Elastic Beanstalk should stream logs to CloudWatch

How to fix it

Turn on instance log streaming to CloudWatch Logs for the named environment. Check the instance profile first: streaming needs logs:CreateLogStream and logs:PutLogEvents, which the Elastic Beanstalk web tier and worker tier managed policies carry but a hand-built profile may not. This check reads the setting and not whether any log event arrived, so without those permissions the finding clears and the logs still go nowhere. Turning it on runs an environment update against the instances.

In the console

Elastic Beanstalk → Environments → the environment → Configuration → Updates, monitoring, and logging → Instance log streaming to CloudWatch Logs

With the AWS CLI

aws elasticbeanstalk update-environment --environment-name <environment-name> --option-settings Namespace=aws:elasticbeanstalk:cloudwatch:logs,OptionName=StreamLogs,Value=true --region <region>

With Terraform

resource "aws_elastic_beanstalk_environment" "this" {
  name        = var.environment_name
  application = var.application_name

  setting {
    namespace = "aws:elasticbeanstalk:cloudwatch:logs"
    name      = "StreamLogs"
    value     = "true"
  }
}