CloudWatch 上的 EC2 Docker 容器日志

Question

I have a running container on EC2 instance and I would like to populate my logs to CloudWatch in the same region.

I was trying to use this tutorial: https://docs.docker.com/config/containers/logging/awslogs/

However I have an issue related with the timeout of connection, also even though policy allows my ec2 instance to connect to the cloudwatch, when i am trying to describe anything I don't receive any response.

Do You know how to get my logs from docker container running on EC2 to cloudwatch? I have tried multiple tutorials, however wasn't able to do it.

Answer 1

To create the ECS-CloudWatchLogs IAM policy

1.Open the IAM console at https://console.aws.amazon.com/iam/ .

2.In the navigation pane, choose Policies.

3.Choose Create policy, JSON.

4.Enter the following policy:

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs: : :*" ] } ] } 5.Choose Review policy.

6.On the Review policy page, enter ECS-CloudWatchLogs for the Name and choose Create policy.

To attach the ECS-CloudWatchLogs policy to ecsInstanceRole

1.Open the IAM console at https://console.aws.amazon.com/iam/ .

2.In the navigation pane, choose Roles.

3.Choose ecsInstanceRole. If the role does not exist, follow the procedures in Amazon ECS Container Instance IAM Role to create the role.

4.Choose Permissions, Attach policies.

5.To narrow the available policies to attach, for Filter, type ECS-CloudWatchLogs.

6.Select the ECS-CloudWatchLogs policy and choose Attach policy

Answer 2

If the instance has correct permission all you need to pass the following option to your docker run command.

docker run -it --log-driver=awslogs --log-opt awslogs-region=us-west-2     --log-opt awslogs-group=myLogGroup --log-opt awslogs-create-group=true  node:alpine

You can check into aws-console , you will see log group name myLogGroup

As you also mentioned that you are getting timeout, to verify this check the below command.

 curl http://checkip.amazonaws.com

If it's not responding it means the instance does not have internet access and its in private subnet.