Help improve this page

To contribute to this user guide, choose the Edit this page on GitHub link that is located in the right pane of every page.

Access EKS Capabilities controller logs

EKS Capabilities controllers for ACK, kro, and Argo CD run in AWS-managed infrastructure outside your clusters. You can configure log delivery for these controllers using Amazon CloudWatch Vended Logs, giving you visibility into controller behavior for monitoring and troubleshooting.

Logs are delivered in structured JSON format and include operational fields such as log level, message, controller name, and reconciliation identifiers. Internal AWS metadata is filtered before delivery — you receive only the operational log content relevant to your capability controllers.

Supported log types

Each capability has one or more log types that you can configure independently as CloudWatch Vended Logs delivery sources.

ACK

kro

Argo CD

ACK uses a single log type covering all ACK service controllers. Log records include a controllerGroup field (for example, s3.services.k8s.aws, rds.services.k8s.aws) that identifies which ACK service controller generated the log. You can use this field to filter logs for a specific service controller in CloudWatch Logs Insights or other query tools.

Argo CD has five separate log types, one per controller component. This lets you enable logging for only the controllers you need and route them to different destinations.

Setting up log delivery

To configure capability controller log delivery, use the AWS Management Console or the Amazon CloudWatch Logs API. For detailed setup instructions, see Enabling logging from AWS services in the Amazon CloudWatch Logs User Guide. Each capability controller can be configured as an individual CloudWatch Vended Logs delivery source, so you can select which logs to receive.

Console

Using Amazon CloudWatch APIs

Setting up logging requires three steps:

You can retrieve the capability ARN using the describe-capability command:

aws eks describe-capability \
  --region region-code \
  --cluster-name my-cluster \
  --capability-name my-capability \
  --query 'capability.capabilityArn' --output text

You can configure a single capability (delivery source) to send logs to multiple destinations by creating multiple deliveries. You can also send logs from multiple capabilities to the same destination.

IAM permissions

Depending on the destination selected, you might need to configure IAM policies or roles for the CloudWatch log group, S3 bucket, or Data Firehose delivery stream to ensure successful log delivery. If you’re sending logs across AWS accounts, use the PutDeliveryDestinationPolicy API to configure an IAM policy that allows delivery to the destination. See the CloudWatch Vended Logs permissions documentation for additional information.

Example: Querying logs with CloudWatch Logs Insights

To view error logs across all controllers:

fields @timestamp, controller, message, error
| filter level = "error"
| sort @timestamp desc
| limit 50

For more query examples including filtering by service controller, tracking reconciliation cycles, and Argo CD application filtering, see Use controller logs for troubleshooting.

Viewing your logs

After you configure log delivery, logs are delivered to your specified destination. The method for accessing logs depends on your chosen destination type:

Pricing

CloudWatch Vended Logs charges apply for log delivery and storage based on your chosen delivery destination. CloudWatch Vended Logs enables reliable, secure log delivery with built-in AWS authentication and authorization at a reduced price compared to standard CloudWatch Logs. See the Vended Logs section of the CloudWatch pricing page for more details.