---
title: Deploy EDOT Cloud Forwarder for AWS
description: Deploy the EDOT Cloud Forwarder for AWS using CloudFormation CLI, AWS Console, or AWS Serverless Application Repository.
url: https://www.elastic.co/docs/reference/opentelemetry/edot-cloud-forwarder/aws/deploy
products:
  - EDOT Cloud Forwarder
  - EDOT Cloud Forwarder for AWS
  - Elastic Cloud Serverless
  - Elastic Observability
applies_to:
  - Serverless Observability projects: Generally available
  - Elastic Cloud Hosted: Generally available
  - Self-managed Elastic deployments: Unavailable
  - Elastic Distribution of OpenTelemetry Cloud Forwarder for AWS: Generally available since 1.0, Preview in 0.2
---

# Deploy EDOT Cloud Forwarder for AWS
EDOT Cloud Forwarder for AWS can be deployed using any of the following methods:

| Deployment method                           | Description                                                     |
|---------------------------------------------|-----------------------------------------------------------------|
| CloudFormation (AWS CLI)                    | Deploy using AWS CLI commands with CloudFormation templates.    |
| CloudFormation (AWS Console)                | Deploy using the AWS Management Console UI.                     |
| AWS Serverless Application Repository (SAR) | Deploy directly from the AWS Serverless Application Repository. |

Each method achieves the same result and uses CloudFormation templates. Choose the method that best adapts to your workflow.

## Deploy using CloudFormation (AWS CLI)

Use the AWS CLI to deploy the EDOT Cloud Forwarder with CloudFormation templates. This method is ideal for automation and infrastructure-as-code workflows.

### Deployment examples

The following examples show how to deploy the ECF Cloud Forwarder using AWS CloudFormation CLI. Copy and paste these commands after replacing the placeholder values with your actual configuration.
- Use the `--template-url` flag to reference a template hosted on S3.
- Use the `--region` flag to specify the AWS region where the CloudFormation stack will be deployed. The CloudFormation stack deployment region must match the region of the S3 bucket where your logs are stored.
- To always use the most recent stable templates, use the `latest` path. For example, `v1/latest`.
- To pin a specific version, replace `latest` with the desired version tag. For example, `v1/v{{version.edot-cf-aws}}`.

Alternatively, if you have downloaded the template file, use the `--template-body file://<path>` option with a local template file.
<tab-set>
  <tab-item title="VPC Flow logs">
    This example deploys a CloudFormation stack to collect VPC Flow logs stored in an S3 bucket.
    ```sh
    aws cloudformation create-stack \
      --stack-name edot-cloud-forwarder-vpc \
      --template-url https://edot-cloud-forwarder.s3.amazonaws.com/v1/latest/cloudformation/s3_logs-cloudformation.yaml \
      --capabilities CAPABILITY_NAMED_IAM \
      --region eu-central-1 \
      --parameters \
        ParameterKey=SourceS3BucketARN,ParameterValue=your-s3-vpc-bucket-arn \
        ParameterKey=OTLPEndpoint,ParameterValue="<placeholder>" \
        ParameterKey=ElasticAPIKey,ParameterValue="<placeholder>" \
        ParameterKey=EdotCloudForwarderS3LogsType,ParameterValue="vpcflow"
    ```
  </tab-item>

  <tab-item title="ELB Access logs">
    This example deploys a CloudFormation stack to collect ALB Access logs stored in an S3 bucket.
    ```sh
    aws cloudformation create-stack \
      --stack-name edot-cloud-forwarder-alb \
      --template-url https://edot-cloud-forwarder.s3.amazonaws.com/v1/latest/cloudformation/s3_logs-cloudformation.yaml \
      --capabilities CAPABILITY_NAMED_IAM \
      --region eu-central-1 \
      --parameters \
        ParameterKey=SourceS3BucketARN,ParameterValue=your-s3-alb-bucket-arn \
        ParameterKey=OTLPEndpoint,ParameterValue="<placeholder>" \
        ParameterKey=ElasticAPIKey,ParameterValue="<placeholder>" \
        ParameterKey=EdotCloudForwarderS3LogsType,ParameterValue="elbaccess"
    ```
  </tab-item>

  <tab-item title="CloudTrail logs">
    This example deploys a CloudFormation stack to collect CloudTrail logs stored in an S3 bucket.
    ```sh
    aws cloudformation create-stack \
      --stack-name edot-cloud-forwarder-cloudtrail \
      --template-url https://edot-cloud-forwarder.s3.amazonaws.com/v1/latest/cloudformation/s3_logs-cloudformation.yaml \
      --capabilities CAPABILITY_NAMED_IAM \
      --region eu-central-1 \
      --parameters \
        ParameterKey=SourceS3BucketARN,ParameterValue=your-cloudtrail-bucket-arn \
        ParameterKey=OTLPEndpoint,ParameterValue="<placeholder>" \
        ParameterKey=ElasticAPIKey,ParameterValue="<placeholder>" \
        ParameterKey=EdotCloudForwarderS3LogsType,ParameterValue="cloudtrail"
    ```
  </tab-item>

  <tab-item title="WAF logs">
    This example deploys a CloudFormation stack to collect AWS WAF logs stored in an S3 bucket.
    ```sh
    aws cloudformation create-stack \
      --stack-name edot-cloud-forwarder-waf \
      --template-url https://edot-cloud-forwarder.s3.amazonaws.com/v1/latest/cloudformation/s3_logs-cloudformation.yaml \
      --capabilities CAPABILITY_NAMED_IAM \
      --region eu-central-1 \
      --parameters \
        ParameterKey=SourceS3BucketARN,ParameterValue=arn:aws:s3:::aws-waf-logs-your-bucket-arn \
        ParameterKey=OTLPEndpoint,ParameterValue="<placeholder>" \
        ParameterKey=ElasticAPIKey,ParameterValue="<placeholder>" \
        ParameterKey=EdotCloudForwarderS3LogsType,ParameterValue="waf"
    ```

    <note>
      Replace `aws-waf-logs-your-bucket-name` with your actual WAF logging bucket ARN. Remember that the bucket name must start with `aws-waf-logs-` as required by AWS WAF.
    </note>
  </tab-item>

  <tab-item title="CloudWatch logs">
    This example deploys a CloudFormation stack to collect CloudWatch logs (VPC Flow Logs or CloudTrail) from a Log Group.
    ```sh
    aws cloudformation create-stack \
      --stack-name edot-cloud-forwarder-cw-vpc \
      --template-url https://edot-cloud-forwarder.s3.amazonaws.com/v1/latest/cloudformation/cloudwatch_logs-cloudformation.yaml \
      --capabilities CAPABILITY_NAMED_IAM \
      --region eu-central-1 \
      --parameters \
        ParameterKey=OTLPEndpoint,ParameterValue="<placeholder>" \
        ParameterKey=ElasticAPIKey,ParameterValue="<placeholder>" \
        ParameterKey=SourceCloudWatchLogGroupARN,ParameterValue="arn:aws:logs:eu-central-1:123456789012:log-group:your-log-group:*" \
        ParameterKey=EdotCloudForwarderCWLogType,ParameterValue="vpcflow"
    ```

    <note>
      Set `EdotCloudForwarderCWLogType` to `vpcflow` for VPC Flow Logs or `cloudtrail` for CloudTrail logs. The `SourceCloudWatchLogGroupARN` must include the trailing `:*`.
    </note>
  </tab-item>

  <tab-item title="S3 logs (ECS mode)">
    <applies-to>
      - Elastic Distribution of OpenTelemetry Cloud Forwarder for AWS: Preview since 1.5
    </applies-to>
    This example deploys a CloudFormation stack in [ECS mode](/docs/reference/opentelemetry/edot-cloud-forwarder/aws#modes) to collect logs from an S3 bucket and write them to the data streams used by the Elastic AWS integration.
    ```sh
    aws cloudformation create-stack \
      --stack-name edot-cloud-forwarder-vpc-ecs \
      --template-url https://edot-cloud-forwarder.s3.amazonaws.com/v1/latest/cloudformation/s3_logs_ecs-cloudformation.yaml \
      --capabilities CAPABILITY_NAMED_IAM \
      --region eu-central-1 \
      --parameters \
        ParameterKey=SourceS3BucketARN,ParameterValue=your-s3-vpc-bucket-arn \
        ParameterKey=OTLPEndpoint,ParameterValue="<placeholder>" \
        ParameterKey=ElasticAPIKey,ParameterValue="<placeholder>" \
        ParameterKey=EdotCloudForwarderS3LogsType,ParameterValue="vpcflow" \
        ParameterKey=DataStreamNamespace,ParameterValue="default"
    ```

    <note>
      `EdotCloudForwarderS3LogsType` accepts `vpcflow`, `elbaccess`, `cloudtrail`, `waf`, or `guardduty`. For GuardDuty buckets encrypted with a customer-managed key, also set `GuardDutyKMSKeyARN`. Refer to [ECS mode parameters](/docs/reference/opentelemetry/edot-cloud-forwarder/aws/configure#ecs-mode-parameters) for details.
    </note>
  </tab-item>

  <note>
    The `--capabilities CAPABILITY_NAMED_IAM` flag is required because this CloudFormation template creates AWS Identity and Access Management (IAM) resources. More specifically, it creates a named IAM role (`LambdaExecutionRole`) for the Lambda function. To acknowledge that AWS CloudFormation might create or modify IAM resources with custom names, you must specify the `CAPABILITY_NAMED_IAM` capability.
  </note>
</tab-set>


### Update an existing stack

To update an existing CloudFormation stack while preserving some parameter values, follow these steps:
<stepper>
  <step title="Identify the stack to update">
    Determine the name of the CloudFormation stack you want to modify.
  </step>

  <step title="Prepare the update command">
    Use the following structure for your update command:
    - Include all required parameters.
    - Use `UsePreviousValue=true` for parameters that should remain unchanged.
    - Specify `ParameterValue=<new-value>` for parameters that need to be updated.
  </step>

  <step title="Run the `update-stack` command">
    Run the command with the following parameters:
    ```sh
    aws cloudformation update-stack \
      --template-url https://edot-cloud-forwarder.s3.amazonaws.com/v1/latest/cloudformation/<template-file-name>.yaml \
      --stack-name <stack-name> \
      --capabilities CAPABILITY_NAMED_IAM \
      --region eu-central-1 \
      --parameters \
          ParameterKey=Param1,UsePreviousValue=true \
          ParameterKey=Param2,UsePreviousValue=true \
          ParameterKey=Param3,UsePreviousValue=true \
          ParameterKey=Param4,ParameterValue=<new-value>
    ```

    <dropdown title="Example using S3 logs template">
      For example, to modify the S3 bucket ARN for the `edot-cloud-forwarder-vpc` stack while keeping other parameter values unchanged:
      ```sh
      aws cloudformation update-stack \
        --template-url https://edot-cloud-forwarder.s3.amazonaws.com/v1/latest/cloudformation/s3_logs-cloudformation.yaml \
        --stack-name edot-cloud-forwarder-vpc \
        --capabilities CAPABILITY_NAMED_IAM \
        --region eu-central-1 \
        --parameters \
            ParameterKey=OTLPEndpoint,UsePreviousValue=true \
            ParameterKey=ElasticAPIKey,UsePreviousValue=true \
            ParameterKey=EdotCloudForwarderS3LogsType,UsePreviousValue=true \
            ParameterKey=SourceS3BucketARN,ParameterValue=your-new-s3-vpc-bucket-arn
      ```
    </dropdown>

    <dropdown title="Example using CloudWatch logs template">
      For example, to increase reserved concurrency for the `edot-cloud-forwarder-cw-vpc` stack while keeping other parameter values unchanged:
      ```sh
      aws cloudformation update-stack \
        --template-url https://edot-cloud-forwarder.s3.amazonaws.com/v1/latest/cloudformation/cloudwatch_logs-cloudformation.yaml \
        --stack-name edot-cloud-forwarder-cw-vpc \
        --capabilities CAPABILITY_NAMED_IAM \
        --region eu-central-1 \
        --parameters \
            ParameterKey=OTLPEndpoint,UsePreviousValue=true \
            ParameterKey=ElasticAPIKey,UsePreviousValue=true \
            ParameterKey=SourceCloudWatchLogGroupARN,UsePreviousValue=true \
            ParameterKey=EdotCloudForwarderCWLogType,UsePreviousValue=true \
            ParameterKey=EdotCloudForwarderConcurrentExecutions,ParameterValue=100
      ```
    </dropdown>
  </step>

  <step title="Verify the update">
    After running the command, check the stack status in the AWS Management Console under **CloudFormation** → **Stacks**. Then, run this command to confirm the updated parameter values:
    ```sh
    aws cloudformation describe-stacks --stack-name <stack-name>
    ```
  </step>
</stepper>


## Deploy using CloudFormation (AWS Console)

The AWS CloudFormation console supports a one-click flow that uses the **Launch Stack** button, or a manual flow where you paste the template URL.

### One-click deployment

For the canonical one-click flow for each mode and source, refer to the [Quick start](/docs/reference/opentelemetry/edot-cloud-forwarder/aws#quick-start) on the product landing page. The **Launch Stack** buttons there cover S3 (OpenTelemetry), CloudWatch (OpenTelemetry), and S3 (ECS).
<tip>
  The CloudFormation stack deployment region must match the region of your log source (S3 bucket or CloudWatch Log Group).
</tip>


### Manual deployment

To manually specify the template, follow these steps:
1. Navigate to **CloudFormation** in the AWS Console.
2. Select **Create Stack** and choose **With new resources (standard)** to start a fresh deployment.
3. Select one of the following options under **Specify template**:
   - **Amazon S3 URL (Recommended)**: Paste the CloudFormation template URL from [CloudFormation templates](/docs/reference/opentelemetry/edot-cloud-forwarder/aws/configure#cloudformation-templates).
- **Upload a template file**: Download the template from the S3 URL and upload it manually.
4. Select **Next** and configure all required parameters using the settings described in [Configure the template](https://www.elastic.co/docs/reference/opentelemetry/edot-cloud-forwarder/aws/configure).
5. Select **Next** again and check **Acknowledge IAM capabilities**. This is required because the template creates named IAM roles with permissions to access the required resources.
6. Review your configuration and select **Submit** to deploy the stack.
7. Monitor the progress until the stack reaches the `CREATE_COMPLETE` state.


### Update an existing stack

To modify parameters of an existing stack through the AWS Console:
1. Navigate to **CloudFormation** in the AWS Management Console.
2. Select the stack you want to update.
3. Click **Update stack** and select either **Make a direct update** or **Create a change set**.
4. Choose **Use existing template**.
5. Select **Next**.
6. Modify the parameter values as needed (refer to [Configure the template](https://www.elastic.co/docs/reference/opentelemetry/edot-cloud-forwarder/aws/configure) for parameter descriptions).
7. Select **Next** and review your changes.
8. Select **Submit** to apply the updates. For a change set, select **Execute changeset** to apply it.
9. Monitor the stack update progress in the console.


## Deploy using AWS Serverless Application Repository

In addition to deploying through CloudFormation templates, you can deploy the EDOT Cloud Forwarder application directly from the AWS Serverless Application Repository (SAR).

### Deploy from SAR

To deploy from SAR, follow these steps:
1. Navigate to **AWS Serverless Application Repository** in the AWS Management Console.
2. Select **Available applications** and check the box **Show apps that create custom IAM roles or resource policies**.
3. Search for the appropriate application:
   - **S3 logs (OpenTelemetry mode)**: Search for `edot-cloud-forwarder-s3-logs`.
- **S3 logs (ECS mode)**: Search for `cloud-forwarder-s3-logs-ecs`. Refer to [Modes](/docs/reference/opentelemetry/edot-cloud-forwarder/aws#modes) for context and to [ECS mode parameters](/docs/reference/opentelemetry/edot-cloud-forwarder/aws/configure#ecs-mode-parameters) for the additional template parameters.
- **CloudWatch logs (OpenTelemetry mode)**: Search for `edot-cloud-forwarder-cloudwatch-logs`.
4. Select the application.
5. **Configure the application settings**: Under **Application settings**, fill in the parameters described in the [Configure the template](https://www.elastic.co/docs/reference/opentelemetry/edot-cloud-forwarder/aws/configure) section. Refer to that section for details on each parameter.
6. **Acknowledge IAM role creation**: At the bottom of the page, check the box to acknowledge that the application will create custom IAM roles. This is required for the forwarder to access your log source and send data to Elastic Observability.
7. Select **Deploy**.

The deployment process will start, and a CloudFormation stack will be created with all the necessary resources. You can monitor the progress in the AWS CloudFormation console under **Stacks**.
<note>
  The same [deployment considerations](/docs/reference/opentelemetry/edot-cloud-forwarder/aws#deployment-considerations) apply to SAR deployments, including the requirement to deploy separate serverless applications for each log type and ensure the deployment region matches your log source region.
</note>


## CloudFormation stack resources

The CloudFormation templates create a number of resources to process logs from a specific log source.

### Resources for S3 logs

This is a list of resources created by the stack when processing S3 logs.

| Resource name                       | Type                                  | Description                                                                                                                                                                                                                                           |
|-------------------------------------|---------------------------------------|-------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
| `CustomNotificationUpdater`         | `AWS::CloudFormation::CustomResource` | Custom resource used to manage S3 event notifications dynamically.                                                                                                                                                                                    |
| `LambdaExecutionRole`               | `AWS::IAM::Role`                      | IAM role granting permissions needed for the Lambda function to interact with S3 and other AWS services.                                                                                                                                              |
| `LambdaFunction`                    | `AWS::Lambda::Function`               | Core Lambda function responsible for processing incoming logs from S3. This is a key resource in the stack.                                                                                                                                           |
| `LambdaInvokeConfig`                | `AWS::Lambda::EventInvokeConfig`      | Configures error handling and invocation settings for the Lambda function.                                                                                                                                                                            |
| `LambdaLogGroup`                    | `AWS::Logs::LogGroup`                 | CloudWatch log group storing logs for the main Lambda function. Useful for debugging and monitoring.                                                                                                                                                  |
| `LambdaPermissionS3Bucket`          | `AWS::Lambda::Permission`             | Grants permission for S3 to invoke the Lambda function when new logs arrive.                                                                                                                                                                          |
| `LambdaS3TriggerPolicy`             | `AWS::IAM::Policy`                    | IAM policy allowing the Lambda function to process events triggered by S3.                                                                                                                                                                            |
| `NotificationUpdaterLambda`         | `AWS::Lambda::Function`               | Utility Lambda function handling S3 event notification updates dynamically.                                                                                                                                                                           |
| `NotificationUpdaterLambdaLogGroup` | `AWS::Logs::LogGroup`                 | CloudWatch log group storing logs for the `NotificationUpdaterLambda` function.                                                                                                                                                                       |
| `S3FailureBucketARN`                | `AWS::S3::Bucket`                     | ARN of the bucket for storing failed invocations from the `edot-cloud-forwarder` Lambda function, preventing data loss, in the format `arn:aws:s3:::your-bucket-name`. If not defined, the template creates a dedicated failure bucket automatically. |

The main Lambda function, `LambdaFunction`, is the core component for processing S3 logs. S3 event notifications are handled dynamically using `CustomNotificationUpdater` and `NotificationUpdaterLambda`.
CloudWatch logs ensure detailed monitoring of Lambda executions. IAM roles and permissions control access between S3 and Lambda functions, while `S3FailureBucketARN` prevents data loss by capturing unprocessed logs.

### Resources for CloudWatch Logs

This is a list of resources created by the stack when CloudWatch logs are the source.

| Resource name                     | Type                             | Description                                                                                                              |
|-----------------------------------|----------------------------------|--------------------------------------------------------------------------------------------------------------------------|
| `CloudWatchLogSubscriptionFilter` | `AWS::Logs::SubscriptionFilter`  | Defines a filter that forwards logs from a CloudWatch Log Group to the Lambda function. Critical for log processing.     |
| `LambdaExecutionRole`             | `AWS::IAM::Role`                 | IAM role granting necessary permissions for the Lambda function to interact with CloudWatch Logs and other AWS services. |
| `LambdaFunction`                  | `AWS::Lambda::Function`          | Core Lambda function responsible for processing incoming logs from CloudWatch. This is a key resource in the stack.      |
| `LambdaInvokeConfig`              | `AWS::Lambda::EventInvokeConfig` | Configures event invocation settings, including error handling and retry behavior.                                       |
| `LambdaLogGroup`                  | `AWS::Logs::LogGroup`            | CloudWatch log group that stores execution logs for the main Lambda function, aiding monitoring and debugging.           |
| `LambdaPermissionCloudWatch`      | `AWS::Lambda::Permission`        | Grants permission for CloudWatch Logs to invoke the Lambda function, enabling real-time log streaming.                   |
| `S3FailureBucketARN`              | `AWS::S3::Bucket`                | ARN of the bucket for storing failed log events to prevent data loss, in the format `arn:aws:s3:::your-bucket-name`.     |

The CloudWatch Log Subscription Filter, `CloudWatchLogSubscriptionFilter`, ensures logs are correctly forwarded to the Lambda function. The Lambda function, `LambdaFunction`, serves as the core processing unit for CloudWatch logs.
CloudWatch Log Groups help monitor execution performance and debug issues. IAM permissions (`LambdaExecutionRole`, `LambdaPermissionCloudWatch`) control interactions between CloudWatch and Lambda, while the failure bucket, `S3FailureBucketARN`, helps prevent data loss in case of processing errors.

## Remove a CloudFormation stack

If you no longer need a deployed stack and want to clean up all associated resources, you can remove it using either the AWS CLI or the AWS Console.

### Important considerations

Deleting a stack removes all AWS resources created by that stack. However:
- If you allowed the stack to automatically create a dedicated S3 bucket for failed Lambda invocations, that bucket is not removed if it contains objects, because CloudFormation doesn't force-remove non-empty buckets. To remove the bucket entirely, you must empty it manually before deleting it.
- If you specified an existing bucket through the `S3FailureBucketARN` parameter, that bucket is not removed because it is not managed by the stack.


### Remove using AWS CLI

Use the following command to remove a stack:
```sh
aws cloudformation delete-stack \
  --stack-name <stack-name> \
  --region <stack-region>
```

You can monitor the deletion progress through this command:
```sh
aws cloudformation describe-stacks \
  --stack-name <stack-name> \
  --region <stack-region>
```

If the stack deletion fails and remains in a `DELETE_FAILED` state, you can retry the deletion with force mode:
```sh
aws cloudformation delete-stack \
  --stack-name <stack-name> \
  --region <stack-region> \
  --deletion-mode FORCE_DELETE_STACK
```

This forcibly removes the stack's resources, except any that cannot be removed, like the failure S3 bucket if it still contains objects. For a complete cleanup, empty the bucket manually before retrying deletion.
<dropdown title="Example: Deleting a stack using AWS CLI">
  The following command removes the `edot-cloud-forwarder-vpc` stack:
  ```sh
  aws cloudformation delete-stack \
    --stack-name edot-cloud-forwarder-vpc \
    --region eu-central-1
  ```
  Monitor the deletion progress:
  ```sh
  aws cloudformation describe-stacks \
    --stack-name edot-cloud-forwarder-vpc \
    --region eu-central-1
  ```
</dropdown>


### Remove using AWS Console

To remove a stack using the AWS Management Console:
1. Navigate to **CloudFormation** in the AWS Management Console.
2. Select the stack you want to remove from the list.
3. Click **Delete** at the top of the stack details page.
4. Monitor the deletion progress on the **Events** tab or wait until the stack disappears from the stack list (indicating deletion is complete).


## Next steps

- [Configuration settings](https://www.elastic.co/docs/reference/opentelemetry/edot-cloud-forwarder/aws/configure): Learn about all configuration options, including optional settings and sizing recommendations.
- [Troubleshooting](https://www.elastic.co/docs/reference/opentelemetry/edot-cloud-forwarder/aws/troubleshooting): Diagnose and resolve issues with log forwarding.