# Ensure AWS Batch is Configured with AWS CloudWatch Logs (Manual)

- Source: https://support.icompaas.com/support/solutions/articles/62000234140-ensure-aws-batch-is-configured-with-aws-cloudwatch-logs-manual-
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [CIS AWS Compute Services Benchmark v1.1.0](https://support.icompaas.com/support/solutions/62000112682) › [AWS Compute Services Benchmark v1.1.0](https://support.icompaas.com/support/solutions/folders/62000169228)
- Last updated: 2026-05-29
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

### **Profile Applicability:**

Level 1  

### **Description:**

AWS Batch is a fully managed batch processing service that allows you to run hundreds to thousands of batch computing jobs on AWS. Configuring AWS Batch with AWS CloudWatch Logs ensures that logs from your batch jobs are captured for monitoring, troubleshooting, and auditing purposes. By enabling CloudWatch Logs, you can view, search, and analyze log data generated by your batch jobs in real-time.

### **Rationale:**

Configuring AWS Batch with CloudWatch Logs ensures that:

-   Logs generated by your batch jobs are automatically captured for further analysis.  
    
-   You can monitor the health and status of batch jobs, which is essential for troubleshooting issues and ensuring smooth operations.  
    
-   Logging helps in auditing batch job execution and adhering to compliance requirements.  
    

### **Default Value:**

By default, AWS Batch jobs are not configured to send logs to CloudWatch. You need to manually configure CloudWatch Logs as part of your job definitions.

**Impact:**

-   **Pros:**  
    
    -   Enhanced visibility into batch job executions and troubleshooting.  
        
    -   Real-time access to logs for monitoring performance, identifying errors, and tracking job progress.  
        
    -   Improved compliance by ensuring all job logs are stored and available for auditing.  
        
-   **Cons:  
    **  
    
    -   Requires proper configuration to ensure logs are being sent to CloudWatch.  
        
    -   CloudWatch logs can accumulate over time, leading to higher storage costs.
        

### **Remediation:**

**Test Plan:**

**Using AWS Console:**

1.  Log in to the AWS Console at [AWS Console](https://console.aws.amazon.com/).  
    
2.  Navigate to AWS Batch under Compute.  
    
3.  In the Job Definitions section, select the job definition for which you want to enable CloudWatch Logs.  
    
4.  In the Logging section of the job definition, configure the Log Group and Log Stream to send job logs to CloudWatch.  
    
5.  Make sure that CloudWatch Logs is enabled and that the correct IAM roles are assigned to allow access to CloudWatch.  
    
6.  Save the job definition and ensure that the CloudWatch Logs are correctly configured and visible in the CloudWatch Logs Console.  
    

**Using AWS CLI:**

1.  Run the following command to register a job definition with CloudWatch Logs enabled:  
    
    aws batch register-job-definition --job-definition-name <job-definition-name> --type container --container-properties '{"image":"<container-image>","vcpus":1,"memory":1024,"command":\["<your-command>"\],"logConfiguration":{"logDriver":"awslogs","options":{"awslogs-group":"/aws/batch/job-logs","awslogs-stream-prefix":"batch"}}}'
    
2.  Verify the CloudWatch Logs configuration by running the following command to describe the job definition:  
    
    aws batch describe-job-definitions --job-definition-name <job-definition-name>
    

**Implementation Plan:**

**Using AWS Console:**

1.  Log in to the AWS Console at [AWS Console](https://console.aws.amazon.com/).  
    
2.  Navigate to AWS Batch and go to Job Definitions.  
    
3.  Select or create the job definition you want to modify.  
    
4.  In the Logging section, enable CloudWatch Logs and configure the Log Group and Log Stream.  
    
5.  Ensure that the correct IAM role with permission to access CloudWatch is assigned.  
    
6.  Save and confirm that job logs are being sent to CloudWatch.  
    

**Using AWS CLI:**

1.  Use the following command to register or update the job definition:  
    
    aws batch register-job-definition --job-definition-name <job-definition-name> --type container --container-properties '{"image":"<container-image>","vcpus":1,"memory":1024,"command":\["<your-command>"\],"logConfiguration":{"logDriver":"awslogs","options":{"awslogs-group":"/aws/batch/job-logs","awslogs-stream-prefix":"batch"}}}'
    
2.  Check if the job definition is correctly updated by describing the job definition:  
    
    aws batch describe-job-definitions --job-definition-name <job-definition-name>
    

**Backout Plan:**

**Using AWS Console:**

1.  If the job is not logging to CloudWatch as expected, log in to the AWS Console.  
    
2.  Navigate to AWS Batch and check the Job Definitions section.  
    
3.  Modify the job definition and ensure the correct CloudWatch Logs configuration is applied.  
    
4.  Ensure that the IAM role has the necessary permissions to write to CloudWatch Logs.  
    

**Using AWS CLI:**

1.  If the configuration needs to be reverted, update the job definition with the correct CloudWatch Logs settings:  
    
    aws batch register-job-definition --job-definition-name <job-definition-name> --type container --container-properties '{"image":"<container-image>","vcpus":1,"memory":1024,"command":\["<your-command>"\],"logConfiguration":{"logDriver":"awslogs","options":{"awslogs-group":"/aws/batch/job-logs","awslogs-stream-prefix":"batch"}}}'
    

  

**References:**

-   [AWS CLI: register-job-definition  
    ](https://docs.aws.amazon.com/cli/latest/reference/batch/register-job-definition.html)
    
-   [AWS CLI: describe-job-definitions  
    ](https://docs.aws.amazon.com/cli/latest/reference/batch/describe-job-definitions.html)
    
-   [AWS Batch Documentation  
    ](https://docs.aws.amazon.com/batch/latest/userguide/)
    
-   [AWS CloudWatch Logs Documentation  
    ](https://docs.aws.amazon.com/cloudwatchlogs/latest/logs/WhatIsCloudWatchLogs.html)
    

**CIS Controls:**

<table style="border:none;border-collapse:collapse;font-family:&quot;Helvetica Neue&quot;"><colgroup style="font-family:&quot;Helvetica Neue&quot;"><col style="font-family:&quot;Helvetica Neue&quot;"><col style="font-family:&quot;Helvetica Neue&quot;"><col style="font-family:&quot;Helvetica Neue&quot;"></colgroup><tbody style="font-family:&quot;Helvetica Neue&quot;"><tr style="height:39.25pt;font-family:&quot;Helvetica Neue&quot;"><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-family:&quot;Helvetica Neue&quot;">Version</span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-family:&quot;Helvetica Neue&quot;">Control ID</span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-family:&quot;Helvetica Neue&quot;">Control Description</span></span></span></p></td></tr><tr style="height:39.25pt;font-family:&quot;Helvetica Neue&quot;"><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-family:&quot;Helvetica Neue&quot;">v8</span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-family:&quot;Helvetica Neue&quot;">3.4</span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-family:&quot;Helvetica Neue&quot;">Ensure AWS Batch jobs are configured to use CloudWatch Logs to track job execution and detect any issues.</span></span></span></p></td></tr><tr style="height:39.25pt;font-family:&quot;Helvetica Neue&quot;"><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-family:&quot;Helvetica Neue&quot;">v7</span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-family:&quot;Helvetica Neue&quot;">14.2</span></span></span></p></td><td style="padding:5pt;overflow:hidden;overflow-wrap:break-word;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><p dir="ltr" style="line-height:1.38;text-align:justify;margin-bottom:0pt;font-family:&quot;Helvetica Neue&quot;;font-size:14px"><span style="font-size:14px"><span style="font-family:Helvetica Neue"><span style="color:rgb(0, 0, 0);font-family:&quot;Helvetica Neue&quot;">Implement centralized logging for batch jobs using CloudWatch Logs to monitor and audit job activity.</span></span></span></p></td></tr></tbody></table>

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.