AWS Amazon CloudWatch Logs

What authentication does the CloudWatch Logs API use?

CloudWatch Logs uses AWS Signature Version 4 (SigV4) HMAC request signing scoped to the logs IAM service. Through Jentic, AWS credentials sit in the encrypted vault and signing happens at execution time so the agent never sees the raw secret.

Can I run a Logs Insights query with the CloudWatch Logs API?

Yes. StartQuery accepts a query string written in the Logs Insights query language plus log group names and a time range, and returns a queryId. Poll GetQueryResults with that ID until status reaches Complete to retrieve the results.

How do I export logs to S3 through Jentic?

Search Jentic for 'export cloudwatch logs to s3', load the CreateExportTask schema, supply the log group name, time range, destination bucket, and prefix, and Jentic will sign and execute the call. Track progress via DescribeExportTasks.

What are the rate limits for the CloudWatch Logs API?

Per-region quotas apply, including default TPS limits on PutLogEvents, FilterLogEvents, and Logs Insights queries, plus account-wide caps on log groups and metric filters. Check the CloudWatch Logs service quotas in the AWS console for the values in your account.

Can the CloudWatch Logs API redact sensitive fields automatically?

Yes. PutDataProtectionPolicy attaches a JSON policy to a log group that identifies sensitive data types such as credit card numbers and email addresses, then masks them at ingest. Authorized principals can read the unmasked values via specific policy permissions.

Can I forward log events to a Lambda function?

Yes. PutSubscriptionFilter on a log group with a destination ARN pointing at a Lambda function streams matching log events to that function in near real time. The function must grant logs.amazonaws.com permission to invoke it.

Can I limit what my agent is allowed to do with the CloudWatch Logs API?

Yes. Because you run Jentic One yourself, your own rules decide which CloudWatch Logs operations and credentials the agent may use. CloudWatch Logs carries log group names in the request body rather than the URL path, so you scope by operation rather than by path prefix: grant only what the agent needs, such as StartQuery and GetQueryResults for read-only investigation. Destructive operations like DeleteLogGroup and DeleteDestination stay off the agent's list unless you explicitly add them.