By using AWS re:Post, you agree to the AWS re:Post Terms of Use
AWS re:Postre:Post

Cannot send WAF logs to Kinesis

1

Hi all,

I have been struggling to send my WAF ACL (AWS Managed rules) logs to Kinesis via a data firehose delivery stream.

I have a web app running on an ALB and have that set as the associated resource in the AWS WAF console.

I have also enabled logging and set Amazon Kinesis Data Firehose delivery stream as the logging destination but i am not seeing any requests etc. in the Kinesis delivery stream, its marked as active and the source is direct PUT.

Any help would be appreciated, thank you in advance!

  • Ziad
    2 years ago

    I'm having the same issue, and I see no error logs or any indication of errors. Any luck resolving this issue?

Topics
AnalyticsSecurity, Identity, & ComplianceInternet of Things (IoT)
Tags
Amazon Data FirehoseAWS WAFAWS Firewall ManagerAmazon Kinesis
Language
English
AWS-User-7115262
asked 2 years ago652 views
2 Answers
0

There are a few troubleshooting steps in the documentation.

Can you check the CloudWatch / Events & Logs to see where it's breaking? That can help narrow down the issue as well.

AWS
Dan_H
answered 2 years ago
  • Ziad
    2 years ago

    No errors, and no logs showing up in Cloudwatch. I have the same issue and tried both from the admin account and the member account, both didn't work. Also, trying directly to send logs to Cloudwatch didn't work either.

0

So, according to a recent chat with AWS support on this issue looks like logging must be enabled at the same time the web ACL or the security policy is being created. The order matters so the associated permissions can be created accordingly. Enabling logging after the ACL/policy is created will not send any logs.

AWS need to indicate the proper steps needed for enabling logging after the fact that ACLs were created, unless this is a bug.

Ziad
answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions

Relevant content