AWS CloudWatch actions

This page provides a reference for AWS CloudWatch actions available in the workflow automation actions catalog. Use these actions to retrieve and upload log data in AWS CloudWatch.

Prerequisites

Before using AWS actions in workflow automation, ensure you have:

An AWS account with appropriate permissions.
AWS credentials configured (IAM user credentials, IAM role ARN, or session credentials).
The necessary IAM permissions for the specific AWS services you plan to use.

See Set up AWS credentials for information on how to create IAM users and IAM roles, and set up static and session AWS credentials for integration with workflow automation AWS actions.

Get log events

The action identifier is aws.cloudwatch.getLogEvents.

Retrieves a batch of log events from a specified log stream in AWS CloudWatch Logs.

The following table describes the input fields for this action.

Input	Type	Description	Example
`awsRoleArn`	String	Optional. IAM role ARN to assume for AWS API calls.	`arn:aws:iam::123456789012:role/my-workflow-role`
`awsAccessKeyId`	String	Optional. AWS access key ID. Pass as a secret.	`${{ :secrets:awsAccessKeyId }}`
`awsSecretAccessKey`	String	Optional. AWS secret access key. Pass as a secret.	`${{ :secrets:awsSecretAccessKey }}`
`awsSessionToken`	String	Optional. Temporary session token for STS authentication. Pass as a secret.	`${{ :secrets:awsSessionToken }}`
`region`	String	Required. AWS region of the target log group.	`us-east-2`
`logStreamName`	String	Required. Name of the log stream to retrieve events from.	`2023/10/27/[$LATEST]abcdef123456`
`logGroupName`	String	Optional. Name of the log group containing the log stream.	`/aws/lambda/my-function`
`logGroupIdentifier`	String	Optional. ARN or name of the log group. Use instead of `logGroupName` when referencing a log group by ARN.	`arn:partition:service:region:account-id:resource`
`startTime`	Int	Optional. Start of the time range, expressed as a Unix timestamp in milliseconds.	`1759296000000`
`endTime`	Int	Optional. End of the time range, expressed as a Unix timestamp in milliseconds.	`1759296000000`
`limit`	Int	Optional. Maximum number of log events to return.	`50`
`startFromHead`	Boolean	Optional. If `true`, returns the earliest log events first. Defaults to `false`.	`true`
`unmask`	Boolean	Optional. If `true`, returns unmasked log event data. Defaults to `false`.	`false`
`nextToken`	String	Optional. Pagination token from a previous response to retrieve the next page of results.	`f/39218833627378687642013305455131706539523449361490509828/s`

The following table describes the output fields for this action.

Output	Type	Example
`response`	Object	`{"events": [{"timestamp": 123, "message": "string", "ingestionTime": 123}], "nextForwardToken": "string", "nextBackwardToken": "string"}`
`success`	Boolean	`true` or `false`
`errorMessage`	String	`"An error occurred (ExpiredTokenException) when calling the GetLogEvents operation: The security token included in the request is expired"`

The following example workflow shows how to use this action.

name: get-lambda-logs
description: 'Retrieve log events from an AWS Lambda function'
workflowInputs:
  region:
    type: String
    defaultValue: us-east-2
  logGroupName:
    type: String
    defaultValue: /aws/lambda/my-function
  logStreamName:
    type: String
    defaultValue: 2023/10/27/[$LATEST]abcdef123456
steps:
  - name: get_events_step
    type: action
    action: aws.cloudwatch.getLogEvents
    version: '1'
    inputs:
      region: ${{ .workflowInputs.region }}
      logGroupName: ${{ .workflowInputs.logGroupName }}
      logStreamName: ${{ .workflowInputs.logStreamName }}
      limit: 100
    next: end

Upload log events

The action identifier is aws.cloudwatch.putLogEvents.

Uploads a batch of log events to the specified log stream in AWS CloudWatch Logs.