Skip to content
By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post
About re:Post

Delivering NLB Access Logs to CloudWatch Logs Using Native CloudFormation Resources

3 minute read
Content level: Intermediate
1

This article provides a CloudFormation template for delivering NLB access logs to CloudWatch Logs using native AWS::Logs resource types (DeliverySource, DeliveryDestination, Delivery).

Network Load Balancer (NLB) supports V2 Vended Logs to deliver access logs to CloudWatch Logs, Amazon S3, or Amazon Data Firehose. The template in this article uses the following native CloudFormation resource types to set up the delivery pipeline:

  • AWS::Logs::DeliverySource
  • AWS::Logs::DeliveryDestination
  • AWS::Logs::Delivery

Architecture

The template creates the following resources:

  1. CloudWatch Log Group — Destination for the NLB access logs
  2. Delivery Source — Registers the NLB as a log source with log type NLB_ACCESS_LOGS
  3. Delivery Destination — Points to the CloudWatch Log Group
  4. Delivery — Connects the source to the destination
NLB ──▶ DeliverySource ──▶ Delivery ──▶ DeliveryDestination ──▶ CloudWatch Log Group

Prerequisites

Steps

1. Get the NLB ARN

Identify the ARN of the NLB you want to enable access logs for. You can find it in the EC2 console under Load Balancers, or by running:

aws elbv2 describe-load-balancers \
  --names <NLB_NAME> \
  --query "LoadBalancers[0].LoadBalancerArn" \
  --output text

2. Save the CloudFormation template

Save the following as nlb-vended-logs.yaml:

AWSTemplateFormatVersion: '2010-09-09'
Description: V2 Vended Logs Delivery (NLB Access Logs to CloudWatch Logs)

Parameters:
  DeliverySourceName:
    Type: String
    Default: WdDeliverySource
  DeliverySourceArn:
    Type: String
    Description: ARN of the NLB
  LogType:
    Type: String
    Default: NLB_ACCESS_LOGS
  DestinationName:
    Type: String
    Default: WdDeliveryDestination
  LogGroupName:
    Type: String
    Default: /aws/vendedlogs/elasticloadbalancing/loadbalancer/NLB_ACCESS_LOGS/net

Resources:
  LogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      LogGroupName: !Ref LogGroupName
      LogGroupClass: STANDARD

  DeliverySource:
    Type: AWS::Logs::DeliverySource
    Properties:
      Name: !Ref DeliverySourceName
      ResourceArn: !Ref DeliverySourceArn
      LogType: !Ref LogType

  DeliveryDestination:
    Type: AWS::Logs::DeliveryDestination
    DependsOn: LogGroup
    Properties:
      Name: !Ref DestinationName
      DestinationResourceArn: !GetAtt LogGroup.Arn

  Delivery:
    Type: AWS::Logs::Delivery
    DependsOn:
      - DeliverySource
      - DeliveryDestination
    Properties:
      DeliverySourceName: !Ref DeliverySourceName
      DeliveryDestinationArn: !GetAtt DeliveryDestination.Arn

Outputs:
  DeliveryArn:
    Value: !GetAtt Delivery.Arn
  LogGroupName:
    Value: !Ref LogGroupName

3. Deploy the stack

aws cloudformation create-stack \
  --stack-name nlb-vended-logs-delivery \
  --template-body file://nlb-vended-logs.yaml \
  --parameters ParameterKey=DeliverySourceArn,ParameterValue=<YOUR_NLB_ARN> \
  --region <YOUR_REGION>

4. Verify the deployment

Wait for the stack to complete, then confirm the delivery was created:

aws cloudformation describe-stacks \
  --stack-name nlb-vended-logs-delivery \
  --query "Stacks[0].StackStatus" \
  --output text

aws logs describe-log-groups \
  --log-group-name-prefix /aws/vendedlogs/elasticloadbalancing/loadbalancer/NLB_ACCESS_LOGS

Important Notes

  • Access logs are created only if the load balancer has a TLS listener, and the logs contain information about TLS requests only.
  • Access logs record requests on a best-effort basis. Use access logs to understand the nature of the requests, not as a complete accounting of all requests.
  • The log group name must be unique in your account. The stack will fail with a ResourceAlreadyExistsException if the log group already exists. Specify a different name using the LogGroupName parameter if needed.
  • The template uses the Standard log group class. The Infrequent Access log class does not support metric filters, Live Tail, subscription filters, or the GetLogEvents/FilterLogEvents APIs. For more details, see Log classes.
  • Deleting the stack will remove the delivery configuration and the log group. Existing log data in the log group will be lost.

Related Resources

No comments

Relevant content