Aerospike Database logs

Every Aerospike Cloud database cluster stores logs from each cluster node in an Amazon S3 bucket managed by Aerospike Cloud. To access these logs, use the Aerospike Cloud API to grant access to AWS IAM roles or an entire AWS account. After granting access, you can read logs from the S3 bucket using standard AWS APIs and tooling.

Configure log access

Use the following steps to enable log access for your AWS IAM roles.

Grant log access to your AWS account or IAM roles using the Aerospike Cloud API.

Caution
When updating the authorizedRoles array, the entire list is replaced. Include all roles that should have access in each update. Setting "authorizedRoles": [] removes access for all roles.

To grant access during database creation:

Include the logging block in your create cluster API request.

To grant access to an entire AWS account, use the root user ARN.
```
{
  "logging": {
    "authorizedRoles": [
      "arn:aws:iam::012345678901:root"
    ]
  }
}
```
To grant access to specific roles, use the role ARNs.
```
{
  "logging": {
    "authorizedRoles": [
      "arn:aws:iam::012345678901:role/ASLogReader",
      "arn:aws:iam::012345678901:role/DeveloperRole"
    ]
  }
}
```
To grant access for an existing database:

Use the update cluster API endpoint to modify the logging configuration:
```
{
  "logging": {
    "authorizedRoles": [
      "arn:aws:iam::012345678901:role/ASLogReader",
      "arn:aws:iam::012345678901:role/DeveloperRole"
    ]
  }
}
```
Retrieve the S3 bucket ARN from the cluster details.

You can retrieve the S3 bucket ARN using the get cluster API endpoint. The response includes a logging object with the logBucket field:
```
{
  "logging": {
    "logBucket": "arn:aws:s3::db-logs-bucket",
    "authorizedRoles": [ "arn:aws:iam::012345678901:root" ]
  }
}
```
Access the S3 bucket containing your database logs.

Use your authorized AWS account or assume the authorized IAM role and use standard AWS tools to access the logs:
Terminal window
```
# Using AWS CLI to list logs (extract bucket name from ARN)
aws s3 ls s3://db-logs-bucket
```