咨询：AWS Lightsail（Bitnami镜像）网站用户IP日志对接CloudWatch或SSH读取？

Great question! You absolutely don't have to rely on manual SSH logins to access your user IP logs—AWS Lightsail (built on EC2 under the hood) fully supports integrating with CloudWatch for centralized log management, even with Bitnami images. Here's how to set it up step by step:

1. First, confirm your log file paths #

Bitnami packages store web server logs in standard, predictable locations depending on your server:

• For Apache: Run sudo ls /opt/bitnami/apache2/logs/ — look for access_log, which contains user IP addresses, request details, and timestamps.
• For Nginx: Run sudo ls /opt/bitnami/nginx/logs/ — target access.log for user access data.
• If your donation site has app-specific logs (like PHP access/error logs), check /opt/bitnami/apps/[your-app-name]/logs/ to find relevant files.

2. Set up IAM permissions for CloudWatch #

Your Lightsail instance needs permissions to send logs to CloudWatch:

• Open the Lightsail console, navigate to your instance, and go to the Permissions tab.
• Attach an IAM policy that allows CloudWatch Logs access. The managed policy CloudWatchLogsFullAccess works for testing; for production, create a custom policy with just the necessary actions: logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents.

3. Install and configure the CloudWatch Agent #

The CloudWatch Agent is the official tool to ship logs from your instance to CloudWatch:

1. Install the agent:

   • For Ubuntu-based Bitnami instances (most common):

     sudo apt update && sudo apt install amazon-cloudwatch-agent -y
     

   • For Amazon Linux-based instances:

     sudo yum install amazon-cloudwatch-agent -y
     

2. Run the interactive configuration wizard:
   Launch the wizard to set up log collection:

   sudo /opt/aws/amazon-cloudwatch-agent/bin/amazon-cloudwatch-agent-config-wizard
   

   Follow these key prompts:

   • Select EC2 as the host type
   • Choose Yes when asked if you want to monitor logs
   • Enter the full path to your access log (e.g., /opt/bitnami/apache2/logs/access_log)
   • Name your log group (e.g., lightsail-donation-site-access-logs) and log stream (use your instance name for clarity)
   • Save the configuration when prompted

3. Start and enable the agent:

   sudo systemctl start amazon-cloudwatch-agent
   sudo systemctl enable amazon-cloudwatch-agent
   

4. Verify the integration #

Head to the CloudWatch console, navigate to Logs > Log groups, and locate the log group you created. Within a few minutes, you should see incoming logs with user IP addresses and access details.

Bonus: Manual log access (for quick checks) #

If you ever need to inspect logs directly without CloudWatch, SSH into your instance and use these commands:

# Tail Apache access logs in real-time
sudo tail -f /opt/bitnami/apache2/logs/access_log

# Search for a specific IP address
sudo grep "192.168.1.1" /opt/bitnami/apache2/logs/access_log

内容的提问来源于stack exchange，提问作者georgetheevilman