Prerequisites Step 1: Create or identify a VPC Step 2: Create a security group Step 3: Create the VPC endpoint Step 4: Create a log group Step 5: Add a resource policy Step 6: Create the syslog configuration Step 7: Verify delivery and field extraction

Setting up syslog ingestion

This section walks you through the steps to set up syslog ingestion into CloudWatch Logs. You will create a VPC endpoint for the syslog service, a log group to receive the messages, a resource policy to authorize the syslog service, and a syslog configuration that routes traffic from your VPC endpoint to your log group.

You can perform all of these steps using the AWS Management Console, the AWS CLI, or the AWS SDKs. The following instructions provide both console and AWS CLI examples.

Prerequisites

The IAM identity (user or role) that you use to set up syslog ingestion must have permissions to create VPC endpoints, log groups, resource policies, and syslog configurations. The following example policy shows the minimum required permissions:


{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:CreateLogGroup",
        "logs:PutResourcePolicy",
        "logs:DeleteResourcePolicy",
        "logs:PutSyslogConfiguration",
        "logs:ListSyslogConfigurations",
        "logs:DeleteSyslogConfiguration"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "ec2:CreateVpc",
        "ec2:ModifyVpcAttribute",
        "ec2:CreateSubnet",
        "ec2:CreateSecurityGroup",
        "ec2:AuthorizeSecurityGroupIngress",
        "ec2:CreateVpcEndpoint",
        "ec2:ModifyVpcEndpoint",
        "ec2:DescribeVpcEndpoints"
      ],
      "Resource": "*"
    }
  ]
}

Note

If you already have a VPC, subnet, and security group, you only need the ec2:CreateVpcEndpoint, ec2:ModifyVpcEndpoint, and ec2:DescribeVpcEndpoints permissions for the EC2 actions.

Step 1: Create or identify a VPC

You need a VPC that is reachable from your on-premises network (via VPN or Direct Connect) where your syslog-generating devices reside. If you already have a VPC connected to your data center, skip this step and use your existing VPC and subnet IDs.

Note

The VPC endpoint creates an elastic network interface (ENI) with a private IP in your subnet. Your on-premises devices reach this IP via your VPN or Direct Connect connection. Ensure your network routing allows traffic from your devices to the subnet CIDR.

Step 2: Create a security group

Create a security group for the VPC endpoint that allows inbound syslog traffic from your VPC. This controls which resources can send syslog to the endpoint.

Tip

If you only plan to use one protocol (for example, TCP+TLS on port 6514), you only need to open that port in the security group.

Step 3: Create the VPC endpoint

Create an interface VPC endpoint pointing to the syslog AWS PrivateLink service. This gives your VPC a private entry point to the CloudWatch Logs syslog service.

Note

You can specify multiple subnet IDs across different Availability Zones when creating the endpoint. The endpoint creates an ENI in each subnet, providing higher availability without needing separate VPC endpoints per Availability Zone. A single VPC endpoint with subnets in multiple Availability Zones is sufficient.

Step 4: Create a log group

Create the CloudWatch Logs log group where your syslog messages will be delivered. You can use any log group name. We recommend using a /syslog/ prefix for organizational clarity.

You do not need to create a log stream. The syslog service automatically creates a log stream named VPCE_ID_Syslog_Region (for example, vpce-0abc123def456_Syslog_us-east-1) when the first message is delivered.

Step 5: Add a resource policy

The CloudWatch Logs syslog service writes to your log group using the syslog.logs.amazonaws.com Service Principal. You must grant it permission via a resource policy on your log group. The aws:SourceArn condition ensures only traffic from your specific VPC endpoint can write to this log group.


ACCOUNT_ID=$(aws sts get-caller-identity --query 'Account' --output text)

aws logs put-resource-policy \
  --policy-name syslog-ingestion \
  --policy-document '{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "syslog.logs.amazonaws.com"
      },
      "Action": [
        "logs:PutLogEvents",
        "logs:CreateLogStream"
      ],
      "Resource": "arn:aws:logs:'$REGION':'$ACCOUNT_ID':log-group:/syslog/my-devices:*",
      "Condition": {
        "StringEquals": {
          "aws:SourceAccount": "'$ACCOUNT_ID'"
        },
        "ArnEquals": {
          "aws:SourceArn": "arn:aws:ec2:'$REGION':'$ACCOUNT_ID':vpc-endpoint/'$VPCE_ID'"
        }
      }
    }
  ]
}' \
  --region $REGION

The conditions in the resource policy provide the following protections:

aws:SourceAccount – Prevents confused deputy attacks. Only your account's traffic is accepted.
aws:SourceArn – Scopes access to a specific VPC endpoint. If you have multiple VPC endpoints, add each one as a separate ARN in the condition.

To allow multiple VPC endpoints to write to the same log group, use the ArnLike condition operator with a wildcard:


"ArnLike": {
    "aws:SourceArn": "arn:aws:ec2:us-east-1:123456789012:vpc-endpoint/*"
}

Step 6: Create the syslog configuration

This step tells the CloudWatch Logs syslog service that traffic arriving from your VPC endpoint should be routed to your log group. Without this configuration, traffic from your endpoint is rejected.

Your syslog ingestion pipeline is now active. Any syslog messages sent to the VPC endpoint will be delivered to the /syslog/my-devices log group.

Step 7: Verify delivery and field extraction

Send a test message from any EC2 host or device that can reach the VPC endpoint, then use CloudWatch Log Analytics to verify that the message was delivered and that structured fields were extracted correctly. Messages typically appear within 10–20 seconds.

Send a test message (TCP plaintext):


echo "<134>1 $(date -u +%Y-%m-%dT%H:%M:%SZ) myhost myapp 1234 - - Hello from syslog" | \
  nc $VPCE_DNS 1514

Verify delivery and extracted fields:

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Syslog ingestion

Device configuration

Setting up syslog ingestion

Prerequisites

Note

Step 1: Create or identify a VPC

To create a VPC (console)

Note

Step 2: Create a security group

To create a security group (console)

Tip

Step 3: Create the VPC endpoint

Note

To create the VPC endpoint (console)

Step 4: Create a log group

To create a log group (console)

Step 5: Add a resource policy

Step 6: Create the syslog configuration

To create the syslog configuration (console)

Step 7: Verify delivery and field extraction

To verify delivery using Log Analytics (console)