Pushing logs to AWS Cloud Watch from AWS FortiGate

Hi,

Please refer to https://docs.fortinet.com/document/fortigate-public-cloud/6.4.0/aws-administration-guide/154350/setting-up-cloudwatch hope this addresses your query.

From Fortiweb support about the same question:
"After checking your query to send the logs to "AWS Cloud Watch", according to the following Amazon document,

https://aws.amazon.com/cloudwatch/features/#:~:text=CloudWatch%20Container%20Insights%20collects%2C%20aggregates,Fargate%20(for%20both%20Amazon%20ECS

Amazon CloudWatch Logs service allows you to collect and store logs from your own application and on-premises resources, which is available in the "Custom logs" category, you can use AWS Systems Manager to install a CloudWatch Agent, or you can use the PutLogData API action to easily publish logs.

Fortiweb supports "Syslog" and "SIEM" servers to store the logs remotely(referring to the attached picture).

For more information regarding this point, please check the "Configuring logging" section in the following document:

https://docs.fortinet.com/document/fortiweb/7.0.10/administration-guide/303842/logging#monitoring_2048514155_1197948

I would suggest checking whether CloudWatch could support getting logs from either Syslog or SIEM, then you may configure fwb to send logs to one of them."
I think it's a truly notable shortcoming not to be able to store WAF logs on CloudWatch for a product that is sold directly on the AWS marketplace.
The only alternative, quite ugly, is to install a syslog, send all the logs there and on the instance with the syslog enable the CloudWatch agent to write them back to CW Logs. But again, it's a bad method.