AWS CloudWatch Sources

An AWS source live-tails a log group in Amazon CloudWatch Logs, in a region you choose, in real time. It uses CloudWatch's StartLiveTail streaming API - new log events are pushed as they're ingested, not polled. Add one from the sidebar's + menu ▸ New AWS CloudWatch Source….

Region

Type a region code (e.g. us-east-1) or pick one from the menu. If you authenticate with a shared profile, the Region is filled in for you from your AWS config - the [default] profile's region, or the selected profile's own region when it declares one. It's always editable.

Authentication

Two methods, chosen with the Auth segment.

Access Key

Paste an IAM access key ID and secret access key. The secret is stored securely in your Keychain (never in the source's saved data or a configuration backup); only the access-key ID and your choices are saved with the source. Best for a quick setup or a dedicated read-only IAM user.

Shared Profile

Use a named profile from your ~/.aws/credentials file - the same file the AWS CLI writes. Leave File on the default ~/.aws/credentials or click Choose… to point at another file; the Profile menu then fills with the profiles found in it, and the Region auto-fills from the matching config. Only the selected profile's keys are stored - never the whole shared file. Best if you already use the AWS CLI. Under the App Store sandbox you pick the file once and it's remembered via a security-scoped bookmark.

Credentials and iCloud

Both methods sync via iCloud Keychain: your AWS credential - the access-key secret, or the selected shared profile's keys - follows you to your other Macs, so a source set up once connects everywhere without re-entering keys or having the credentials file present. Each editor shows a "syncs across your Macs via iCloud Keychain" note. If you rotate keys or switch profiles, re-pick the credentials file with Choose… (or change the Profile) and save, on the Mac that has the file, to refresh the synced copy; a save that doesn't touch the credential leaves the synced copy untouched. See iCloud Sync.

Permissions (IAM)

The identity you authenticate as needs three CloudWatch Logs actions:

logs:StartLiveTail - the live tail itself (the core feature).
logs:FilterLogEvents - the first-paint history backfill and a stream's Test Filter.
logs:DescribeLogGroups - the log-group Choose… picker and the source's Test Connection.

A minimal policy:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "logs:StartLiveTail",
      "logs:FilterLogEvents",
      "logs:DescribeLogGroups"
    ],
    "Resource": "*"
  }]
}

Attach it to a dedicated log-reader identity rather than a deployer or admin user, to keep least privilege. An identity granted only logs:StartLiveTail can still live-tail, but the picker and Test Connection (which need DescribeLogGroups) won't work for it.

Test Connection

Click Test Connection. LogRaker signs a real DescribeLogGroups request against the chosen region. Three outcomes:

✓ Connected - the credentials are valid and the region is reachable.
Credentials valid - limited access (yellow) - the keys authenticated, but this identity isn't allowed to list log groups (logs:DescribeLogGroups). Live tailing can still work if it has logs:StartLiveTail; the Choose… picker won't.
✗ Test failed - wrong keys, wrong region, no network, or another error. The result carries AWS's own message verbatim.

Streams under an AWS source

A stream under an AWS source tails one log group - see AWS CloudWatch Streams for the log-group picker, the optional server-side filter, and how history-on-connect works.