.environment_name
  application = var.application_name

  setting {
    namespace = "aws:elasticbeanstalk:cloudwatch:logs"
    name      = "StreamLogs"
    value     = "true"
  }
}

See which of your accounts this check is failing on.

Book a live scan