AWS CloudWatch Log Group

Deploys an AWS CloudWatch Logs log group with configurable retention policy, optional KMS encryption, and log group class selection. The log group serves as a centralized destination for application logs, service logs, and operational data, and is referenced by many other AWS components including Step Functions, API Gateway, and OpenSearch.

What Gets Created

• CloudWatch Log Group — a container for log streams with the specified retention, encryption, and class settings

Prerequisites

• An AWS account with credentials configured in the stack input
• An AwsKmsKey resource if enabling customer-managed encryption

Quick Start

apiVersion: aws.openmcf.org/v1
kind: AwsCloudwatchLogGroup
metadata:
  name: app-logs
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: my-org
    pulumi.openmcf.org/project: my-project
    pulumi.openmcf.org/stack.name: dev.AwsCloudwatchLogGroup.app-logs
spec:
  region: us-west-2
  retentionInDays: 30

openmcf apply -f log-group.yaml

This creates a STANDARD class log group with 30-day retention using default AWS encryption.

Configuration Reference

Required Fields

No fields are strictly required. An empty spec creates a STANDARD class log group with indefinite retention and default encryption.

Optional Fields

Validation rules:

• retentionInDays must be one of the AWS-allowed discrete values listed above
• logGroupClass must be STANDARD, INFREQUENT_ACCESS, or DELIVERY when set
• retentionInDays must not be set when logGroupClass is DELIVERY (AWS manages retention for Delivery log groups)

Examples

Standard 30-Day Retention

A general-purpose log group for application logging:

apiVersion: aws.openmcf.org/v1
kind: AwsCloudwatchLogGroup
metadata:
  name: app-logs
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: acme
    pulumi.openmcf.org/project: platform
    pulumi.openmcf.org/stack.name: dev.AwsCloudwatchLogGroup.app-logs
spec:
  region: us-west-2
  retentionInDays: 30

Encrypted Production Log Group

A log group with 90-day retention and KMS encryption for compliance workloads:

apiVersion: aws.openmcf.org/v1
kind: AwsCloudwatchLogGroup
metadata:
  name: prod-app-logs
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: acme
    pulumi.openmcf.org/project: platform
    pulumi.openmcf.org/stack.name: prod.AwsCloudwatchLogGroup.prod-app-logs
spec:
  region: us-west-2
  retentionInDays: 90
  kmsKeyId:
    valueFrom:
      kind: AwsKmsKey
      name: log-encryption-key
      fieldPath: status.outputs.key_arn

Infrequent Access for High-Volume Logs

A cost-optimized log group for VPC flow logs or CDN access logs:

apiVersion: aws.openmcf.org/v1
kind: AwsCloudwatchLogGroup
metadata:
  name: vpc-flow-logs
  labels:
    openmcf.org/provisioner: pulumi
    pulumi.openmcf.org/organization: acme
    pulumi.openmcf.org/project: networking
    pulumi.openmcf.org/stack.name: prod.AwsCloudwatchLogGroup.vpc-flow-logs
spec:
  region: us-west-2
  retentionInDays: 365
  logGroupClass: INFREQUENT_ACCESS
  kmsKeyId:
    valueFrom:
      kind: AwsKmsKey
      name: infra-key
      fieldPath: status.outputs.key_arn

Stack Outputs

Related Components

• AWS KMS Key — Customer-managed encryption key for log data
• AWS Step Function — Uses log group ARN for execution logging
• AWS HTTP API Gateway — Uses log group ARN for access logging
• AWS OpenSearch Domain — Uses log group ARN for slow logs, app logs, and audit logs