How do I push SSM Agent logs to CloudWatch?

Resolution

Create a log group in CloudWatch Logs

Complete the following steps:

1. Open the CloudWatch console.
2. In the navigation pane, choose Log groups.
3. Choose Create log group.
4. For Log group name, enter a name.
5. Choose Create.

Attach permissions

To send the logs, the Amazon Elastic Compute Cloud (Amazon EC2) instance must include AWS Identity and Access Management (IAM) permissions.

Attach an IAM role to the instance that has the following permissions:

• logs:CreateLogStream
• logs:DescribeLogGroups
• logs:DescribeLogStreams
• logs:CreateLogGroup
• logs:PutLogEvent

Note: You can include the preceding permissions with already existing permissions, and narrow the permissions based on your requirements.

Configure SSM Agent to send logs to CloudWatch Logs

To configure SSM Agent to send logs to CloudWatch Logs, see Sending SSM Agent logs to CloudWatch Logs.

Related information

Checking SSM Agent status and starting the agent

What is Amazon CloudWatch Logs?

Getting started with CloudWatch Logs