https://github.com/blend/log-pipeline
Centralize all logs in a separate AWS account.
https://github.com/blend/log-pipeline
Last synced: 4 months ago
JSON representation
Centralize all logs in a separate AWS account.
- Host: GitHub
- URL: https://github.com/blend/log-pipeline
- Owner: blend
- License: mit
- Created: 2017-03-14T00:02:20.000Z (over 9 years ago)
- Default Branch: master
- Last Pushed: 2017-03-29T18:30:50.000Z (about 9 years ago)
- Last Synced: 2025-04-12T21:51:37.848Z (about 1 year ago)
- Size: 11.7 KB
- Stars: 10
- Watchers: 3
- Forks: 5
- Open Issues: 1
-
Metadata Files:
- Readme: README.md
- License: LICENSE
Awesome Lists containing this project
README
# log-pipeline
Centralize all logs in a separate AWS account. See [blog post](https://blend.com/centralizing-logs-in-an-isolated-aws-account/).
## Deploying
1. Launch AWS Elasticsearch Domain.
`$ aws cloudformation create-stack --stack-name LogEsDomain --template-body file://es.yml --parameters ParameterKey=KibanaJumpboxPublicIpAddress,ParameterValue=x.x.x.x --profile isolated-account-admin`
2. Launch AWS Kinesis Firehose that delivers logs to Elasticsearch Domain in step 1.
`$ aws cloudformation create-stack --stack-name LogFirehose --template-body file://firehose.yml --parameters ParameterKey=ElasticsearchDomainArn,ParameterValue= ParameterKey=FirehoseBackupS3KmsKeyArn,ParameterValue= --capabilities CAPABILITY_IAM --profile isolated-account-admin`
3. Launch log sink stack that accepts logs from another account and forwards them to the AWS Kinesis Firehose in step 2.
`$ aws cloudformation create-stack --stack-name LogSink --template-body file://cloudwatch_logs_sink.yml --parameters ParameterKey=LogSinkFirehoseDeliveryStream,ParameterValue= ParameterKey=SubscriptionFilterAccountId,ParameterValue=111111111111 --capabilities CAPABILITY_IAM --profile isolated-account-admin`
4. Launch log source in each AWS account to send logs to the log sink in the isolated AWS account.
`$ aws cloudformation create-stack --stack-name LogSource --template-body file://cloudwatch_logs_source.yml --parameters ParameterKey=DestinationArn,ParameterValue= --profile 111111111111-admin`