# CloudWatch

To aggregate and stream your Org's audit log data to AWS CloudWatch using the web console or the command line (RCTL).

Use the web console to configure your audit logs.

## Prerequisites

- Customize the Values file (YAML). (See [below for creating a values.yaml file](https://docs.rafay.co/integrations/siem/configure-cloudwatch/#creating--values--yaml)).
- Create a namespace in your cluster.

## Configure Workload

**Note**: Only one audit log workload is needed for an organization.

01. In the web console, select **Catalog**.
02. For Filter by Catalog, select **default-rafay**.
     
03. Select **rafay-cloudwatch**, then select **Create Workload**.
     
04. Enter a name for the workload. Example: rafay-audit-logs.
05. Select the namespace.
     
06. Click **Continue**.
07. On the Repository tab, for **Values yaml**:
    - Create a **values.yaml** file. (See [below for creating a values.yaml file](https://docs.rafay.co/integrations/siem/configure-cloudwatch/#creating--values--yaml))
    - Click **Upload Files**.
    - Select the **values.yaml** file.
    - Click **Open**.
       
08. Click **Save and Go to Placement**.
09. Update the following for Placements:
    - Select the appropriate **Drift Action**.
    - Select **Specified Clusters** for the Placement Policy.
    - Select the cluster from the cluster list.
    - Click **Save and go to Publish**.
10. Click **Publish**.

Use the Command Line Interface (RCTL) to automate reproducible workflows without having to use the web console.

## Prerequisites

- [Download RCTL](https://docs.rafay.co/cli/overview/#download-rctl)
- [Configure RCTL](https://docs.rafay.co/cli/config/)
- Customize the Values file (YAML). (See [below for creating a values.yaml file](https://docs.rafay.co/integrations/siem/configure-cloudwatch/#creating--values--yaml)).
- Create a namespace in your cluster.

**Note**: Set the correct project using RCTL.

## Create a Repository

Create a repository.yaml file using the following example. Replace **demo** with the name of the project you are adding this repository to. Optionally, you can change **helm-repo** to another name; if you change the name, use that name for **repository_ref** in the workload.yaml file (see [Create a Workload](https://docs.rafay.co/integrations/siem/configure-cloudwatch/#create--workload)).

```yaml
apiVersion: config.rafay.dev/v2
kind: Repository
metadata:
  name: helm-repo
  project: demo
spec:
  repositoryType: HelmRepository
  endpoint: https://rafaysystems.github.io/rafay-helm-charts/
  credentialType: CredentialTypeNotSet
```

Run the create repository command and include the repository.yaml file.

```bash
./rctl create repository -f repository.yaml
```

## Create a Workload

Create a workload.yaml file using the following example. Replace the names used in **clusters**, **namespace**, and **project** to match your environment where you want to publish the workload.

```yaml
name: audit-logs
namespace: ns-name
type: Helm
project: demo
clusters: demo-cluster
repository_ref: helm-repo
repo_artifact_meta:
  helm:
    chartName: rafay-cloudwatch
values: ./values.yaml
```

Run the create workload command and include the workload.yaml file.

```bash
./rctl create workload workload.yaml
```

## Publish a Workload

Run the publish workload command. Replace **workload-name** with the name used in the workload.yaml file. Example: audit-logs.

```bash
./rctl publish workload workload-name
```

---

## Values YAML File

Create a values.yaml file that contains your CloudWatch information. Use the example below and change the following:

- `rafay_api_key` - Your organization's API key. In the web console, select **My Tools > Manage Keys**.
- `rafay_api_secret` - Your organization's API Secret key. In the web console, select **My Tools > Manage Keys**.
- `secret_name` - (Optional) Specify existing k8s secret name that contains your organization's API key & secret. (See [below is an example of k8s secret](https://docs.rafay.co/integrations/siem/configure-cloudwatch/#example--k8s--secret))

```yaml
# Default values for Rafay CloudWatch audit log integration.
# This is a YAML-formatted file.
# Declare variables to be passed into your templates.

config:
  ## Rafay console URL
  url: https://console.rafay.dev
  ## Rafay API Key
  rafay_api_key: RAFAY_API_KEY
  ## Rafay API Secret
  rafay_api_secret: RAFAY_API_SECRET
  ## Send Initial logs to CloudWatch based on following value. Default to "14d" days.
  ## This value can not be greater than 14 days.
  filter: 14d
  ## Time Interval to send logs to cloudwatch
  interval: 1m
  ## CloudWatch Logs Group
  logGroup: rafay-logs
  ## CloudWatch Log Stream for auditlogs
  auditLogStream: auditlogs-prod
  ## CloudWatch Log Stream for kubectl logs
  kubectlLogStream: kubectl-logs-prod
  ## CloudWatch Log Stream for OPA logs
  opaLogStream: opa-logs-prod
  ## Create above specified logs streams.
  createLogStreams: True
  ## AWS Region
  aws_region: us-west-1
  ## Existning Secret Name or leave it empty
  secret_name: ""
image:
  repository: registry.rafay-edge.net/rafay-logs/rafay-cloudwatch
  pullPolicy: Always
  tag: 0.3.5

serviceAccount:
  create: true
  annotations: {}
  name:
rbac:
  create: true
replicaCount: 1
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
deploymentAnnotations: {}
podAnnotations: {}
resources: {}
nodeSelector: {}
tolerations: []
affinity: {}
```

---

## Example of k8s secret with API Key and Secret.

```yaml
apiVersion: v1
kind: Secret
data:
  rafaykey: cmFmYXlrZXkK
  rafaysecret: cmFmYXlzZWNyZXQK
```