<p>We are using Kubernetes to deploy our application docker images.</p>

<p>We would like to be able to take the application logs and push it to cloudwatch.</p>

<p>The application logs are generated using log4j or log4js depending on what language the microservice was built.</p>

<p>What is the right way to do this?</p>

<p>Build containers with the Cloudwatch Agent installed; <a href="https://docs.docker.com/engine/reference/builder/" rel="nofollow noreferrer">to do this you will need a <code>Dockerfile</code></a>. <a href="http://docs.aws.amazon.com/AmazonECS/latest/developerguide/using_cloudwatch_logs.html" rel="nofollow noreferrer">Amazon even has docs specifically for this</a>.</p>

<p>You will need to make sure your base container is either Debian or RHEL based (Amazon docs seem to only support these types of distros with the agent); for example, Debian based systems will have the agent installed with:</p>

<pre><code>curl https://s3.amazonaws.com//aws-cloudwatch/downloads/latest/awslogs-agent-setup.py -O
</code></pre>

<p>So, you will need to execute the above when you build the container.</p>

<p>Details for installation are <a href="http://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/QuickStartEC2Instance.html" rel="nofollow noreferrer">here</a>.</p>

<p>You mentioned IAM policy concerns; <a href="http://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/EC2NewInstanceCWL.html" rel="nofollow noreferrer">Amazons example policy is below</a>; you will need to make sure that your containers have access.</p>

<pre><code>{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogGroup",
                "logs:CreateLogStream",
                "logs:PutLogEvents",
                "logs:DescribeLogStreams"
            ],
            "Resource": [
                "arn:aws:logs:*:*:*"
            ]
        },
        {
            "Effect": "Allow",
            "Action": [
                "s3:GetObject"
            ],
            "Resource": [
                "arn:aws:s3:::myawsbucket/*"
            ]
        }
    ]
}
</code></pre>

<p>Someone on <a href="https://github.com/SergeyZh/docker-awslogs/blob/master/Dockerfile#L5-L9" rel="nofollow noreferrer">GitHub has done this already</a>:</p>

<pre><code>FROM ubuntu:latest
MAINTAINER Ryuta Otaki &lt;otaki.ryuta@classmethod.jp&gt;, Sergey Zhukov &lt;sergey@jetbrains.com&gt;
...
RUN apt-get install -q -y python python-pip wget
RUN cd / ; wget https://s3.amazonaws.com/aws-cloudwatch/downloads/latest/awslogs-agent-setup.py
</code></pre>

<p>I highly suggest you follow their lead; use Ubuntu and follow the docs. Don't re-invent the wheel.</p>
