spec:
  additionalPolicies:
    master: |
      [
        {
          "Effect": "Allow",
          "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
          "Resource": ["*"]
        }
      ]
    node: |
      [
        {
          "Effect": "Allow",
          "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
          "Resource": ["*"]
        }
      ]
  docker:
    logDriver: awslogs
    logLevel: warn
    logOpt:
    - awslogs-region=us-east-2
    - awslogs-group=<%= ENV["TF_VAR_cluster_name"] %>
    - "tag='{{.Name}}'"
  iam:
    legacy: true

spec:
  additionalPolicies:
    master: |
      [
        {
          "Effect": "Allow",
          "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
          "Resource": ["*"]
        }
      ]
    node: |
      [
        {
          "Effect": "Allow",
          "Action": ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
          "Resource": ["*"]
        }
      ]
  docker:
    logDriver: awslogs
    logLevel: warn
    logOpt:
    - awslogs-region=us-east-2
    - awslogs-group=<%= ENV["TF_VAR_cluster_name"] %>
    - "tag='{{.Name}}'"
  hooks:
  - execContainer:
      command:
      - sh
      - -c
      - >
        chroot /rootfs apt-get update &&
        chroot /rootfs curl https://s3.amazonaws.com/aws-cloudwatch/downloads/latest/awslogs-agent-setup.py -o /tmp/awslog.py &&
        echo -e "[general]\n" > /rootfs/etc/awslog.conf &&
        echo -e "\n[/var/log/syslog]\nfile = /var/log/syslog\nbuffer_duration = 5000\nlog_stream_name = {instance_id}-syslog\ninitial_position = start_of_file\nlog_group_name = <%= ENV["TF_VAR_cluster_name"] %>" >> /rootfs/etc/awslog.conf &&
        echo -e "\n[/var/log/auth.log]\nfile = /var/log/auth.log\nbuffer_duration = 5000\nlog_stream_name = {instance_id}-auth.log\ninitial_position = start_of_file\nlog_group_name = <%= ENV["TF_VAR_cluster_name"] %>" >> /rootfs/etc/awslog.conf &&
        echo -e "\n[/var/log/messages]\nfile = /var/log/messages\nbuffer_duration = 5000\nlog_stream_name = {instance_id}-messages\ninitial_position = start_of_file\nlog_group_name = <%= ENV["TF_VAR_cluster_name"] %>" >> /rootfs/etc/awslog.conf &&
        chroot /rootfs python /tmp/awslog.py -n --region us-east-2 -c /etc/awslog.conf
      image: busybox
  iam:
    legacy: true

Send system logs to CloudWatch
Send system logs to CloudWatch
