Sending capacity provider system logs to CloudWatch Logs

By default, Lambda automatically captures system logs for your capacity provider and sends them to CloudWatch Logs, provided your capacity provider's operator role has the necessary permissions. These logs are stored in a log group named /aws/lambda/capacity-provider/<capacity-provider-name>. If needed, you can configure your capacity provider to send logs to a different log group using the Lambda console, AWS CLI, or Lambda API. For more information, see Configuring CloudWatch log groups.

You can view logs for your capacity provider using the Lambda console, the CloudWatch console, the AWS Command Line Interface (AWS CLI), or the CloudWatch API. For more information, see Viewing CloudWatch logs for capacity providers.

Required IAM permissions

Your capacity provider's operator role needs the following permissions to upload logs to CloudWatch Logs:

To learn more, see Using identity-based policies (IAM policies) for CloudWatch Logs in the Amazon CloudWatch User Guide.

You can add these CloudWatch Logs permissions using the AWSLambdaManagedEC2ResourceOperator AWS managed policy provided by Lambda. To add this policy to your role, run the following command:

aws iam attach-role-policy --role-name your-role --policy-arn arn:aws:iam::aws:policy/AWSLambdaManagedEC2ResourceOperator

For more information, see Lambda operator role for Lambda Managed Instances.

Pricing

There is no additional charge for using capacity provider system logs; however, standard CloudWatch Logs charges apply. For more information, see CloudWatch pricing.