Pushing logs to AWS Cloudwatch logs

Geiasou Vangelis and welcome to the UTM Community!

Thanks for your question, I didn't know that this had been added!

One possible issue might be that you configured your instance without an access key.  Are those fields completed in 'Definitions & Users >> AWS Profiles'?

Cheers - Bob

Geiasou Vangelis and welcome to the UTM Community!

Thanks for your question, I didn't know that this had been added!

One possible issue might be that you configured your instance without an access key.  Are those fields completed in 'Definitions & Users >> AWS Profiles'?

Cheers - Bob

Hi Bob

Thanks for the prompt answer.

I noticed 2 things

• Logging & Reporting -> Log Settings -> Cloudwatch, was not enabled at all. I was confused by the plain "Cloudwatch" I was expecting "Cloudwatch Logs". However, it says "All log files accessible via the Logging & Reporting section are uploaded to the Amazon CloudWatch service", so I guess this needs enabling.
• As you mention "Definitions & Users -> AWS Profile" has aws keys fields, but I haven't filled them. This also needs filling

So, I followed the instructions in https://community.sophos.com/kb/en-us/127389 However I noticed the following issues:

• When I reach in https://community.sophos.com/kb/en-us/127389 "Create the AWS Profile within UTM" -> "Navigate to AWS Management > Outbound Gateway." there is no "Outbound Gateway" page under my "AWS Management" page
• This release note https://community.sophos.com/products/unified-threat-management/b/utm-blog/posts/sophos-utm-9-506-on-aws-release-notes says "Outbound Gateway" page was added on 9.506 but I am on version 9.509-3 so I would expect to see it
• The suggested Cloudformation template refers only to "cloudwatch" actions and not as I expected "logs" actions (https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/permissions-reference-cwl.html)

I admit I am a bit confused and I might be missing something basic.

I've barely played with this, Vangelis, so I only know to go one step at a time.  When I created a UTM instance, I did not select to create a key pair, but I suspect that you cannot use CloudWatch if you didn't create the key pair when you launched the instance.  What happens if you start over doing that?

Cheers - Bob