Inspect a service failure
Search the log group of the affected service and correlate messages by order or request identifier, keeping the time window close to the incident.
APIs & logs · MCP integration
Investigate CloudWatch logs from your AI app.
Connect AWS CloudWatch Logs to an MCP endpoint with a fixed region and explicit log groups. GateRook supports Logs Insights queries or FilterLogEvents patterns and can use an AWS profile or access key, with optional role assumption.
Connection in GateRook
stage-cloudwatch
AWS CloudWatch Logs
stage / QA- Connector type
- AWS CloudWatch
- Name / environment
- stage-cloudwatch / stage
- Region
- eu-central-1
- Log groups
- /services/orders-stage
The route
Your AI requests a tool. GateRook checks the endpoint policy, resolves credentials locally, and calls the configured service.
Understand the request flowAsk your AI
Find recent order 48213 errors in AWS CloudWatch Logs and explain the sequence.
logs_search · arguments
{
"connection": "stage-cloudwatch",
"query": "fields @timestamp, @message | filter @message like /48213/ and @message like /ERROR/ | sort @timestamp desc | limit 20",
"from": "-15m",
"to": "now",
"limit": 20
}Example result
{
"backend": "cloudwatch",
"entries": [
{
"timestamp": "2026-10-22T12:29:00Z",
"severity": "ERROR",
"message": "Payment authorization timed out for order 48213"
}
],
"count": 1,
"truncated": false
}Sample configuration and output, not a live connection. Replace example values with your environment. Tool names here are connector names; the endpoint may expose a connection-specific name.
Put context to work
What you can do with AWS CloudWatch Logs and AI
Investigate a Lambda error
Create a connection scoped to the relevant Lambda log group, then let the AI inspect returned events alongside a separately scoped AWS connection.
Keep log access distinct from infrastructure access
Expose CloudWatch log search without granting the AI general AWS inventory or resource-action tools.
From service to MCP
How to connect AWS CloudWatch Logs
GateRook must be running on a computer that can reach your service. Open Connections, choose Add connection, and select Logs. Give the connection a name and environment.
New to GateRook? Start with the full setup guide.Prepare AWS log access
Choose an existing local AWS profile or provide an access key in GateRook. Ensure the identity can read the selected log groups and run the configured search API. If using AssumeRole, configure the role trust and permissions.
Set region, groups and credentials
Open Connections, Add connection and AWS CloudWatch. Enter the region, explicit log groups, credential source and optional role ARN. Keep unrelated groups out of this connection.
Choose the search language and test
Select Logs Insights or Filter patterns, then run Test connection and finish Add to endpoint. The example below uses Insights. Start with a short time window and verify the result in Playground.
Choose the endpoint and tool modes
Add the tested connection to an endpoint. In Tools & policies, enable only the tools needed for the task. Start with Read only where supported; use Approval for any selected mutation and leave other tools Off. A connection alone does not grant an AI client access.
Connect your AI and verify the first call
In Clients, choose your AI app and endpoint, review the connection details, and connect. Try this guide’s example in Playground before asking your AI. Open Activity to inspect the tool, target, decision and returned result. The getting started guide covers this shared flow.
Connection settings
Configure AWS CloudWatch Logs in GateRook
These are example values for the connection form. Enter credentials into GateRook’s secret fields, not into an AI prompt. Requirements and alternatives are noted per field.
| Setting | Example | How to use it |
|---|---|---|
Connector type | AWS CloudWatch | Select this Logs variant for log search, rather than the separate AWS infrastructure connector. |
Name / environment | stage-cloudwatch / stage | A dedicated connection for the selected log groups. |
Region | eu-central-1 | The AWS region containing the configured log groups. |
Log groups | /services/orders-stage | List the log group names or supported log group ARNs the agent may query. |
Credentials source / profile | profile / orders-reader | The profile must exist on the GateRook computer. Access-key credentials are also supported. |
Role ARN | arn:aws:iam::123456789012:role/gw-readonly | Optional AssumeRole target. Its trust policy must allow the selected source identity. |
Search API | insights | Use Logs Insights QL; the alternative filter mode expects FilterLogEvents patterns. |
Know what you expose
AWS CloudWatch Logs tools and access boundaries
The connector determines what is possible. Endpoint modes and connection policies determine what a particular AI client may use.
| Tool | Purpose | Access behavior |
|---|---|---|
logs_search | Search a bounded time range in the backend query language, with a cursor for older results. | Read only |
logs_tail | Read new log entries since a cursor, waiting up to eight seconds for another page. | Read only |
Before you enable access
- This integration reads logs. It does not edit entries, change retention or administer the logging service.
- The connection scope, environment policy and result limits all apply. A truncated page is only part of the evidence.
- Log messages may contain application data or sensitive payloads. Scope the source and review the data your AI app is permitted to receive.
- Logs Insights queries are billed by AWS for scanned data. Narrow the time range and log groups.
- The query language depends on Search API. A Logs Insights query is not a FilterLogEvents pattern.
GateRook stores local connection secrets encrypted and resolves them for connectors. Allowed tool results are returned to your AI client and may be processed by its provider. Scope the data you expose as well as the actions you allow.
Practical answers
AWS CloudWatch Logs connection questions
Use Test connection to isolate service access problems. Use Playground and Activity to inspect endpoint permissions and tool calls.
Is this the same as the AWS connector?
No. AWS CloudWatch is a Logs backend that exposes logs_search and logs_tail. The separate AWS connector covers its own infrastructure tools.
Can I use an AWS profile instead of pasting a secret key?
Yes. Select profile as the credentials source and specify a profile available on the computer running GateRook. Optional role assumption uses that source identity.
Will a query search my entire AWS account?
The connection has an explicit region and log group list. Keep that list narrow; tool calls can also target a configured source.
Keep exploring
Connect the rest of your stack
AWS
Connect Claude, Codex or Cursor to AWS through GateRook. Inspect resources and CloudWatch metrics with scoped regions, local credentials and read-only MCP tools.
Loki
Connect Loki to AI through MCP. Search and follow scoped logs with GateRook, using native queries, bounded time ranges and private credentials.
OpenSearch
Connect OpenSearch to AI through MCP. Search and follow scoped logs with GateRook, using native queries, bounded time ranges and private credentials.
Your infrastructure, on your terms
Bring AWS CloudWatch Logs into the conversation.
Start with one connection. Choose what your AI can do.