Export Lovable logs to Amazon S3

1. 1

   Go to the Data exports page in Lovable, click 'New data export', and choose 'Amazon S3' as the destination.

   This starts the process of creating a new log export to your Amazon S3 bucket.

2. 2

   Enter the name of your S3 bucket (e.g., 'acme-lovable-exports') and an optional folder name (prefix) for your files, or leave it blank for the default 'lovable-export/'.

   This tells Lovable where to store your log files within S3.

3. 3

   Choose a name for your AWS IAM role and enter its full ARN (e.g., 'arn:aws:iam::123456789012:role/LovableExportWriter') into the 'Role ARN' field in Lovable.

   This identifies the specific AWS role Lovable will use to access your S3 bucket, even if the role doesn't exist yet.

4. 4

   In your AWS IAM console, create a new role with the name you chose in the previous step, selecting 'Web identity' as the trusted entity and 'accounts.google.com' as the identity provider.

   This creates the necessary security role in AWS that Lovable will temporarily use to write files, without needing your AWS keys.

5. 5

   Copy the 'Trust policy JSON' from the Lovable setup panel and replace the existing trust policy of the IAM role you just created in AWS.

   This ensures that only Lovable's specific service account can use this role for your workspace, preventing unauthorized access.

6. 6

   Copy the 'Permissions policy JSON' from the Lovable setup panel and attach it to the IAM role you created in AWS.

   This grants the role the specific permissions (like writing and deleting objects) it needs to interact with your S3 bucket, but only within the specified folder (prefix).

7. 7

   In Lovable, choose the 'Source' of the logs you want to export (e.g., audit logs) and click 'Test connection'.

   This verifies that Lovable can successfully connect to your S3 bucket using the IAM role and write a small test file.

8. 8

   Once the connection test passes, click 'Create export' in Lovable.

   This finalizes the setup and starts the scheduled export of your logs to S3.

Hey Lovable, please set up a scheduled export of my audit logs to my Amazon S3 bucket named 'acme-lovable-exports'. I want the files to go into a folder called 'lovable-logs/' within that bucket. I've already created an IAM role in AWS named 'LovableExportWriter' with the ARN 'arn:aws:iam::123456789012:role/LovableExportWriter' and updated its trust and permissions policies as per the documentation. Please test the connection and create the export.

Amazon S3

A cloud storage service provided by Amazon Web Services (AWS) for storing large amounts of data, like files and backups.

IAM role

An AWS identity that has specific permissions to access AWS resources. Instead of a user, a service like Lovable can temporarily 'assume' this role to perform actions.

Web identity federation

A way for services like Lovable to get temporary access to your AWS resources by proving their identity through a trusted third party (like Google), without you having to share permanent AWS security keys.

gzipped JSON Lines files

Log data stored in a compressed format (gzipped) where each line is a separate JSON object (JSON Lines), making it efficient for storage and processing.

ARN (Amazon Resource Name)

A unique identifier for any resource in AWS, like a specific S3 bucket or an IAM role.

Trust policy

A set of rules attached to an IAM role that defines who or what is allowed to assume that role.

Permissions policy

A set of rules attached to an IAM role that defines what actions the role is allowed to perform on which AWS resources.

Prefix

In S3, a prefix acts like a folder path within a bucket, helping to organize files.

• Using a custom OIDC provider for 'accounts.google.com' that doesn't include your Lovable workspace's audience, which can prevent Lovable from assuming the role.
• Not using the exact trust policy provided by Lovable, which could either block Lovable's access or allow other Lovable workspaces to assume your role.
• Forgetting to update the permissions policy if you change the S3 prefix, which will cause write failures.
• Deleting the S3 bucket after setting up the export, which will pause the export and cause runs to fail.