CloudWatch Logs导出到S3

CloudWatch S3导出功能介绍

S3导出功能可以直接将日志导出到S3进行保存。在此过程中,需要指定导出日志的时间范围。

具体步骤

S3存储桶准备

首先需要准备用于接收导出日志的S3存储桶。此时S3存储桶的区域必须和CloudWatch Logs的区域一致。另外需要为存储桶添加如下策略(以东京区域为例):

{
    "Version": "2012-10-17", 
    "Statement": [
        {
            "Effect": "Allow",
            "Principal": {"Service": "logs.ap-northeast-1.amazonaws.com"},
            "Action": "s3:GetBucketAcl",
            "Resource": "arn:aws:s3:::[YOUR-BUCKET-NAME]"
        },
        {
            "Effect": "Allow",
            "Principal": {"Service": "logs.ap-northeast-1.amazonaws.com"},
            "Action": "s3:PutObject",
            "Resource": "arn:aws:s3:::[YOUR-BUCKET-NAME]/*",
            "Condition": {
                "StringEquals": {"s3:x-amz-acl": "bucket-owner-full-control"}
            }
        }
    ]
}

注意替换[YOUR-BUCKET-NAME]为你的桶的名字。