AWS's AccountLevelLogSubscriptionPolicy

[zscgeek]

Any chance we can add support to Axiom for AWS's AccountLevelLogSubscriptionPolicy?

Earlier this year they added support for an account level subscription so you don't need to hook the lambda up to each and every log group.

I have had several cases now where the existing axiom cloudwatch logs setup have failed on me because of new log groups not getting picked up by the listener for various reasons. At least the older versions would max out if you had several hundred log groups due to IAM policy size issues.

I do see that your Axiom CloudWatch Forwarder got a pretty major reworking that might fix some of my issues and i'm still on the older version, but it looks like this account level method might work a lot better and be more resilient to issues.

References:

https://aws.amazon.com/about-aws/whats-new/2024/01/amazon-cloudwatch-logs-account-level-subscription-filter/

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/SubscriptionFilters-AccountLevel.html

https://docs.aws.amazon.com/cdk/api/v2/python/aws_cdk.aws_logs/CfnAccountPolicy.html

https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutAccountPolicy.html

https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-logs-accountpolicy.html