NLog - log to different Account than other AWS Services use.

[gwilczura]

I have a .NET application that uses SNS, SQS and SecretsManager.
For those to authenticate I use DefaultAWSCredentialsIdentityResolver.GetCredentials() in code.

I also run my VisualStudio with profile environmaneVariables

"AWS_PROFILE": "localstack"

And I actually do use localstack. With SNS, SQS, SecretsManager enabled.

Now I have added NLog with AWSTarget to log to CloudWatch with specified region and profile.

<targets>
    <target name="aws" type="AWSTarget"
            logGroup="NLog.TestGroup"
            region="eu-west-1"
            profile="my-other-profile"
             />
</targets>

The other profile is pointing to actual AWS account with CloudWatch in it.

Now this does not work :)
in aws-logger-errors.txt i'm getting:

  :Amazon.SSO.AmazonSSOException: The specified bucket does not exist
 ---> Amazon.Runtime.Internal.HttpErrorResponseException: Exception of type 'Amazon.Runtime.Internal.HttpErrorResponseException' was thrown.
   at Amazon.Runtime.HttpWebRequestMessage.ProcessHttpResponseMessage(HttpResponseMessage responseMessage)

If i would change env variables to:

"AWS_PROFILE": "my-other-profile"

Then logging works. But now everything is in the same account.

I am suspecting that somehow AWSTarget when authenticating is using the service url of the localstack - but that is only suspicion.

But when I add serviceUrl to target:

<targets>
    <target name="aws" type="AWSTarget"
            logGroup="NLog.TestGroup"
            region="eu-west-1"
            profile="my-other-profile"
            serviceUrl="monitoring.eu-west-1.amazonaws.com"
             />
</targets>

I'm no longer getting error, but I'm also not getting logs :D
Fun fact - when I change AWS_PROFILE

"AWS_PROFILE": "my-other-profile"

and use serviceUrl like above - I'm also not getting logs.

Please help - how can I make this work?

Reference that I have already seen: https://stackoverflow.com/questions/48899053/using-multiple-awsprofilenames-simultaneously-in-your-net-application
Just not sure how I would apply this to my AWS Target,

[gwilczura]

I managed to solve my own issue :)

Most important part - I have removed from environmaneVariables the AWS_PROFILE.

I have added in appsettings.json:

  "Aws": {
    "DefaultProfile": "localstack",
    "LogsProfile": "my-other-profile"
  }

For the SNS, SQS and Secrets I'm now using code like this:

  var chain = new CredentialProfileStoreChain();
  var credentialsResult = chain.TryGetAWSCredentials(awsOptions.DefaultProfile, out var awsCredentials);

and for the NLog now the standard configuration works.
I have it now in code:

var profile = awsOptions.LogsProfile;

var awsTarget = new AWSTarget()
{
    LogGroup = "some-log-group",
    Region = region.SystemName,
    Profile = profile
};

And it works.