You can continually push logs from mongod, mongos, and audit logs to an AWS S3 bucket from an M10+ cluster. Atlas exports logs every 5 minutes.
Required Access
To push logs to an AWS S3 bucket, you must have Project Owner or Organization Owner access to Atlas.
To push logs to an AWS S3 bucket using the Atlas Administration API, you must have Project Owner access to Atlas.
Considerations
You can't specify which logs to send. Atlas sends all
mongod,mongos, and audit logs.Push-based log export doesn't support Bring Your Own Key (BYOK).
You can only push logs to an AWS S3 bucket from an
M10+Atlas cluster.Atlas doesn't export log lines over 10 MB.
End of Life and Migration
MongoDB is phasing out Push-Based Log Export in favor of external log sinks, which offer 1-minute export intervals, AWS KMS encryption, support for Multi-Region Access Points, additional destinations, and per-destination log type selection.
Date | Milestone |
|---|---|
February 4, 2026 | Push-Based Log Export deprecated. |
September 2026 | External log sinks are generally available and enabled for all accounts. |
October 30, 2026 | Push-Based Log Export stops accepting new configurations. Existing exports continue to run uninterrupted. |
February 4, 2027 | Push-Based Log Export reaches end of life. MongoDB no longer provides security updates, bug fixes, or technical support for push-based log export. Existing configurations continue to run until MongoDB retires the feature in coordination with your account team. |
Migrate to External Log Sinks
To migrate from Push-Based Log Export to an external log sink, complete the following steps.
Create an AWS S3 log export integration.
Configure the integration to use the same AWS IAM role and S3 bucket as your push-based configuration. To preserve the push-based daily-folder path structure, set useLegacyPathStructure to true. For configuration steps, see Export Logs to AWS S3 Buckets.
If you encounter blockers during migration, contact MongoDB Support.
Prerequisites
You will need:
an AWS IAM role with sts:AssumeRole that grants Atlas access to your AWS resource with a maximum session duration set to 12 hours.
an existing AWS S3 bucket.
An
M10+Atlas cluster.
Procedure
Note
During the procedure, Atlas creates a role policy to access the S3 bucket with the following permissions:
To continually push logs to an AWS S3 bucket, follow these steps.
In Atlas, go to the Advanced page for your project.
If it's not already displayed, select the organization that contains your project from the Organizations menu in the navigation bar.
If it's not already displayed, select your project from the Projects menu in the navigation bar.
In the sidebar, click Database & Network Access under the Security heading.
In the sidebar, click Advanced.
The Advanced page displays.