Looking for how to use this in your app?See Frontend Libraries →

CloudWatch Logs

Use the AWS Cloud Development Kit (AWS CDK) to create an Amazon CloudWatch log group and grant your app the permissions it needs. For more on adding custom AWS resources to your Amplify backend, see Custom resources.

Set up a CloudWatch log group

amplify/backend.ts
import { defineBackend } from "@aws-amplify/backend";
import { auth } from "./auth/resource";
import { data } from "./data/resource";
import { Policy, PolicyStatement } from "aws-cdk-lib/aws-iam";
import { LogGroup } from "aws-cdk-lib/aws-logs";
const backend = defineBackend({
const loggingStack = backend.createStack("logging-stack");
// Create a CloudWatch log group
const logGroup = new LogGroup(loggingStack, "LogGroup", {
  logGroupName: "/app/my-app",
// Grant log write permissions to authenticated users
const loggingPolicy = new Policy(loggingStack, "LoggingPolicy", {
  statements: [
    new PolicyStatement({
      actions: [
        "logs:CreateLogStream",
        "logs:PutLogEvents",
        "logs:DescribeLogStreams",
      resources: [logGroup.logGroupArn],
backend.auth.resources.authenticatedUserIamRole.attachInlinePolicy(loggingPolicy);

If you are not using the CDK, ensure your authenticated IAM role has permission to write to your target log group:

  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Action": [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
      "logs:DescribeLogStreams"
    "Resource": "arn:aws:logs:<region>:<account-id>:log-group:<log-group-name>:*"

For more information, see the Amazon CloudWatch Logs documentation.

Next steps

Use the CloudWatch client to send logs from your app.

View logs