Log monitoring for AWS environments
Review the logs that Glean collects in an AWS customer-hosted environment. This page explains which logs you can export to Security Information and Event Management (SIEM) tools and which logs contain sensitive data.
Glean uses AWS CloudWatch log groups and S3 buckets to store and process logs. These logs remain in your AWS account, where you can inspect them at any time.
Limit access to the Glean environment in AWS. S3 and CloudWatch can store sensitive data, so restrict access to these resources. Also restrict access that can modify Identity and Access Management (IAM) permissions in the Glean account.
Audit log
Glean stores all audit logs in the audit-log CloudWatch log group. Integrate this log group with your SIEM to alert on and analyze user activity on the Glean platform. Because it is a CloudWatch log group, you can use AWS-native tools or AWS-native SIEM ingestion mechanisms to obtain the logs.
Sensitive logs
Glean stores logs that may contain sensitive data. These logs should not leave the Glean environment.
Glean provides a report in JSON and Markdown formats that identifies the CloudWatch log groups and S3 buckets containing sensitive and non-sensitive data. To obtain the report, you need AWS credentials from the Glean AWS account to pull content from the glean-terraform-deploy-packages S3 bucket.
The zip file contains the full Terraform deployment package for Glean. Use the following commands to retrieve it:
# Run this command with AWS credentials for your Glean AWS account
# Get the latest stable release version
RELEASE_VERSION=$(aws secretsmanager get-secret-value \
--secret-id arn:aws:secretsmanager:us-east-1:518642952506:secret:glean-stable-external-release-version-e1R7Yq \
--region us-east-1 \
--query 'SecretString' \
--output text)
# Fetch the zipped release notes
aws s3 cp s3://glean-terraform-deploy-packages/full_terraform_deploy_${RELEASE_VERSION}.zip .
After you unzip the file, the report will be available in the following locations:
- CloudWatch:
- Markdown:
terraform/glean.com/docs/aws/glean_cloudwatch_logging_resources.md - JSON:
terraform/glean.com/docs/aws/glean_cloudwatch_logging_resources/cloudwatch_log_group_sensitivity.json
- Markdown:
- S3:
- Markdown:
terraform/glean.com/docs/aws/glean_s3_resources.md - JSON:
terraform/glean.com/docs/aws/glean_cloudwatch_logging_resources/s3_sensitivity.json
- Markdown:
The JSON file is useful if you want to automate log collection for non-sensitive resources.