# Enable logging from AWS services
<a name="AWS-logs-and-resource-policy"></a>

Use the searchable catalog to find an AWS service and open its logging setup guide. For more information about the destinations and permissions models for each service, see [Supported log destinations and permissions](AWS-logs-destinations-table.md).

Many services publish logs only to CloudWatch Logs, but others use vended log delivery to send logs directly to Amazon Simple Storage Service or Amazon Data Firehose. Direct delivery is useful when your main requirement is long-term storage or processing in one of those destinations.

Even when you publish logs directly to Amazon S3 or Firehose, CloudWatch delivery charges apply. If you send logs to Amazon S3, then `{{AWS_REGION}}-S3-Egress-Bytes` charges appear in Cost Explorer or on your bill. If you send logs to Firehose, then `{{AWS_REGION}}-FH-Egress-Bytes` charges appear. For more information about vended logs pricing, see the **Logs** tab at [Amazon CloudWatch Pricing](https://aws.amazon.com/cloudwatch/pricing/).

Some services require additional permissions before they can deliver logs. Without these permissions, log delivery fails. In the comparison table, services that use the original permissions model are labeled **Supported (V1 permissions)**. Services that use the current model are labeled **Supported (V2 permissions)**. Each label links to the required policies.
| Service | Guide |
| --- | --- |
| Amazon API Gateway | [Guide](https://docs.aws.amazon.com/apigateway/latest/developerguide/set-up-logging.html) |
| Application Load Balancer | [Guide](https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-access-logs.html) |
| AWS AppSync | [Guide](https://docs.aws.amazon.com/appsync/latest/devguide/monitoring.html) |
| Amazon Aurora MySQL | [Guide](https://docs.aws.amazon.com/AmazonRDS/latest/AuroraUserGuide/AuroraMySQL.Integrating.CloudWatch.html) |
| Amazon Bedrock AgentCore Gateway | [Guide](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/gateway.html) |
| Amazon Bedrock AgentCore Identity | [Guide](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/identity.html) |
| Amazon Bedrock AgentCore Memory | [Guide](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/memory.html) |
| Amazon Bedrock AgentCore Payments | [Guide](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/payments.html) |
| Amazon Bedrock AgentCore Runtime | [Guide](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/agents-tools-runtime.html) |
| Amazon Bedrock AgentCore Tools | [Guide](https://docs.aws.amazon.com/bedrock-agentcore/latest/devguide/built-in-tools.html) |
| Amazon Bedrock Agents | [Guide](https://docs.aws.amazon.com/bedrock/latest/userguide/model-invocation-logging.html) |
| Amazon Bedrock Knowledge Bases | [Guide](https://docs.aws.amazon.com/bedrock/latest/userguide/knowledge-bases-logging.html) |
| Amazon Chime | [Guide](https://docs.aws.amazon.com/chime/latest/ag/monitoring-cloudwatch.html#cw-logs) |
| Amazon CloudFront | [Guide](https://docs.aws.amazon.com/AmazonCloudFront/latest/DeveloperGuide/AccessLogs.html) |
| AWS CloudHSM | [Guide](https://docs.aws.amazon.com/cloudhsm/latest/userguide/get-hsm-audit-logs-using-cloudwatch.html) |
| AWS CloudTrail | [Guide](https://docs.aws.amazon.com/awscloudtrail/latest/userguide/monitor-cloudtrail-log-files-with-cloudwatch-logs.html) |
| CloudWatch Evidently | [Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-Evidently-datastorage.html#CloudWatch-Evidently-datastorage-logformat) |
| CloudWatch Internet Monitor | [Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/CloudWatch-IM-view-cw-tools.S3_athena.html) |
| CloudWatch Logs Insights query execution logs | [Guide](https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-vended-logs-permissions-V2.html#vended-logs-insights-query-execution-source) |
| AWS CodeBuild | [Guide](https://docs.aws.amazon.com/codebuild/latest/userguide/getting-started-build-log-console.html) |
| Amazon CodeWhisperer | [Guide](https://docs.aws.amazon.com/eventbridge/latest/ref/events-ref-codewhisperer.html) |
| Amazon Cognito | [Guide](https://docs.aws.amazon.com/cognito/latest/developerguide/what-is-amazon-cognito.html) |
| Amazon Connect | [Guide](https://docs.aws.amazon.com/connect/latest/adminguide/logging-and-monitoring.html) |
| AWS DataSync | [Guide](https://docs.aws.amazon.com/datasync/latest/userguide/monitor-datasync.html#cloudwatchlogs) |
| AWS DevOps Agent | [Guide](https://docs.aws.amazon.com/devopsagent/latest/userguide/configuring-capabilities-for-aws-devops-agent-vended-logs-and-metrics.html) |
| EC2 Spot Instance | [Guide](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/spot-data-feeds.html) |
| Amazon ECS | [Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_cloudwatch_logs.html) |
| Amazon ECS Action Logs | [Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/action-logs-getting-started.html) |
| Amazon EKS Auto Mode | [Guide](https://docs.aws.amazon.com/eks/latest/userguide/auto-managed-component-logs.html) |
| Amazon EKS Capability Logs | [Guide](https://docs.aws.amazon.com/eks/latest/userguide/capabilities-controller-logs.html) |
| Amazon EKS Control Plane | [Guide](https://docs.aws.amazon.com/eks/latest/userguide/control-plane-logs.html) |
| AWS Elastic Beanstalk | [Guide](https://docs.aws.amazon.com/elasticbeanstalk/latest/dg/AWSHowTo.cloudwatchlogs.html) |
| Amazon ElastiCache (Redis OSS) | [Guide](https://docs.aws.amazon.com/AmazonElastiCache/latest/red-ug/Log_Delivery.html) |
| AWS Elemental MediaPackage | [Guide](https://docs.aws.amazon.com/mediapackage/latest/ug/access-logging.html) |
| AWS Elemental MediaTailor | [Guide](https://docs.aws.amazon.com/mediatailor/latest/ug/monitoring-cw-logs.html) |
| AWS Entity Resolution | [Guide](https://docs.aws.amazon.com/entityresolution/latest/userguide/what-is-service.html) |
| Amazon EventBridge Event Bus (Custom) | [Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-custom-bus-observability.html) |
| Amazon EventBridge Event Buses | [Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-event-bus-logs.html) |
| Amazon EventBridge Pipes | [Guide](https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-pipes-logs.html) |
| AWS Fargate | [Guide](https://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_awslogs.html) |
| AWS Fault Injection Service | [Guide](https://docs.aws.amazon.com/fis/latest/userguide/monitoring-logging.html) |
| Amazon FinSpace | [Guide](https://docs.aws.amazon.com/finspace/latest/userguide/finspace-what-is.html) |
| AWS Global Accelerator | [Guide](https://docs.aws.amazon.com/global-accelerator/latest/dg/monitoring-global-accelerator.flow-logs.html) |
| AWS Glue | [Guide](https://docs.aws.amazon.com/glue/latest/dg/monitor-continuous-logging.html) |
| IAM Identity Center | [Guide](https://docs.aws.amazon.com/singlesignon/latest/userguide/logging-ad-sync-errors.html) |
| AWS IoT | [Guide](https://docs.aws.amazon.com/iot/latest/developerguide/cloud-watch-logs.html) |
| AWS IoT FleetWise | [Guide](https://docs.aws.amazon.com/iot-fleetwise/latest/developerguide/logging-cw.html) |
| Amazon IVS Chat | [Guide](https://docs.aws.amazon.com/ivs/latest/LowLatencyUserGuide/chat-logging.html) |
| AWS Lambda | [Guide](https://docs.aws.amazon.com/lambda/latest/dg/monitoring-cloudwatchlogs.html) |
| Amazon Macie | [Guide](https://docs.aws.amazon.com/macie/latest/user/discovery-jobs-monitor-cw-logs.html) |
| AWS Mainframe Modernization | [Guide](https://docs.aws.amazon.com/m2/latest/userguide/what-is-m2.html) |
| Amazon Managed Service for Prometheus | [Guide](https://docs.aws.amazon.com/prometheus/latest/userguide/CW-logs.html) |
| Amazon MQ | [Guide](https://docs.aws.amazon.com/amazon-mq/latest/developer-guide/configure-logging-monitoring-activemq.html) |
| Amazon MSK | [Guide](https://docs.aws.amazon.com/msk/latest/developerguide/msk-logging.html) |
| Amazon MSK Connect | [Guide](https://docs.aws.amazon.com/msk/latest/developerguide/msk-connect-logging.html) |
| AWS Network Firewall | [Guide](https://docs.aws.amazon.com/network-firewall/latest/developerguide/firewall-logging.html) |
| AWS Network Firewall Proxy | [Guide](https://docs.aws.amazon.com/network-firewall/latest/developerguide/proxy-logging-and-monitoring.html) |
| Network Load Balancer | [Guide](https://docs.aws.amazon.com/elasticloadbalancing/latest/network/load-balancer-access-logs.html) |
| Amazon OpenSearch Ingestion | [Guide](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/monitoring-pipeline-logs.html) |
| Amazon OpenSearch Service | [Guide](https://docs.aws.amazon.com/opensearch-service/latest/developerguide/createdomain-configure-slow-logs.html) |
| AWS PCS | [Guide](https://docs.aws.amazon.com/pcs/latest/userguide/monitoring-overview.html) |
| Amazon Q Business Connectors | [Guide](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/connectors-list.html) |
| Amazon Q Business Conversations | [Guide](https://docs.aws.amazon.com/amazonq/latest/qbusiness-ug/cw-logs-enable-logging.html) |
| Amazon Q in Connect AI agents | [Guide](https://docs.aws.amazon.com/connect/latest/adminguide/monitor-q-assistants-cloudwatch.html) |
| Amazon Quick | [Guide](https://docs.aws.amazon.com/quick/latest/userguide/monitoring-cloudwatch-logs.html) |
| Amazon RDS PostgreSQL | [Guide](https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/USER_LogAccess.Concepts.PostgreSQL.html#USER_LogAccess.PostgreSQL.PublishtoCloudWatchLogs) |
| Amazon Route 53 Global Resolver | [Guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/gr-monitoring.html) |
| Amazon Route 53 Public DNS | [Guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/logging-monitoring.html) |
| Amazon Route 53 Resolver | [Guide](https://docs.aws.amazon.com/Route53/latest/DeveloperGuide/resolver-query-logs-choosing-target-resource.html) |
| AWS RTB Fabric | [Guide](https://docs.aws.amazon.com/rtb-fabric/latest/userguide/what-is-rtb-fabric.html) |
| Amazon S3 | [Guide](https://docs.aws.amazon.com/AmazonS3/latest/userguide/ServerLogs.html) |
| Amazon SageMaker AI Events | [Guide](https://docs.aws.amazon.com/sagemaker/latest/dg/logging-cloudwatch.html) |
| Amazon SageMaker AI Worker Events | [Guide](https://docs.aws.amazon.com/sagemaker/latest/dg/workteam-private-tracking.html) |
| AWS Security Hub | [Guide](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub-v2.html) |
| AWS Security Hub CSPM | [Guide](https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html) |
| Amazon SES | [Guide](https://docs.aws.amazon.com/ses/latest/dg/eb-logging.html) |
| AWS Shield Advanced | [Guide](https://docs.aws.amazon.com/waf/latest/developerguide/ddos-flow-logs.html) |
| AWS Site-to-Site VPN | [Guide](https://docs.aws.amazon.com/vpn/latest/s2svpn/monitoring-logs.html) |
| Amazon SNS | [Guide](https://docs.aws.amazon.com/sns/latest/dg/sms_stats_cloudwatch.html#sns-viewing-cloudwatch-logs) |
| Amazon SNS Data Protection | [Guide](https://docs.aws.amazon.com/sns/latest/dg/sns-message-data-protection-operations.html) |
| AWS Step Functions | [Guide](https://docs.aws.amazon.com/step-functions/latest/dg/cw-logs.html) |
| AWS Storage Gateway | [Guide](https://docs.aws.amazon.com/storagegateway/latest/userguide/monitoring-file-gateway.html) |
| AWS Transfer Family | [Guide](https://docs.aws.amazon.com/transfer/latest/userguide/structured-logging.html) |
| AWS Verified Access | [Guide](https://docs.aws.amazon.com/verified-access/latest/ug/access-logs.html) |
| Amazon VPC Flow Logs | [Guide](https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs-s3.html) |
| Amazon VPC Lattice | [Guide](https://docs.aws.amazon.com/vpc-lattice/latest/ug/monitoring-access-logs.html) |
| Amazon VPC Route Server | [Guide](https://docs.aws.amazon.com/vpc/latest/userguide/dynamic-routing-route-server.html) |
| AWS WAF | [Guide](https://docs.aws.amazon.com/waf/latest/developerguide/logging-destinations.html) |
| Amazon WorkMail | [Guide](https://docs.aws.amazon.com/workmail/latest/adminguide/monitoring-audit-logging.html) |