aws-glue-job-log-event
ETL code and connector errors can echo arguments, records, and credentials into CloudWatch Logs.
Where it sits
| location | CloudWatch Logs Glue job/crawler log event.message |
|---|
| location kind | log_field |
|---|
| data kinds | credential password api_key access_key secret_key customer_data pii |
|---|
| emits edge | ContainsCredential |
|---|
| service | Glue (aws:glue) |
|---|
Collection recipe
| access mode | indirect_destination |
|---|
| operation | logs:FilterLogEvents |
|---|
| response path | Events[].Message |
|---|
| encoding | string |
|---|
| params | {"LogGroupName": "\u003cglue-log-group\u003e"} |
|---|
Required permissions
logs:FilterLogEvents
glue:GetJobRun
References