--- title: AWS CloudWatch actions source: https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/actions-catalog/aws/aws-cloudwatch --- This page provides a reference for AWS CloudWatch actions available in the workflow automation actions catalog. Use these actions to retrieve and upload log data in AWS CloudWatch. ## Prerequisites Before using AWS actions in workflow automation, ensure you have: - An AWS account with appropriate permissions. - AWS credentials configured (IAM user credentials, IAM role ARN, or session credentials). - The necessary IAM permissions for the specific AWS services you plan to use. See [Set up AWS credentials](https://docs.newrelic.com/docs/workflow-automation/setup-and-configure/set-up-aws-credentials/) for information on how to create IAM users and IAM roles, and set up static and session AWS credentials for integration with workflow automation AWS actions. ## Get log events The action identifier is `aws.cloudwatch.getLogEvents`. Retrieves a batch of log events from a specified log stream in AWS CloudWatch Logs. The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | -------------------- | -------- | ---------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region of the target log group. | `us-east-2` | | `logStreamName` | String | Required. Name of the log stream to retrieve events from. | `2023/10/27/[$LATEST]abcdef123456` | | `logGroupName` | String | Optional. Name of the log group containing the log stream. | `/aws/lambda/my-function` | | `logGroupIdentifier` | String | Optional. ARN or name of the log group. Use instead of `logGroupName` when referencing a log group by ARN. | `arn:partition:service:region:account-id:resource` | | `startTime` | Int | Optional. Start of the time range, expressed as a Unix timestamp in milliseconds. | `1759296000000` | | `endTime` | Int | Optional. End of the time range, expressed as a Unix timestamp in milliseconds. | `1759296000000` | | `limit` | Int | Optional. Maximum number of log events to return. | `50` | | `startFromHead` | Boolean | Optional. If `true`, returns the earliest log events first. Defaults to `false`. | `true` | | `unmask` | Boolean | Optional. If `true`, returns unmasked log event data. Defaults to `false`. | `false` | | `nextToken` | String | Optional. Pagination token from a previous response to retrieve the next page of results. | `f/39218833627378687642013305455131706539523449361490509828/s` | The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | -------------- | -------- | -------------------------------------------------------------------------------------------------------------------------------------------- | | `response` | Object | `{"events": [{"timestamp": 123, "message": "string", "ingestionTime": 123}], "nextForwardToken": "string", "nextBackwardToken": "string"}` | | `success` | Boolean | `true` or `false` | | `errorMessage` | String | `"An error occurred (ExpiredTokenException) when calling the GetLogEvents operation: The security token included in the request is expired"` | The following example workflow shows how to use this action. ```yaml name: get-lambda-logs description: 'Retrieve log events from an AWS Lambda function' workflowInputs: region: type: String defaultValue: us-east-2 logGroupName: type: String defaultValue: /aws/lambda/my-function logStreamName: type: String defaultValue: 2023/10/27/[$LATEST]abcdef123456 steps: - name: get_events_step type: action action: aws.cloudwatch.getLogEvents version: '1' inputs: region: ${{ .workflowInputs.region }} logGroupName: ${{ .workflowInputs.logGroupName }} logStreamName: ${{ .workflowInputs.logStreamName }} limit: 100 next: end ``` ## Upload log events The action identifier is `aws.cloudwatch.putLogEvents`. Uploads a batch of log events to the specified log stream in AWS CloudWatch Logs. The following table describes the input fields for this action. | **Input** | **Type** | **Description** | **Example** | | -------------------- | -------- | ------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | `awsRoleArn` | String | Optional. IAM role ARN to assume for AWS API calls. | `arn:aws:iam::123456789012:role/my-workflow-role` | | `awsAccessKeyId` | String | Optional. AWS access key ID. Pass as a secret. | `${{ :secrets:awsAccessKeyId }}` | | `awsSecretAccessKey` | String | Optional. AWS secret access key. Pass as a secret. | `${{ :secrets:awsSecretAccessKey }}` | | `awsSessionToken` | String | Optional. Temporary session token for STS authentication. Pass as a secret. | `${{ :secrets:awsSessionToken }}` | | `region` | String | Required. AWS region of the target log group. | `us-east-2` | | `logGroupName` | String | Required. Name of the log group to upload events to. | `/aws/lambda/hello-you` | | `logStreamName` | String | Required. Name of the log stream to upload events to. | `2025/09/24/[$LATEST]09f7ca9e9ab044f389419ce60305f594` | | `logEvents` | List | Required. List of log events to upload. Each event must include a `timestamp` (Unix milliseconds) and a `message` string. | `[{"timestamp": 1698384000000, "message": "Workflow task started."}]` | | `entity` | Dict | Optional. Entity metadata to associate with the log events for New Relic entity correlation. | `{"keyAttributes": {"ResourceType": "AWS::ElasticLoadBalancingV2::LoadBalancer", "Identifier": "app/my-web-lb/12345", "Environment": "Production"}, "attributes": {"MonitoringTier": "Gold"}}` | The following table describes the output fields for this action. | **Output** | **Type** | **Example** | | -------------- | -------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------ | | `response` | Object | `{"nextSequenceToken": "string", "rejectedLogEventsInfo": {"tooNewLogEventStartIndex": 123, "tooOldLogEventEndIndex": 123, "expiredLogEventEndIndex": 123}}` | | `success` | Boolean | `true` or `false` | | `errorMessage` | String | `"An error occurred (ExpiredTokenException) when calling the PutLogEvents operation: The security token included in the request is expired"` | The following example workflow shows how to use this action. ```yaml name: put-custom-logs description: 'Upload a batch of custom log events to CloudWatch' workflowInputs: region: type: String defaultValue: us-east-2 logGroupName: type: String defaultValue: my-custom-app-logs logStreamName: type: String defaultValue: instance-01-thread-01 steps: - name: upload_logs type: action action: aws.cloudwatch.putLogEvents version: '1' inputs: region: ${{ .workflowInputs.region }} logGroupName: ${{ .workflowInputs.logGroupName }} logStreamName: ${{ .workflowInputs.logStreamName }} logEvents: - timestamp: 1698384000000 message: "Workflow started successfully" - timestamp: 1698384005000 message: "Step 1 completed" next: end ```