AWS CloudWatch
Connect your AWS account so Sazabi can set up subscription filters on your CloudWatch log groups and stream logs in real time.
About
Connect your AWS account and Sazabi sets up a CloudWatch subscription filter on each log group you select. Sazabi assumes a cross-account IAM role you create in your AWS account, adds your account to the Sazabi-managed CloudWatch destination policy, and installs the subscription filter — all without you running anything.
AWS CloudWatch also has a Send to an endpoint path where you run your own OpenTelemetry Collector against your log groups and export OTLP to Sazabi. See CloudWatch endpoint page for that setup.
Prerequisites
- An AWS account with permission to create an IAM role (
iam:CreateRole,iam:PutRolePolicy). - CloudWatch log groups in the same region as your Sazabi project.
Set up in the dashboard
The dashboard offers three ways to create the required IAM role — CloudFormation, Terraform, or the AWS CLI. All three produce the same role; choose whichever fits your workflow.
Create the IAM role
Go to Settings > Log streams, click Add source, and select CloudWatch. Choose a setup method:
CloudFormation — Click Launch CloudFormation stack. AWS opens a quick-create form with all parameters pre-filled. After the stack finishes, copy the RoleArn value from Stacks > [stack name] > Outputs.
Terraform — Copy the Terraform snippet from the dashboard and add it to your configuration. Run terraform apply, then copy the sazabi_role_arn output value.
AWS CLI — Copy the CLI commands from the dashboard (they embed the correct Sazabi account ID and external ID for your project). Run them in your terminal; the final command prints the role ARN.
The IAM role grants Sazabi permission to:
logs:DescribeLogGroups— list your log groupslogs:DescribeSubscriptionFilters— inspect existing filterslogs:PutSubscriptionFilterandlogs:DeleteSubscriptionFilter— install and remove filterslogs:PutAccountPolicy,logs:DeleteAccountPolicy,logs:DescribeAccountPolicies— manage account-level policies
Enter the role ARN
Paste the role ARN (format: arn:aws:iam::ACCOUNT_ID:role/ROLE_NAME) into the dashboard and click Connect. Sazabi validates that it can assume the role using the external ID generated for your project.
Add log streams
After the connection is confirmed, click Add log stream to open the log group picker. Select the groups you want to forward. Sazabi installs a subscription filter on each one. Only log groups in the same region as your Sazabi project are shown.
Set up with the CLI
You can also manage the CloudWatch log source with the Sazabi CLI (installed and authenticated — see CLI reference).
The initial managed connection is best created in the dashboard: the cross-account IAM role's trust policy must reference a Sazabi-generated external ID that the setup form (and the CloudFormation, Terraform, and AWS CLI snippets it produces) embeds for your project. Once the role exists and the connection is created, use the CLI to inspect and manage the source:
sazabi log-sources list --provider cloudwatch # Find the CloudWatch log source ID
sazabi log-sources get <log-source-id> # Log source details and its log streams
sazabi log-sources disable <log-source-id> # Pause ingestion for its log streams
sazabi log-sources enable <log-source-id> # Resume ingestionVerify
Write a new log event to one of the connected log groups — for example invoke a Lambda function or trigger an application log statement.
Open the Intake page in the Sazabi dashboard and confirm that records attributed to the CloudWatch source appear. Logs typically arrive within one to two minutes of the subscription filter delivering them.
Troubleshooting
"Access denied" on sts:AssumeRole — The IAM role trust policy does not allow Sazabi to assume the role. Verify that the Principal in the trust policy matches the Sazabi AWS account ID shown in the setup form, and that the sts:ExternalId condition matches the external ID from your project.
"Access denied" on logs:PutSubscriptionFilter — The IAM role policy is missing the logs:PutSubscriptionFilter permission on the target log group ARN. Check the ManageSubscriptionFilters policy statement.
"Subscription filter quota exceeded" — CloudWatch allows at most two subscription filters per log group. Remove an existing filter from the log group in the AWS console before re-adding the log stream in Sazabi.
Only showing log groups from one region — Sazabi only lists log groups in your project's region. To forward log groups from other regions, create a separate Sazabi project in the target region.
Logs stop arriving — Check whether the IAM role or the subscription filter still exists in your AWS account. A role deletion or trust-policy change prevents Sazabi from assuming the role during future provisioning.