Better Stack offers a deeply integrated experience with AWS, allowing you to seamlessly monitor your cloud infrastructure.

Deploy our prepared CloudFormation template into your AWS account to gain comprehensive observability. This integration provides:

• Automatic ingestion of all CloudWatch metrics.
• Detection and per-log-group optional ingestion of all CloudWatch log groups.
• Automatic integration with CloudTrail to forward audit logs into Better Stack.
• Automatic integration with AWS X-Ray; forward traces from AWS into Better Stack.

1. Create a source

Create a new AWS Source in Better Stack. You can use one source for all your regions, which is recommended for better cross-region trace correlation, or split your regions across different sources to vary retention/permissions.

2. Deploy the CloudFormation stack

You will be presented with a button to "Deploy CloudFormation stack". this will open the CloudFormation "Quick create stack" page from our template.

We set sensible defaults in the Quick create links, but there are five CloudFormation parameters you may wish to review:

• CreateGlobalResources Create IAM roles. Set to false for secondary regions after the first.

• EnableMetricStream Stream your CloudWatch metrics to Better Stack in near real-time. Set to false to poll them through the CloudWatch API instead, which costs less but adds latency. See Reducing metric costs with polling.

• EnableTagEnrichment Enable Lambda-based tag enrichment for metrics and logs. Data will still be forwarded to Better Stack without this, but the quality of the contextual information and metric tags will be lower.

• EnableCloudTrail Create a new CloudTrail trail, and configure AWS to forward that new trail to CloudWatch, and then to Better Stack.

• EnableXRayTransactionSearch Enable X-Ray Transaction Search to forward X-Ray data to CloudWatch, and then to Better Stack.

The full CloudFormation stack and Lambda definitions can be found in our GitHub repository.

3. Complete the integration

Once the CloudFormation stack is deployed, enter the IntegrationRoleArn and ExternalId outputs from the deployment and press 'Save' to complete the integration.

We will now start loading your log groups.

Controlling forwarded logs

By default, all log groups are automatically subscribed to and forwarded to Better Stack. You can disable this behavior and select specific groups or sets of groups to forward by visiting Source → Configure and selecting the groups you wish to forward from the AWS log groups section.

We recommend you closely monitor your AWS spend following the deployment of the AWS CloudFormation.

While costs are typically modest for most deployments, your AWS cost connected to gathering and forwarding telemetry might be significant depending on your exact usage.

Custom log group routing

Need to route specific CloudWatch log groups to different Better Stack sources with varying retention periods? Follow our guide on Custom log group routing.

Metric selection

Better Stack loads the set of available CloudWatch metrics for your source and lets you choose which to collect and make queryable in Better Stack.

You can collect all metrics, every metric in a given namespace such as AWS/EC2 or AWS/RDS, or individual metrics. No metrics are ingested until you make a selection.

When we ingest your metrics, we convert them to Better Stack naming. For example, AWS/EC2/CPUUtilization becomes aws.ec2.cpu_utilization.

Not seeing your metrics yet?

Loading the full set of available metrics can take a few minutes after you first deploy the integration.

Reducing metric costs with polling

By default, the stack streams your CloudWatch metrics to Better Stack in near real-time using a CloudWatch metric stream and Amazon Data Firehose. This gives you the lowest latency, but the metric stream and Firehose add to your AWS bill.

To lower that cost, set the EnableMetricStream parameter to false when you deploy or update the stack. Better Stack then pulls your metrics through the CloudWatch API instead. Polling is significantly cheaper, but your metrics arrive with up to 10 minutes of latency, and the metrics Firehose and tag-enrichment Lambda are no longer created. Your logs, traces, and CloudTrail audit logs are unaffected.

Tag filtering

When using metric polling, you may also optionally specify a list of tags to match on. For supported services, we will filter fetched metrics to only those resources that match the supplied tags. Some examples:

Removing the AWS integration

To remove the AWS integration, go to AWS → CloudFormation → Stacks → betterstack -> Delete.

This will delete almost all Better Stack configured components from the selected region. Logs and metrics will no longer be sent to Better Stack from that region.

The exception is the S3 buckets deployed by the CloudFormation stack, which AWS will not delete when the stack is deleted, and must be manually emptied and deleted. You will not be able to re-deploy the stack until you do so. The two buckets that you will need to remove are:

• better-stack-firehose-<account>-<region>
• better-stack-cloudtrail-<account>-<region> (only if EnableCloudTrail was set during deployment)

When you have the AWS integration deployed in multiple regions, and delete the stack from the first region that you deployed to, AWS will remove IAM roles required by other regions. To resolve this, select a different region, and update the CloudFormation stack (from the same template), setting the CreateGlobalResources to true so that IAM resources are created in the new region.

Need help?

Please let us know at hello@betterstack.com.
We're happy to help! 🙏