Export logs with S3 archiving

In SolarWinds Observability SaaS, you can archive your log messages to your own S3 bucket. After creating an Amazon Web Services account at https://aws.amazon.com and activating Amazon S3, create a bucket for log archives, and grant SolarWinds Observability SaaS access to the bucket via an IAM role in your AWS account. For more information on creating buckets, see Creating, configuring, and working with Amazon S3 buckets in the Amazon documentation. For the bucket you are creating, use the following information:

• Use a unique bucket name, such as companyname-swo-logs. The name should consist solely of lowercase letters, numbers, and hyphens. For more information, see General purpose bucket quotas, limitations, and restrictions in the Amazon documentation.
• Assign the bucket to the appropriate region.

Once you have created the bucket, follow the steps below to create an IAM role that grants SolarWinds Observability SaaS write access to the bucket. Once the bucket and IAM role have been configured, you can enable archiving in SolarWinds Observability SaaS. Navigate to Settings > Logs > Log archives, enable the Amazon S3 toggle, then enter the IAM role ARN, S3 bucket name, and, optionally, an S3 bucket path.

After setting up S3 archiving, it takes approximately 6 to 7 hours for logs to be available in the archive.

Two-hop setup

Custom S3 archiving uses a two-hop assume-role chain with an External ID. You create an IAM role in your own AWS account instead of granting access to a shared SolarWinds role. Follow these steps to set up custom S3 archiving:

1. Create an IAM role in your AWS account.

2. Add a trust policy. The principal is the SolarWinds delegation role, with a condition requiring the external ID shown in SolarWinds Observability SaaS.

   {
     "Version": "2012-10-17",
     "Statement": [{
       "Effect": "Allow",
       "Principal": { "AWS": "arn:aws:iam::851060098468:role/archivist_assumed_role" },
       "Action": "sts:AssumeRole",
       "Condition": {
         "StringEquals": { "sts:ExternalId": "<EXTERNAL-ID-FROM-SWO-UI>" }
       }
     }]
   }

   The external ID is generated per organization and displayed on the Log archives settings page. It must match exactly.

3. Grant the role permissions on your bucket.

   {
     "Version": "2012-10-17",
     "Statement": [{
       "Effect": "Allow",
       "Action": [
         "s3:PutObject",
         "s3:PutObjectAcl",
         "s3:DeleteObject",
         "s3:GetBucketLocation",
         "s3:ListBucket"
       ],
       "Resource": [
         "arn:aws:s3:::<bucket-name>",
         "arn:aws:s3:::<bucket-name>/*"
       ]
     }]
   }

   s3:GetBucketLocation and s3:ListBucket apply to the bucket ARN. s3:PutObject, s3:PutObjectAcl, and s3:DeleteObject apply to the object ARN. (If you are using a prefix, the object ARN can be narrowed to arn:aws:s3:::<bucket-name>/<prefix>/.)

4. Paste the role ARN into the SolarWinds Observability SaaS settings page and run the test upload. The test writes a small object to the bucket and then deletes it. A successful test confirms the role ARN, trust policy, external ID, and bucket permissions are all correct.