digitc1/AWSLandingZone

Change custom cloudwatch log gorup name to subscription filter name

silavjy opened this issue · 0 comments

Due to changes done by Tomans on the Splunk lambdas, a change to the LZ is required in case of using custom names for index identification.

Currently if custom names are used, those are applied to the cloudwatch log groups (Guardduty, SecurityHub, AWSConfig, CloudTrail and CloudTrail Insights).

The change should be such that instead of setting the custom name on the CloudWatch Log Group, the custom name should be set on the Subscription filters that stream the logs to splunk for every cloudwatch log group identified above.