Wählen Sie Ihre Cookie-Einstellungen aus

Wir verwenden essentielle Cookies und ähnliche Tools, die für die Bereitstellung unserer Website und Services erforderlich sind. Wir verwenden Performance-Cookies, um anonyme Statistiken zu sammeln, damit wir verstehen können, wie Kunden unsere Website nutzen, und Verbesserungen vornehmen können. Essentielle Cookies können nicht deaktiviert werden, aber Sie können auf „Anpassen“ oder „Ablehnen“ klicken, um Performance-Cookies abzulehnen.

Wenn Sie damit einverstanden sind, verwenden AWS und zugelassene Drittanbieter auch Cookies, um nützliche Features der Website bereitzustellen, Ihre Präferenzen zu speichern und relevante Inhalte, einschließlich relevanter Werbung, anzuzeigen. Um alle nicht notwendigen Cookies zu akzeptieren oder abzulehnen, klicken Sie auf „Akzeptieren“ oder „Ablehnen“. Um detailliertere Entscheidungen zu treffen, klicken Sie auf „Anpassen“.

Präferenzen
Kontakt
Feedback
AWS Documentation
AWS-Konto erstellen

AMS aggregated service logs

PDF
RSS
Fokusmodus
AMS aggregated service logs - AMS Advanced User Guide
Diese Seite wurde nicht in Ihre Sprache übersetzt. Übersetzung anfragen

Each AWS service logs to either CloudWatch Logs or a specific location in an Amazon S3 bucket.

Note

Unless specifically stated, all log locations are local to the account that generated the logs, and are not aggregated into the central Logging account.

To find the default AMS CloudTrail trail names in SALZ and MALZ accounts, go to the AWS Console for CloudTrail and then to the Trails page and search for AMS. Because AMS resources have tags, you can find the trails this way. Example AMS CloudTrail tag:

Environment	  AMSInfrastructure

To access your logs, ensure that you have one of the required IAM roles and are in your AMS account. Then navigate to the directory shown.

Multi-Account Landing Zone
AMS multi-account landing zone Aggregated Service Logs
  Service name Log details Log location

1

Amazon Aurora

General, slow query, and error logs.

CloudWatch LogGroup: /aws/rds/cluster/{database_name}/{log_name}

2

AWS CloudFormation (CFN)

API call logging only.

AWS CloudFormation API calls are documented via CloudTrail, which sends its logs to the CloudWatch LogGroup and then syncs the logs into an S3 bucket. Logs are retained for 14 days by default in the CloudWatch LogGroup, and are retained indefinitely in the S3 bucket.

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-ams-a{account_ID}-log-management-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

3

Amazon CloudFront (CloudFront)

User request logging. CloudFront logging must be explicitly enabled. For information, see Enabling logging for supported services.

S3 bucket: ams-a{account_ID}-log-management-{region}

Path: AWS/RedShift/{CloudFront distribution ID}

4

Amazon CloudWatch (CloudWatch)

API call logging only.

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

5

Amazon Elastic Block Store (Amazon EBS)

No logs are produced by the EBS service.

Not applicable

6

Amazon Elastic Compute Cloud (Amazon EC2)

System and application logs.

For information, see the Amazon Elastic Compute Cloud (Amazon EC2) - system level logs.

CloudWatch Logs: /{instance ID}

7

Amazon Elastic File System (Amazon EFS)

API call logging only.

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

8

Elastic Load Balancing (ELB)

Access and error log entries.

Elastic load balancers log all requests sent to them, including requests that aren't routed to back-end instances. For example, if a client sends a malformed request, or there are no healthy instances to respond, the request is still logged.

For more information about Elastic Load Balancing log entries, see

API call logs:

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

Access logs:

S3 bucket: mc-a{account_ID}-logs{region}

Path: aws/elbaccess

9

Amazon OpenSearch Service (OpenSearch Service)

Service error logs.

You must explicitly enable OpenSearch logging. For information, see Enabling logging for supported services

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

10

Amazon ElastiCache

API call logging only.

CloudWatch LogGroup: //CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

11

Amazon GuardDuty

12

Amazon Inspector

13

Amazon Macie

14

Amazon Redshift

Connection, user, and activity logs.

Logging is enabled by default when you create your Redshift cluster by invoking the Create Redshift cluster CT (ct-1malj7snzxrkr).

For information, see Database Audit Logging.

S3 bucket: ams-a{account_ID}-log-management-{region}

Path: /AWS/RedShift/{CloudFront Distribution ID}

15

Amazon Relational Database Service (RDS)

Logs specific to database type.

You must explicitly enable RDS logging. For information, see Enabling logging for supported services

You can only access MSSQL logs through a stored procedure; for information, see Archiving Log Files.

CloudWatch LogGroup:

/aws/rds/(instance or cluster)/{database_name}/{log_name}

16

Amazon S3 (S3)

Bucket access logs. Each access log record provides details about a single access request such as the requester, bucket name, request time, request action, response status, and error code (if any). Access log information can be useful in security and access audits. It can also help you learn about your customer base and understand your Amazon S3 bill.

For more information about S3 Access Log entries, see S3 Server Access Log Format.

S3 bucket: mc-a{account_ID}-log-management-{region}

Path: /aws/s3access/{bucket_name}

S3 bucket [in the central Logging Account]: aws-landing-zone-s3-access-logs-{account_ID}-{region}

Path: /

17

Amazon Simple Email Service (SES)

SES API service calls.

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

18

Amazon Virtual Private Cloud (VPC)

VPC flow data (information about the IP traffic going to and from your VPC's network interfaces).

CloudWatch LogGroup:

/aws/vpcflow/{VPC_ID}

19

Auto Scaling

API call logging only.

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

20

AWS Certificate Manager

21

AWS CodeDeploy

Instance-specific deployment logs.

On Instance

22

AWS Config

AWS Config API service calls.

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

Resource configuration changes, as tracked by AWS Config.

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/Config/

23

AWS Database Migration Service

Database migration logs.

For information, see Introducing log management in AWS Database Migration Service.

Database migration console

24

AWS Direct Connect (DX)

API call logging only.

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

25

AWS Glacier

26

AWS IAM (IAM)

27

AWS Key Management Service

28

AWS Management Console (console or AWS Console)

29

AWS Simple Notification Service (SNS)

30

AWS Simple Queueing Service (SQS)

Single-Account Landing Zone
AMS single-account landing zone Aggregated Service Logs
  Service name Log details Log location

1

Amazon Aurora

General, slow query, and error logs.

CloudWatch LogGroup: /aws/rds/cluster/{database_name}/{log_name}

2

Amazon CloudFormation (CloudFormation or CFN)

API call logging only.

CloudFormation API calls are documented via CloudTrail, which sends its logs to the CloudWatch LogGroup and then syncs the logs into an S3 bucket.

CloudWatch LogGroup: /aws/ams/cloudtrail

S3 bucket: ams-a{account_ID}-log-management-{region}

3

Amazon CloudFront (CloudFront)

User request logging.

You must explicitly enable CloudFront logging. For information, see Enabling logging for supported services

S3 bucket: ams-a{account_ID}-log-management-{region}

Path: AWS/RedShift/{CloudFront_distribution_ID}

4

Amazon CloudWatch (CloudWatch)

API call logging only.

CloudWatch LogGroup: /aws/ams/cloudtrail

5

Amazon Elastic Block Store (EBS)

No logs are produced by the EBS service.

Not applicable

6

Amazon Elastic Compute Cloud (EC2)

System and application logs.

For information, see the Amazon Elastic Compute Cloud (Amazon EC2) - system level logs.

CloudWatch Logs: /{instance_ID}

7

Amazon Elastic File System (Amazon EFS)

API call logging only.

CloudWatch LogGroup: /aws/ams/cloudtrail

8

Elastic Load Balancing (ELB)

Access and error log entries.

Elastic load balancers log all requests sent to them, including requests that aren't routed to back-end instances. For example, if a client sends a malformed request, or there are no healthy instances to respond, the request is still logged.

For more information about elastic load balancer log entries, see

CloudWatch LogGroup: /aws/ams/cloudtrail

S3 bucket: mc-a{account_ID}-logs-{region}

Path: aws/elbaccess

9

Amazon OpenSearch Service (OpenSearch Service)

Service error logs.

You must explicitly enable OpenSearch logging. For information, see Enabling logging for supported services

CloudWatch LogGroup: /aws/ams/cloudtrail

10

Amazon ElastiCache

API call logging only.

CloudWatch LogGroup: /aws/ams/cloudtrail

11

Amazon GuardDuty

12

Amazon Inspector

13

Amazon Macie

14

Amazon Redshift

Connection, user, and activity logs.

Logging is enabled by default when you create your Redshift cluster by invoking the Create Redshift cluster CT (ct-1malj7snzxrkr).

For information, see Database Audit Logging.

S3 bucket: ams-a{account_ID}-log-management-{region}

Path: /AWS/RedShift/{CloudFront_Distribution_ID}

15

Amazon Relational Database Service (RDS)

Logs specific to database type.

RDS logging must be explicitly enabled. For information, see Enabling logging for supported services

You can only access MSSQL logs through a stored procedure; for information, see Archiving Log Files.

CloudWatch LogGroup: /aws/rds/(instance|cluster)/{database name}/{log name}

16

Amazon S3 (S3)

Bucket access logs. Each access log record provides details about a single access request, such as: requester, bucket name, request time, request action, response status, and error code (if any). Access log information can be useful in security and access audits; it can also help you learn about your customer base and understand your Amazon S3 bill.

For more information on S3 Access Log entries, see S3 Server Access Log Format.

S3 bucket: mc-a{account_ID}-log-management-{region}

Path: /aws/s3access/{bucket_name}

17

Amazon Simple Email Service (SES)

SES API service calls.

CloudWatch LogGroup: /aws/ams/cloudtrail

S3 bucket: ams-a{account_ID}-log-management-{region}

Path: AWS/CloudTrail/AWSLogs/{account_ID}/CloudTrail/{region}

18

Amazon Virtual Private Cloud (VPC)

VPC flow data (information about the IP traffic going to and from your VPC's network interfaces).

CloudWatch LogGroup: /aws/vpcflow/{vpc_id}

19

Auto Scaling

API call logging only.

CloudWatch LogGroup: /aws/ams/cloudtrail

20

AWS Certificate Manager

21

AWS CodeDeploy

Instance specific deployment logs.

On instance

22

AWS Config

AWS Config API service calls.

CloudWatch LogGroup: /aws/ams/cloudtrail

S3 bucket: ams-a{account_ID}-log-management-{region}

Path: AWS/CloudTrail/AWSLogs/{account_ID}/CloudTrail/{region}

23

AWS Database Migration Service

Database migration logs.

For information, see Introducing log management in AWS Database Migration Service.

Database migration console

24

AWS Direct Connect (DX)

API call logging only.

CloudWatch LogGroup: /aws/ams/cloudtrail

25

AWS Glacier

26

AWS IAM (IAM)

27

AWS Key Management Service

28

AWS Management Console (console or AWS Console)

29

AWS Simple Notification Service (SNS)

30

AWS Simple Queueing Service (SQS)

anchoranchor
AMS multi-account landing zone Aggregated Service Logs
  Service name Log details Log location

1

Amazon Aurora

General, slow query, and error logs.

CloudWatch LogGroup: /aws/rds/cluster/{database_name}/{log_name}

2

AWS CloudFormation (CFN)

API call logging only.

AWS CloudFormation API calls are documented via CloudTrail, which sends its logs to the CloudWatch LogGroup and then syncs the logs into an S3 bucket. Logs are retained for 14 days by default in the CloudWatch LogGroup, and are retained indefinitely in the S3 bucket.

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-ams-a{account_ID}-log-management-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

3

Amazon CloudFront (CloudFront)

User request logging. CloudFront logging must be explicitly enabled. For information, see Enabling logging for supported services.

S3 bucket: ams-a{account_ID}-log-management-{region}

Path: AWS/RedShift/{CloudFront distribution ID}

4

Amazon CloudWatch (CloudWatch)

API call logging only.

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

5

Amazon Elastic Block Store (Amazon EBS)

No logs are produced by the EBS service.

Not applicable

6

Amazon Elastic Compute Cloud (Amazon EC2)

System and application logs.

For information, see the Amazon Elastic Compute Cloud (Amazon EC2) - system level logs.

CloudWatch Logs: /{instance ID}

7

Amazon Elastic File System (Amazon EFS)

API call logging only.

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

8

Elastic Load Balancing (ELB)

Access and error log entries.

Elastic load balancers log all requests sent to them, including requests that aren't routed to back-end instances. For example, if a client sends a malformed request, or there are no healthy instances to respond, the request is still logged.

For more information about Elastic Load Balancing log entries, see

API call logs:

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

Access logs:

S3 bucket: mc-a{account_ID}-logs{region}

Path: aws/elbaccess

9

Amazon OpenSearch Service (OpenSearch Service)

Service error logs.

You must explicitly enable OpenSearch logging. For information, see Enabling logging for supported services

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

10

Amazon ElastiCache

API call logging only.

CloudWatch LogGroup: //CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

11

Amazon GuardDuty

12

Amazon Inspector

13

Amazon Macie

14

Amazon Redshift

Connection, user, and activity logs.

Logging is enabled by default when you create your Redshift cluster by invoking the Create Redshift cluster CT (ct-1malj7snzxrkr).

For information, see Database Audit Logging.

S3 bucket: ams-a{account_ID}-log-management-{region}

Path: /AWS/RedShift/{CloudFront Distribution ID}

15

Amazon Relational Database Service (RDS)

Logs specific to database type.

You must explicitly enable RDS logging. For information, see Enabling logging for supported services

You can only access MSSQL logs through a stored procedure; for information, see Archiving Log Files.

CloudWatch LogGroup:

/aws/rds/(instance or cluster)/{database_name}/{log_name}

16

Amazon S3 (S3)

Bucket access logs. Each access log record provides details about a single access request such as the requester, bucket name, request time, request action, response status, and error code (if any). Access log information can be useful in security and access audits. It can also help you learn about your customer base and understand your Amazon S3 bill.

For more information about S3 Access Log entries, see S3 Server Access Log Format.

S3 bucket: mc-a{account_ID}-log-management-{region}

Path: /aws/s3access/{bucket_name}

S3 bucket [in the central Logging Account]: aws-landing-zone-s3-access-logs-{account_ID}-{region}

Path: /

17

Amazon Simple Email Service (SES)

SES API service calls.

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

18

Amazon Virtual Private Cloud (VPC)

VPC flow data (information about the IP traffic going to and from your VPC's network interfaces).

CloudWatch LogGroup:

/aws/vpcflow/{VPC_ID}

19

Auto Scaling

API call logging only.

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

20

AWS Certificate Manager

21

AWS CodeDeploy

Instance-specific deployment logs.

On Instance

22

AWS Config

AWS Config API service calls.

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

Resource configuration changes, as tracked by AWS Config.

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/Config/

23

AWS Database Migration Service

Database migration logs.

For information, see Introducing log management in AWS Database Migration Service.

Database migration console

24

AWS Direct Connect (DX)

API call logging only.

CloudWatch LogGroup: /CloudTrail/Landing-Zone-Logs

S3 bucket [in the central Logging Account]: aws-landing-zone-logs-{account_ID}-{region}

Path: /AWSLogs/{account_ID}/CloudTrail/

25

AWS Glacier

26

AWS IAM (IAM)

27

AWS Key Management Service

28

AWS Management Console (console or AWS Console)

29

AWS Simple Notification Service (SNS)

30

AWS Simple Queueing Service (SQS)

DatenschutzNutzungsbedingungen für die WebsiteCookie-Einstellungen
© 2025, Amazon Web Services, Inc. oder Tochtergesellschaften. Alle Rechte vorbehalten.