Configure Amazon IoT logging

1. Under Select trusted entity, choose Amazon Service. Then choose IoT under Use case. If you don't see IoT, enter and search IoT from the Use cases for other Amazon services: drop-down menu. Select Next.

2. On the Add permissions page, you will see the policies that are automatically attached to the service role. Choose Next.

3. On the Name, review, and create page, enter a Role name and Role description for the role, then choose Create role.

To configure Amazon IoT logging:

1. Sign in to the Amazon IoT console. For more information, see Open the Amazon IoT console.

2. In the left navigation pane, choose Logs (previously a section under Settings).

3. Configure account-level logging: account level logging applies to all your Amazon IoT fleet (devices or endpoints), unless overridden by event-level or resource-specific settings.

   1. Under Account-level logging, select Manage account-level logging to make updates.

   2. Select the "Enable logging" checkbox to start sending logs to CloudWatch. When “Enable logging” is unchecked, Amazon IoT will not send any logs to CloudWatch log groups, regardless of event-level or resource-level logging configurations.

   3. Under IAM log role, select an existing role from the dropdown list. You can View role details to inspect role permissions. Alternatively, select Create new role to set up a new IAM role. The logging role provides policies that allow Amazon IoT to submit log entries to CloudWatch on your behalf. If you configure event-level logging with a custom CloudWatch log group, you must update the role policy to include the ARN for this log group.

   4. Choose the Default Log level that corresponds to the level of detail of the log entries that you want to appear in the CloudWatch Logs. Note: Log level “DEBUG” provides the most detail but increases CloudWatch costs. CloudWatch log group destinations cannot be configured at the account level. However, you can specify custom log groups for individual event types as described in the following section.

   5. Choose Update logging to save your changes.

4. Event-level logging allows you to selectively capture logs for relevant events and direct them to dedicated CloudWatch log groups. This gives you the flexibility to organize logs by use cases for better discoverability, share them with different audiences, and reduce CloudWatch costs by enabling logs and setting log levels based on event criticality.

   Configure event-level logging: event-level logging captures specific Amazon IoT events, such as client authentication attempts. These settings override Account-Level Logging.

   1. Under Event-level logging section, select Manage event-level logging to make updates.

   2. By default, event types inherit the account-level logging configuration. Note: When resource-specific logging is configured, it overrides account and event-level settings.

   3. To modify settings for individual events, click the value in the corresponding event row. You can adjust both the log level and the CloudWatch log group destination. When specifying a custom CloudWatch log group destination, you must verify that the IAM role policy includes permissions for the new log group. Failure to update the role policy will prevent Amazon IoT from writing logs to the custom log group. After making your selection, click the check mark to confirm your choice. The 'Is Modified' column will display 'Yes' to indicate pending changes.

   4. Click on Update Logging to apply your changes or choose Cancel to discard.

5. Configure Resource-specific overrides: Resource-specific overrides apply a logging setting to selected resources. A resource can be a thing group, source IP, client ID, or principal ID. Resource-specific logging configuration overrides both account-level and event-level settings. When enabled, it generates logs for all event types at the configured logging level for the specified resources. For example, you can set debug-level logging for a specific Thing while keeping info-level logging for all other Things.

   1. Select Add resource-specific overrides in the Resource-specific overrides section.

   2. Choose a log target: Thing group, Source IP, Client ID or Principal ID.

   3. Enter the corresponding log target value for your selected target type.

   4. Select the desired log level from the dropdown menu in the Resource-specific log level section.

   5. Click Submit to add the override or Cancel to discard changes.

   6. To modify an existing resource-specific override, select the checkbox next to the resource and click “Remove” to delete the override or “Edit” to modify.

To use the CLI to configure default logging for Amazon IoT

1. Use the set-v2-logging-options command to set the logging options for your account.

   aws iot set-v2-logging-options \
       --event-configurations event-configuration-list \
       --role-arn logging-role-arn \
       --default-log-level log-level

   where:

   --role-arn

   The role ARN that grants Amazon IoT permission to write to your logs in CloudWatch Logs. Role-arn configuration is required for initial setup.

   --default-log-level

   The log level to use. Valid values are: ERROR, WARN, INFO, DEBUG, or DISABLED. Default-log-level configuration is required for initial setup.

   --no-disable-all-logs

   An optional parameter that enables all Amazon IoT logging. Use this parameter to enable logging when it is currently disabled.

   --disable-all-logs

   An optional parameter that disables all Amazon IoT logging. Use this parameter to disable logging when it is currently enabled.

   --event-configurations

   This parameter is optional and allows you to customize logging settings for individual event types:

   • eventType: The type of event that overrides the account-level setting

   • logLevel: Override the account-level setting with DEBUG, INFO, ERROR, WARN, or DISABLED

   • logDestination: Specify a custom CloudWatch log group for log delivery

   You can configure logging level and log destination independently for each event type. If not specified, events will inherit the account-level settings

   aws iot set-v2-logging-options \
       --event-configurations "[{\"eventType\":\"Publish-In\",\"logLevel\":\"INFO\",\"logDestination\":\"examplePublishInLogGroup\"}]"

2. Use the get-v2-logging-options command to get your current logging options.

   aws iot get-v2-logging-options \
       --verbose

   where:

   --verbose

   An optional parameter that enables you to retrieve all eventTypes and their configurations.

To use the CLI to configure Resource-specific overrides for Amazon IoT

1. Enable account-level logging before configuring resource-specific logging using the following command: aws iot set-v2-logging-options command

2. Use the set-v2-logging-level command to configure Resource-specific overrides. See the following example for thing group configuration:

   aws iot set-v2-logging-level \
                 --log-target targetType=THING_GROUP,targetName=thing_group_name \
                 --log-level log_level

   --log-target

   The type and name of the resource for which you are configuring logging. The targetType value must be one of: THING_GROUP | CLIENT_ID | SOURCE_IP | PRINCIPAL_ID. The log-target parameter value can be text, as shown in the preceding command example, or a JSON string, such as the following example.

   aws iot set-v2-logging-level \
                 --log-target '{"targetType": "THING_GROUP","targetName": "thing_group_name"}' \
                 --log-level log_level

   --log-level

   The logging level used when generating logs for the specified resource. Valid values are: DEBUG, INFO, ERROR, WARN, and DISABLED.

3. Use the list-v2-logging-levels command to list the currently configured logging levels.

   aws iot list-v2-logging-levels

4. Use the delete-v2-logging-level command to delete a resource-specific logging level, such as the following examples.

   aws iot delete-v2-logging-level \
                 --target-type "THING_GROUP" \
                 --target-name "thing_group_name"

   aws iot delete-v2-logging-level \
                 --target-type=CLIENT_ID 
                 --target-name=ClientId1

   --target-type

   The target-type value must be one of: THING_GROUP | CLIENT_ID | SOURCE_IP | PRINCIPAL_ID.

   --target-name

   The name of the thing group for which to remove the logging level.