feat(ecs): log retention for FireLensLogDriver #28354
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
github-actions
bot
added
valued-contributor
…fix-firelens-publogpolicy
aws-cdk-automation
added
the
pr/needs-community-review
…fix-firelens-publogpolicy
lpizzinidev
reviewed
Dec 14, 2023
There was a problem hiding this comment.
Looks good to me! 👍
I think that this should be a feat: feat(ecs): support log retention for FireLensLogDriver.
You could add some documentation about the newly supported option here.
sakurai-ryo
changed the title
|
@lpizzinidev |
lpizzinidev
suggested changes
Dec 14, 2023
Comment on lines
1132
to
1133
| See the [Fluent Bit CloudWatch Configuration Parameters](https://docs.fluentbit.io/manual/pipeline/outputs/cloudwatch#configuration-parameters) | ||
| for more information about `log_retention_days`. |
There was a problem hiding this comment.
Suggested change
| See the [Fluent Bit CloudWatch Configuration Parameters](https://docs.fluentbit.io/manual/pipeline/outputs/cloudwatch#configuration-parameters) | |
| for more information about `log_retention_days`. | |
| > Visit [Fluent Bit CloudWatch Configuration Parameters](https://docs.fluentbit.io/manual/pipeline/outputs/cloudwatch#configuration-parameters) | |
| for more details. |
aws-cdk-automation
removed
the
pr/needs-community-review
aws-cdk-automation
added
the
pr/needs-maintainer-review
sumupitchayan
previously approved these changes
Dec 18, 2023
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
aws-cdk-automation
removed
the
pr/needs-maintainer-review
kaizencc
changed the title
mergify
bot
dismissed
sumupitchayan’s stale review
Pull request has been modified.
kaizencc
approved these changes
Dec 19, 2023
AWS CodeBuild CI Report
Powered by github-codebuild-logs, available on the AWS Serverless Application Repository |
|
Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork). |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR resolves the missing
logs:PutRetentionPolicypermission issue when usingFireLensLogDriverwith CloudWatch Logs.Description
When using
FireLensLogDriverto send logs to CloudWatch Logs, we can specify the retention period for newly created Log Groups by specifyinglog_retention_daysin theFireLensLogDriverProps.options.https://docs.fluentbit.io/manual/pipeline/outputs/cloudwatch#configuration-parameters
https://docs.aws.amazon.com/cdk/api/v2/docs/aws-cdk-lib.aws_ecs.FireLensLogDriverProps.html#options
If you have not added a FluentBit container, CDK will automatically add it to the task definition, and the IAM permissions required for this are added to the task role.
aws-cdk/packages/aws-cdk-lib/aws-ecs/lib/base/task-definition.ts
Line 816 in db22b85
aws-cdk/packages/aws-cdk-lib/aws-ecs/lib/firelens-log-router.ts
Line 170 in db22b85
While
FireLensLogDriverallows specifyinglog_retention_daysfor Log Groups, FluentBit cannot set the retention period due to the absence of thelogs:PutRetentionPolicypolicy. Consequently, it results in anAccessDeniedException.To address this, the PR adds the necessary
logs:PutRetentionPolicypermission to the task role whenlog_retention_daysis set inFireLensLogDriverProps.options, ensuring FluentBit has the required permissions to set the retention period for Log Groups.Relates to #28258
By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license