Inspect a service failure
Search the log group of the affected service and correlate messages by order or request identifier, keeping the time window close to the incident.
APIs & logs · MCP Firewall integration
Let AI investigate CloudWatch. Restrict the logs it can reach.
Use GateRook’s MCP Firewall to expose CloudWatch Logs in a fixed region and explicit log groups. Configure an AWS profile or access key in GateRook, optionally assume a dedicated role, and return bounded reads from Logs Insights or FilterLogEvents. IAM permissions remain in force.
Connection in GateRook
stage-cloudwatch
AWS CloudWatch Logs
stage / QA- Connector type
- AWS CloudWatch
- Name / environment
- stage-cloudwatch / stage
- Region
- eu-central-1
- Log groups
- /services/orders-stage
The security boundary
Your AI requests a tool. GateRook checks its mode and policy, requires approval when configured, and resolves credentials locally before an allowed call runs.
Understand the request flowAsk your AI
Find recent order 48213 errors in AWS CloudWatch Logs and explain the sequence.
cloudwatch_logs_search · arguments
{
"connection": "stage-cloudwatch",
"query": "fields @timestamp, @message | filter @message like /48213/ and @message like /ERROR/ | sort @timestamp desc | limit 20",
"from": "-15m",
"to": "now",
"limit": 20
}Example result
{
"backend": "cloudwatch",
"entries": [
{
"timestamp": "2026-10-22T12:29:00Z",
"severity": "ERROR",
"message": "Payment authorization timed out for order 48213"
}
],
"count": 1,
"truncated": false
}Sample configuration and output, not a live connection. Replace example values with your environment. Tool names here are connector names; the endpoint may expose a connection-specific name.
Useful access. Explicit control.
What you can do with AWS CloudWatch Logs and AI
Investigate a Lambda error
Create a connection scoped to the relevant Lambda log group, then let the AI inspect returned events alongside a separately scoped AWS connection.
Keep log access distinct from infrastructure access
Expose CloudWatch log search without granting the AI general AWS inventory or resource-action tools.
From service to MCP Firewall
How to connect AWS CloudWatch Logs
GateRook must be running on a computer that can reach your service. Open Connections, choose Add connection, and select AWS CloudWatch. Give the connection a name and environment.
New to GateRook? Start with the full setup guide.Prepare AWS log access
Choose an existing local AWS profile or provide an access key in GateRook. Ensure the identity can read the selected log groups and run the configured search API. If using AssumeRole, configure the role trust and permissions.
Set region, groups and credentials
Open Connections, Add connection and AWS CloudWatch. Enter the region, explicit log groups, credential source and optional role ARN. Keep unrelated groups out of this connection.
Choose the search language and test
Select Logs Insights or Filter patterns, then run Test connection and finish Add to endpoint. The example below uses Insights. Start with a short time window and verify the result in Playground.
Choose the endpoint and tool modes
Add the tested connection to an endpoint. In Tools & policies, enable only the tools needed for the task. Start with Read only where supported; use Approval for any selected mutation and leave other tools Off. A connection alone does not grant an AI client access.
Connect your AI and verify the first call
In Clients, choose your AI app and endpoint, review the connection details, and connect. Try this guide’s example in Playground before asking your AI. Open Activity to inspect the tool, target, decision and returned result. The getting started guide covers this shared flow.
Connection settings
Configure AWS CloudWatch Logs in GateRook
These are example values for the connection form. Enter credentials into GateRook’s secret fields, not into an AI prompt. Requirements and alternatives are noted per field.
| Setting | Example | How to use it |
|---|---|---|
Connector type | AWS CloudWatch | Choose AWS CloudWatch in Add connection. It is a dedicated built-in connector. |
Name / environment | stage-cloudwatch / stage | A dedicated connection for the selected log groups. |
Region | eu-central-1 | The AWS region containing the configured log groups. |
Log groups | /services/orders-stage | List the log group names or supported log group ARNs the agent may query. |
Credentials source / profile | profile / orders-reader | The profile must exist on the GateRook computer. Access-key credentials are also supported. |
Role ARN | arn:aws:iam::123456789012:role/gw-readonly | Optional AssumeRole target. Its trust policy must allow the selected source identity. |
Search API | insights | Use Logs Insights QL; the alternative filter mode expects FilterLogEvents patterns. |
Know what you expose
AWS CloudWatch Logs tools and access boundaries
The connector defines available operations. GateRook’s MCP Firewall enforces endpoint modes and connection policies before an AI client can use them.
| Tool | Purpose | Access behavior |
|---|---|---|
cloudwatch_logs_search | Search a bounded time range in the backend query language, with a cursor for older results. | Read only |
cloudwatch_logs_tail | Read new log entries since a cursor, waiting up to eight seconds for another page. | Read only |
Before you enable access
- This integration reads logs. It does not edit entries, change retention or administer the logging service.
- The connection scope, environment policy and result limits all apply. A truncated page is only part of the evidence.
- Log messages may contain application data or sensitive payloads. Scope the source and review the data your AI app is permitted to receive.
- Logs Insights queries are billed by AWS for scanned data. Narrow the time range and log groups.
- The query language depends on Search API. A Logs Insights query is not a FilterLogEvents pattern.
GateRook stores local connection secrets encrypted and resolves them for connectors. Allowed tool results are returned to your AI client and may be processed by its provider. Scope the data you expose as well as the actions you allow.
Practical answers
AWS CloudWatch Logs connection questions
Use Test connection to isolate service access problems. Use Playground and Activity to inspect endpoint permissions and tool calls.
Is this the same as the AWS connector?
No. AWS CloudWatch is a dedicated log connector that exposes cloudwatch_logs_search and cloudwatch_logs_tail. The separate AWS connector covers its own infrastructure tools.
Can I use an AWS profile instead of pasting a secret key?
Yes. Select profile as the credentials source and specify a profile available on the computer running GateRook. Optional role assumption uses that source identity.
Will a query search my entire AWS account?
The connection has an explicit region and log group list. Keep that list narrow; tool calls can also target a configured source.
Why does an older connection still expose logs_search and logs_tail?
Older saved Logs connections retain their compatible tool names. New AWS CloudWatch connections expose cloudwatch_logs_search and cloudwatch_logs_tail. Use the names shown in your endpoint; the endpoint may also add a connection-specific prefix.
Keep exploring
Extend control across your stack
AWS
Inspect AWS through GateRook’s MCP Firewall. Scope accounts and regions, keep credentials local, and expose read-only resource and CloudWatch tools.
Loki
Control AI access to Loki logs with GateRook. Configure tenant and source scope, keep credentials local and bound LogQL results and time ranges.
SSH log files
Read selected SSH log files through GateRook’s MCP Firewall. Verify host keys, restrict file access and inspect bounded results and call history in Activity.
Your MCP Firewall. Your access rules.
Control AI access to AWS CloudWatch Logs.
Start with read-only access. Approve changes. Inspect the audit trail.