Amazon S3 Logs

​

Prerequisites

1. Enabled OIDC in your env zero organization.
2. Configured an Identity provider as explained in Set up an AWS OIDC authentication Guide.

​

Setup

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "s3:PutObject"
            ],
            "Resource": "arn:aws:s3:::<YOUR_BUCKET_NAME>/*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetBucketLocation"
            ],
            "Resource": "arn:aws:s3:::<YOUR_BUCKET_NAME>"
        }
    ]
}

​

Self Configuration of S3 Transporter

1. ​

   In the env zero app

2. ​

   Using environment variables

   In the env zero platform you will need to configure the following environment variables in any scope to forward the deployment logs. These are the relevant environment variables:

   Environment variable name	Description	Mandatory
   ENV0_S3_LOG_ROLE_ARN	The ARN of the IAM role associated with your OIDC provider.	Yes
   ENV0_S3_LOG_BUCKET_NAME	The name of the S3 bucket where logs will be stored.	Yes
   ENV0_S3_LOG_AWS_REGION	The AWS region where your S3 bucket is located.	Yes
   ENV0_S3_LOG_BUCKET_PATH	An optional path (prefix) within the bucket to store the logs.	No
   ENV0_S3_LOG_SESSION_DURATION	The OIDC token session duration in seconds. Defaults to 3600 (1 hour) if not set.	No

1. ​

   Audit Logs:

   • bucket path - env0-audits

2. ​

   Deployment Logs:

   • bucket path - env0-deployments

​

Next steps

• Logs Forwarding Overview - See all supported log forwarding destinations.
• Amazon CloudWatch - Alternative: forward logs to CloudWatch log groups.
• Splunk Logs - Alternative: forward logs to Splunk.