feat(ecs): log retention for FireLensLogDriver#28354
Merged
mergify[bot] merged 9 commits intoaws:mainfrom Dec 19, 2023
Merged
Conversation
…fix-firelens-publogpolicy
…fix-firelens-publogpolicy
lpizzinidev
reviewed
Dec 14, 2023
Contributor
lpizzinidev
left a comment
There was a problem hiding this comment.
Looks good to me! 👍
I think that this should be a feat: feat(ecs): support log retention for FireLensLogDriver.
You could add some documentation about the newly supported option here.
Contributor
Author
|
@lpizzinidev |
lpizzinidev
suggested changes
Dec 14, 2023
Contributor
lpizzinidev
left a comment
There was a problem hiding this comment.
Small documentation nit.
Comment on lines
+1132
to
+1133
| See the [Fluent Bit CloudWatch Configuration Parameters](https://docs.fluentbit.io/manual/pipeline/outputs/cloudwatch#configuration-parameters) | ||
| for more information about `log_retention_days`. |
Contributor
There was a problem hiding this comment.
Suggested change
| See the [Fluent Bit CloudWatch Configuration Parameters](https://docs.fluentbit.io/manual/pipeline/outputs/cloudwatch#configuration-parameters) | |
| for more information about `log_retention_days`. | |
| > Visit [Fluent Bit CloudWatch Configuration Parameters](https://docs.fluentbit.io/manual/pipeline/outputs/cloudwatch#configuration-parameters) | |
| for more details. |
sumupitchayan
previously approved these changes
Dec 18, 2023
Contributor
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
Pull request has been modified.
kaizencc
approved these changes
Dec 19, 2023
Collaborator
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
Contributor
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR resolves the missing
logs:PutRetentionPolicypermission issue when usingFireLensLogDriverwith CloudWatch Logs.Description
When using
FireLensLogDriverto send logs to CloudWatch Logs, we can specify the retention period for newly created Log Groups by specifyinglog_retention_daysin theFireLensLogDriverProps.options.https://docs.fluentbit.io/manual/pipeline/outputs/cloudwatch#configuration-parameters
https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ecs.FireLensLogDriverProps.html#options
If you have not added a FluentBit container, CDK will automatically add it to the task definition, and the IAM permissions required for this are added to the task role.
aws-cdk/packages/aws-cdk-lib/aws-ecs/lib/base/task-definition.ts
Line 816 in db22b85
aws-cdk/packages/aws-cdk-lib/aws-ecs/lib/firelens-log-router.ts
Line 170 in db22b85
While
FireLensLogDriverallows specifyinglog_retention_daysfor Log Groups, FluentBit cannot set the retention period due to the absence of thelogs:PutRetentionPolicypolicy. Consequently, it results in anAccessDeniedException.To address this, the PR adds the necessary
logs:PutRetentionPolicypermission to the task role whenlog_retention_daysis set inFireLensLogDriverProps.options, ensuring FluentBit has the required permissions to set the retention period for Log Groups.Relates to #28258
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license