Elastic Beanstalk should stream logs to CloudWatch
Confirms that the Elastic Beanstalk environment streams its instance logs to CloudWatch Logs, so they outlive the instance that wrote them. It reads the setting, not whether logs arrive: the instance profile needs logs:CreateLogStream and logs:PutLogEvents, which AWSElasticBeanstalkWebTier and AWSElasticBeanstalkWorkerTier include.
- service
- ElasticBeanstalk
- severity
- High
- scope
- evaluated in every region
How to fix it
In the console
Elastic Beanstalk → Environments → the environment → Configuration → Updates, monitoring, and logging → Instance log streaming to CloudWatch Logs
- Log streaming
- Enable
- Retention
- As long as your log retention policy requires (the default is 7 days)
- Lifecycle
- Keep logs after terminating environment
With the AWS CLI
aws elasticbeanstalk update-environment --environment-name <environment-name> --option-settings Namespace=aws:elasticbeanstalk:cloudwatch:logs,OptionName=StreamLogs,Value=true --region <region>With Terraform
resource "aws_elastic_beanstalk_environment" "this" {
name = var.environment_name
application = var.application_name
setting {
namespace = "aws:elasticbeanstalk:cloudwatch:logs"
name = "StreamLogs"
value = "true"
}
}
See which of your accounts this check is failing on.
Book a live scan