Can API Gateway send Access Logs to Firehose in a different account?

0

We have API Gateway deployed in account A and want to send Access Logs to a Firehose in account B so all auditing services and billing are separated. But after Firehose ARN from account B was set in API Gateway, we are getting the error "Invalid ARN specified in the request. ARN must belong to account A and region should be X". Is it possible that we are missing some permission configuration here? Or is just that API Gateway does not have the option to send Access Logs to another account?

3개 답변
0

The recommendation would be to have API Gateway in account A, Kinesis Firehose in account A, and S3 target bucket + analytics in account B, you could find the example on how to achieve this here. The account A would also be charged by the usage of Kinesis Firehose. You could use tag-based cost allocation to know that cost in particular if you want to internally allocate that cost (although from my experience Firehose's cost shouldn't be too much to go through this hassle)

AWS
답변함 일 년 전
0

Thanks for the recommendation, we'll do that. Can you confirm it's not possible to send API Gateway's Access Logs to Firehose in a different account?

답변함 일 년 전
0

API Gateway doesn't allow direct cross-account pass role. At the moment they can only be sent to the same account (not cross-account). To have a centralized logging in a common account is to follow this pattern https://aws.amazon.com/solutions/implementations/centralized-logging/

AWS
답변함 10달 전

로그인하지 않았습니다. 로그인해야 답변을 게시할 수 있습니다.

좋은 답변은 질문에 명확하게 답하고 건설적인 피드백을 제공하며 질문자의 전문적인 성장을 장려합니다.

질문 답변하기에 대한 가이드라인

관련 콘텐츠