Back to Checks
aws

Elastic Beanstalk environment streams logs to CloudWatch Logs

elasticbeanstalk_environment_cloudwatch_logging_enabled
Service: elasticbeanstalkSeverity: high
OfficialBuilt-inVerified
Categories:logging
Resource Type:AwsElasticBeanstalkEnvironment

Elastic Beanstalk environments are configured to stream instance and proxy logs to Amazon CloudWatch Logs via the StreamLogs setting

Prowler logoProwlerprowler-provider-aws

Risk

Without centralized logging to CloudWatch, logs may be lost during rotation or instance termination, delaying detection and response. Attackers can delete local logs to evade audits, hiding evidence of web attacks or config tampering and undermining confidentiality, integrity, and availability.

Run this check with Prowler

Run in Prowler Cloud
Run
prowler aws --checks elasticbeanstalk_environment_cloudwatch_logging_enabled

Recommendation

Enable streaming to CloudWatch Logs. Set sensible retention, avoid deletion on termination, and restrict access with least-privilege IAM. Add metric filters and alerts for early detection, and retain archives to support forensics, accountability, and defense in depth.

Remediation

CLI

aws elasticbeanstalk update-environment --environment-name <example_resource_name> --option-settings Namespace=aws:elasticbeanstalk:cloudwatch:logs,OptionName=StreamLogs,Value=true

Terraform

resource "aws_elastic_beanstalk_environment" "<example_resource_name>" {
  name         = "<example_resource_name>"
  application  = "<example_resource_name>"
  platform_arn = "<platform_arn>"

  # Critical: Enables instance log streaming to CloudWatch Logs
  setting {
    namespace = "aws:elasticbeanstalk:cloudwatch:logs"
    name      = "StreamLogs"
    value     = "true"
  }
}

NativeIaC

Resources:
  <example_resource_name>:
    Type: AWS::ElasticBeanstalk::Environment
    Properties:
      ApplicationName: "<example_resource_name>"
      PlatformArn: "<platform_arn>"
      OptionSettings:
        - Namespace: aws:elasticbeanstalk:cloudwatch:logs
          OptionName: StreamLogs
          Value: "true"  # Critical: Enables instance log streaming to CloudWatch Logs

Other

1Open the AWS Elastic Beanstalk console and select your environment
2Go to Configuration > Updates, monitoring, and logging > Edit
3Under "Instance log streaming to CloudWatch Logs", set Log streaming to Activated
4Click Apply to save

Check Code

from prowler.lib.check.models import Check, Check_Report_AWS
from prowler.providers.aws.services.elasticbeanstalk.elasticbeanstalk_client import (
    elasticbeanstalk_client,
)


class elasticbeanstalk_environment_cloudwatch_logging_enabled(Check):
    def execute(self):
        findings = []
        for environment in elasticbeanstalk_client.environments.values():
            report = Check_Report_AWS(metadata=self.metadata(), resource=environment)
            report.status = "PASS"
            report.status_extended = f"Elastic Beanstalk environment {environment.name} is sending logs to CloudWatch Logs."

            if environment.cloudwatch_stream_logs != "true":
                report.status = "FAIL"
                report.status_extended = f"Elastic Beanstalk environment {environment.name} is not sending logs to CloudWatch Logs."

            findings.append(report)

        return findings

References