Supported log destinations and permissions

The following table shows which destinations each AWS service supports for sending logs, and which permissions version is required.

Log source	Log type	Logs sent to CloudWatch Logs	Logs sent to Amazon S3	Logs sent to Firehose	Traces sent to X-Ray
Amazon API Gateway access logs	Vended logs	Supported (V1 permissions)
Application Load Balancer access logs	Vended logs	Supported [V2 Permissions]	Supported [V2 Permissions]	Supported [V2 Permissions]
AWS AppSync logs	Custom logs	Supported
Amazon Aurora MySQL logs	Custom logs	Supported
Amazon Bedrock Knowledge bases logging	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Bedrock Agent logging	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Bedrock AgentCore Runtime	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Bedrock AgentCore Gateway	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Bedrock AgentCore Identity	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Bedrock AgentCore Memory	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Bedrock AgentCore Payments	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Bedrock AgentCore Tools	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Chime media quality metric logs and SIP message logs	Vended logs	Supported (V1 permissions)
CloudFront: access logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
AWS CloudHSM audit logs	Custom logs	Supported
CloudWatch Evidently evaluation event logs	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)
CloudWatch Internet Monitor logs	Vended logs		Supported (V1 permissions)
Create a delivery source for CloudWatch Logs Insights query execution logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
CloudTrail logs	Custom logs	Supported
AWS CodeBuild logs	Custom logs	Supported
Amazon CodeWhisperer event logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Cognito logs	Vended logs	Supported (V1 permissions)
Amazon Connect Customer logs	Custom logs	Supported
AWS DataSync logs	Custom logs	Supported
AWS DevOps Agent logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon ElastiCache (Redis OSS) logs	Vended logs	Supported (V1 permissions)		Supported (V1 permissions)
AWS Elastic Beanstalk logs	Custom logs	Supported
Amazon Elastic Container Service logs	Custom logs	Supported
Amazon Elastic Kubernetes Service Auto Mode logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Elastic Kubernetes Service Capability Logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Elastic Kubernetes Service control plane logs	Vended logs	Supported
AWS Elemental MediaPackage access logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
AWS Elemental MediaTailor logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
AWS Entity Resolution logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon EventBridge Pipes logging	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)	Supported (V1 permissions)
Amazon EventBridge event buses	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
AWS Fargate logs	Custom logs	Supported
AWS Fault Injection Service experiment logs	Vended logs		Supported (V1 permissions)
Amazon FinSpace	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)	Supported (V1 permissions)
AWS Global Accelerator flow logs	Vended logs		Supported (V1 permissions)
AWS Glue job logs	Custom logs	Supported
IAM Identity Center error logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Interactive Video Service chat logs	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)	Supported (V1 permissions)
AWS IoT logs	Custom logs	Supported
AWS IoT FleetWise logs	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)	Supported (V1 permissions)
AWS Lambda logs	Vended logs	Supported	Supported	Supported
Amazon Macie logs	Custom logs	Supported
AWS Mainframe Modernization	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)	Supported (V1 permissions)
Amazon Managed Service for Prometheus logs	Vended logs	Supported (V1 permissions)
Amazon MSK broker logs	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)	Supported (V1 permissions)
Amazon MSK Connect logs	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)	Supported (V1 permissions)
Amazon MQ logs	Custom logs	Supported
AWS Network Firewall logs	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)	Supported (V1 permissions)
AWS Network Firewall Proxy logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Network Load Balancer access logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
OpenSearch logs	Custom logs	Supported
Amazon OpenSearch Service ingestion logs	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)	Supported (V1 permissions)
AWS PCS logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Q Business connector logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Q Business conversation logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Q in Connect AI agent event logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Quick logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Relational Database Service PostgreSQL logs	Custom logs	Supported
Amazon Route 53 Global Resolver query logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Route 53 public DNS query logs	Vended logs	Supported
Amazon Route 53 resolver query logs	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)
AWS RTB Fabric logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
AWS Security Hub CSPM	Vended logs	Supported (V2 permissions)
AWS Security Hub	Vended logs	Supported (V2 permissions)
AWS Shield Advanced attack flow logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Simple Storage Service server access logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon SageMaker AI events	Vended logs	Supported (V1 permissions)
Amazon SageMaker AI worker events	Vended logs	Supported (V1 permissions)
AWS Site-to-Site VPN logs	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)	Supported (V1 permissions)
Amazon Simple Email Service logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
Amazon Simple Notification Service logs	Custom logs	Supported
Amazon Simple Notification Service data protection policy logs	Custom logs	Supported
EC2 Spot Instance data feed files	Vended logs		Supported (V1 permissions)
AWS Step Functions Express Workflow and Standard Workflow logs	Vended logs	Supported (V1 permissions)
Storage Gateway audit logs and health logs	Vended logs	Supported (V1 permissions)
AWS Transfer Family logs	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)	Supported (V1 permissions)
AWS Verified Access logs	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)	Supported (V1 permissions)
Amazon Virtual Private Cloud flow logs	Vended logs	Supported	Supported (V1 permissions)	Supported (V1 permissions)
Amazon VPC Lattice access logs	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)	Supported (V1 permissions)
Amazon VPC Route Server	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)
AWS WAF logs	Vended logs	Supported (V1 permissions)	Supported (V1 permissions)	Supported
Amazon WorkMail audit logs	Vended logs	Supported (V2 permissions)	Supported (V2 permissions)	Supported (V2 permissions)

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Enable logging from AWS services

Logging that requires additional permissions [V1]