Tip — pipeline logging for debugging. Trace data may carry sensitive application content (request parameters, user identifiers, span attributes), so create the log group with KMS encryption first, then attach it:
bash
# 1. Create the log group with a customer-managed KMS keyaws logs create-log-group \ --log-group-name /aws/vendedlogs/OpenSearchIngestion/trace-pipeline \ --kms-key-id arn:aws:kms:<region>:<account>:key/<key-id>aws logs put-retention-policy \ --log-group-name /aws/vendedlogs/OpenSearchIngestion/trace-pipeline \ --retention-in-days 30# 2. Attach it to the pipelineaws osis update-pipeline --pipeline-name trace-pipeline \ --log-publishing-options 'CloudWatchLogDestination={LogGroup=/aws/vendedlogs/OpenSearchIngestion/trace-pipeline},IsLoggingEnabled=true'