Elastic Beanstalk streams logs to CloudWatch Logs

Check ID: elasticbeanstalk_environment_cloudwatch_logging_enabled
Provider: AWS
Service: elasticbeanstalk
Severity: HIGH
Categories: logging
Resource type: AwsElasticBeanstalkEnvironment

What this check verifies

Elastic Beanstalk environments are configured to stream instance and proxy logs to Amazon CloudWatch Logs via the StreamLogs setting

Risk

Without centralized logging to CloudWatch, logs may be lost during rotation or instance termination, delaying detection and response. Attackers can delete local logs to evade audits, hiding evidence of web attacks or config tampering and undermining confidentiality, integrity, and availability.

Recommendation

Enable streaming to CloudWatch Logs. Set sensible retention, avoid deletion on termination, and restrict access with least-privilege IAM. Add metric filters and alerts for early detection, and retain archives to support forensics, accountability, and defense in depth.

Remediation

CLI
Terraform
Native IaC
Dashboard steps

aws elasticbeanstalk update-environment --environment-name <example_resource_name> --option-settings Namespace=aws:elasticbeanstalk:cloudwatch:logs,OptionName=StreamLogs,Value=true

resource "aws_elastic_beanstalk_environment" "<example_resource_name>" {
  name         = "<example_resource_name>"
  application  = "<example_resource_name>"
  platform_arn = "<platform_arn>"

  # Critical: Enables instance log streaming to CloudWatch Logs
  setting {
    namespace = "aws:elasticbeanstalk:cloudwatch:logs"
    name      = "StreamLogs"
    value     = "true"
  }
}

Resources:
  <example_resource_name>:
    Type: AWS::ElasticBeanstalk::Environment
    Properties:
      ApplicationName: "<example_resource_name>"
      PlatformArn: "<platform_arn>"
      OptionSettings:
        - Namespace: aws:elasticbeanstalk:cloudwatch:logs
          OptionName: StreamLogs
          Value: "true"  # Critical: Enables instance log streaming to CloudWatch Logs

References

Where this check fires

This check runs on every scheduled scan against your AWS account. Findings appear at Cloud Security → Findings filterable by Check ID = elasticbeanstalk_environment_cloudwatch_logging_enabled. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

← Back to AWS checks

ElastiCache Redis replication group has AUTH enabled Elastic Beanstalk has enhanced health reporting on

​What this check verifies

​Risk

​Recommendation

​Remediation

​References

​Where this check fires

What this check verifies

Risk

Recommendation

Remediation

References

Where this check fires