> For the complete documentation index, see [llms.txt](https://docs.bluerock.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.bluerock.io/deployment-guides/aws-deployments/aws-deployment-with-cli.md).

# AWS Deployment with CLI

### High-Level Architecture Overview

This section provides a conceptual overview of how the BlueRock instance is deployed on AWS EC2 and how its core components interact.

#### End-to-End Flow

Deployment scripts are executed from a user's desktop or client environment where AWS CLI is configured. The script uses AWS APIs to provision the required AWS Resources and deploy the BlueRock instance.

#### BlueRock EC2 Architecture Components

#### Architecture Diagram

<figure><img src="https://1983702018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCNnVnPvaRpvlLmPT6IAN%2Fuploads%2FufGZTOKEI5Zm6krwwrdk%2Fimage.png?alt=media&amp;token=c23ee52c-8d7d-4eda-a919-00c1087fc865" alt=""><figcaption></figcaption></figure>

#### **BlueRock EC2 Architecture Components**

A typical BlueRock Secure MCP Server EC2 deployment consists of the following AWS Resources/Services:

<table data-search="false"><thead><tr><th width="316.65625">AWS Resources/Services</th><th>Description</th></tr></thead><tbody><tr><td><strong>Virtual Private Cloud (VPC)</strong></td><td>Provides an isolated networking environment in AWS where all BlueRock deployment resources are created.</td></tr><tr><td><strong>Amazon VPC Gateway</strong></td><td>Enables controlled inbound and outbound internet access for resources deployed inside the VPC.</td></tr><tr><td><strong>Amazon EC2 (BlueRock Instance)</strong></td><td>Runs the BlueRock MCP Server using a hardened BlueRock AMI and hosts all runtime services.</td></tr><tr><td><strong>Amazon Elastic Block Store (EBS)</strong></td><td>Provides persistent block storage attached to the EC2 instance for operating system and application data.</td></tr><tr><td><strong>Amazon S3 (BlueRock Config)</strong></td><td>Stores BlueRock configuration files such as <code>config.toml</code> that are retrieved by the BlueRock control plane during runtime.</td></tr><tr><td><strong>AWS Identity and Access Management (IAM) Role</strong></td><td>Grants the EC2 instance permission to access required AWS services such as Amazon S3 and Amazon CloudWatch.</td></tr><tr><td><strong>Amazon CloudWatch Logs</strong></td><td>Stores runtime logs and security events generated by the BlueRock MCP Server for analysis and auditing.</td></tr><tr><td><strong>User / Administrator</strong></td><td>Manages and monitors the BlueRock deployment through AWS services such as CloudWatch and AWS Systems Manager (SSM).</td></tr></tbody></table>

***

#### Deployment types

BlueRock EC2 deployments support multiple deployment modes depending on networking and telemetry requirements:

<table data-header-hidden><thead><tr><th width="176.95703125">Deployment Mode</th><th>Description</th></tr></thead><tbody><tr><td><strong>Private</strong></td><td>Deploys a single BlueRock EC2 instance into a private subnet, with outbound access via a NAT Gateway and management access enabled through AWS Systems Manager (SSM).</td></tr><tr><td><strong>Public</strong></td><td>Deploys a single BlueRock EC2 instance into a public subnet, allowing management access through SSH (if configured) and AWS Systems Manager (SSM).</td></tr></tbody></table>

***

### Supported AMI Distributions

BlueRock Secure MCP Server supports the following Linux distributions. Each distribution has a corresponding AMI with a specific kernel version:

| **Name**              | **Kernel Version** | **AMI NAME**                                |
| --------------------- | ------------------ | ------------------------------------------- |
| **Amazon Linux 2023** | 6.12.89            | bluerock-release-26-23-1-amzlnx2023-6.12.89 |
| **Ubuntu 24.04**      | 6.12.89            | bluerock-release-26-23-1-ubuntu2404-6.12.89 |

{% hint style="info" icon="notes-sticky" %}
**Note:**&#x20;

The AMI name includes the **BlueRock release version**, **Linux distribution**, and **Kernel version**, allowing users to identify compatibility directly from the AMI name
{% endhint %}

***

### Prerequisites

#### AWS Requirements

* Active AWS account
* [AWS CLI](https://aws.amazon.com/cli/)
  * [AWS key credentials](https://docs.aws.amazon.com/cli/v1/userguide/cli-chap-configure.html) configured in the local environment

### Deployment Workflow Overview

1. **Phase 1: AWS Infrastructure Provisioning (Local Client / AWS CLI)**
   1. [Create the IAM Role and Instance Profile](#create-the-iam-role-and-instance-profile)
      1. [Create the Trust Policy](#create-the-trust-policy)
      2. [Create the Role](#create-the-role)
   2. [Create the S3 Bucket](#create-the-s3-bucket)
      1. [Attach AWS Managed Policies](#attach-aws-managed-policies)
      2. [Create and Attach the Custom Policy with Minimal Permissions](#create-and-attach-the-custom-policy-with-minimal-permissions)
      3. [Create and Link the Instance Profile](#create-and-link-the-instance-profile)
   3. [Launch the EC2 Instance](#launch-the-ec2-instance)
      1. [Check Instance Access](#check-instance-access)
         1. [SSH Access](#ssh-access-public-deployment)
         2. [SSM Access](#ssm-access-private-deployments)
2. **Phase 2: BlueRock Instance Setup**
   1. [Policy Creation and Upload to S3 Bucket](#policy-creation-and-upload-to-s3-bucket)
      1. [Create Policy](#create-policy)
      2. [Required Policy Artifacts](#required-policy-package-artifacts)
      3. [Upload Files to S3](#upload-policy-files-to-s3)
   2. [OTEL Configuration](#otel-configuration)
   3. [BlueRock Instance Configuration](#bluerock-instance-configuration)
      1. [Verify `bluerockd` operation](#verify-bluerockd-operation)
3. **Phase 3: Logs in CloudWatch and Troubleshooting**
   1. [View Logs in AWS CloudWatch](#view-logs-in-aws-cloudwatch)
   2. [Troubleshooting](#troubleshooting)
      1. [Review `bluerockd` logs](#review-bluerockd-logs)
      2. [OpenTelemetry Connectivity Verification](#opentelemetry-connectivity-verification)
      3. [Verify BlueRock Kernel Sensor Service](#verify-bluerock-kernel-sensor-service)
      4. [Verify BlueRock Kernel Sensor Logs](#verify-bluerock-kernel-sensor-logs)
      5. [Verify Runtime Artifacts  (BlueRock Sensor Socket)](#runtime-artifacts-bluerock-sensor-socket)
      6. [Inspect Local OTEL Event Logs](#local-otel-event-logs)
      7. [Check `otelcol.service` logs](#opentelemetry-collector-logs)

### Create the IAM Role and Instance Profile

Configure an IAM Role for the EC2 instance with least-privilege permissions tailored to each service requirement:

* **Amazon S3 Access:**\
  Grants permissions to upload and download policy configuration files, public keys, digital signatures, and checksum files to and from the target S3 bucket.
* **Amazon CloudWatch Logging:**\
  Grants permission to push OTEL log events to CloudWatch Log Streams for central monitoring and visualization.
* **AWS Systems Manager (SSM) Management:**\
  Enables core agent capabilities for remote management, administration, and patching of the BlueRock VM instance.
* **Amazon EC2 Read Access:**\
  Grants read-only access to query instance metadata, subnets, and security groups required by the BlueRock VM.

#### Create the Trust Policy

Create a local file named `ec2-trust-policy.json` :

{% code title="ec2-trust-policy.json" lineNumbers="true" %}

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": { "Service": "ec2.amazonaws.com" },
      "Action": "sts:AssumeRole"
    }
  ]
}
```

{% endcode %}

#### Create the Role

Execute the following command to create the IAM role:

```shellscript
$ aws iam create-role \
    --role-name <IAMRoleName> \
    --assume-role-policy-document file://ec2-trust-policy.json
```

Expected Command Output:

```shellscript
{
    "Role": {
        "Path": "/",
        "RoleName": "<IAMRoleName>",
        "RoleId": "<ROLE_ID>",
        "Arn": "arn:aws:iam::<AWS_ACCOUNT_ID>:role/<IAMRoleName>",
        "CreateDate": "2026-08-13T20:52:29+00:00",
        "AssumeRolePolicyDocument": {
            "Version": "2012-10-17",
            "Statement": [
                {
                    "Effect": "Allow",
                    "Principal": {
                        "Service": "ec2.amazonaws.com"
                    },
                    "Action": "sts:AssumeRole"
                }
            ]
        }
    }
}
```

### Create the S3 Bucket

Create a globally unique S3 bucket to store the BlueRock Instance policies:

```shellscript
$ aws s3 mb s3://<BucketName> --region <Region>
```

#### Attach AWS Managed Policies

Attach the required AWS-managed policies for EC2 read access, CloudWatch telemetry, and Systems Manager (SSM) core agent support:

* **`AmazonEC2ReadOnlyAccess`**:\
  Grants read-only access to query EC2 infrastructure details, subnets, and security groups.
* **`CloudWatchAgentServerPolicy`**:\
  Grants permission to collect and push OTEL telemetry logs to Amazon CloudWatch.
* **`AmazonSSMManagedInstanceCore`**:\
  Enables core agent capabilities for remote instance management and administration via Systems Manager.

```shellscript
$ aws iam attach-role-policy \
    --role-name <IAMRoleName> \
    --policy-arn arn:aws:iam::aws:policy/AmazonEC2ReadOnlyAccess

$ aws iam attach-role-policy \
    --role-name <IAMRoleName> \
    --policy-arn arn:aws:iam::aws:policy/CloudWatchAgentServerPolicy

$ aws iam attach-role-policy \
    --role-name <IAMRoleName> \
    --policy-arn arn:aws:iam::aws:policy/AmazonSSMManagedInstanceCore
```

#### **Create and Attach the Custom Policy with Minimal Permissions**

Create a local file named `bluerock-installer-policy.json` containing the explicit minimal permissions for S3 policy objects and log stream events:

{% code title="bluerock-installer-policy.json" lineNumbers="true" %}

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:ListBucket",
        "logs:PutLogEvents"
      ],
      "Resource": "*"
    },
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:PutObject"
      ],
      "Resource": [
        "arn:aws:s3:::<BucketName>/bluerock_pub_key.pem",
        "arn:aws:s3:::<BucketName>/policy.json",
        "arn:aws:s3:::<BucketName>/policy.json.sha256",
        "arn:aws:s3:::<BucketName>/policy.json.sig"
      ]
    }
  ]
}
```

{% endcode %}

Execute the commands to create the custom policy and attach it to the role:

```shellscript
$ aws iam create-policy \
    --policy-name <PolicyName> \
    --policy-document file://bluerock-installer-policy.json

$ aws iam attach-role-policy \
    --role-name <IAMRoleName> \
    --policy-arn arn:aws:iam::<AWS_ACCOUNT_ID>:policy/<PolicyName>
```

#### Create and Link the Instance Profile

Create the instance profile and link the IAM role:

```shellscript
$ aws iam create-instance-profile --instance-profile-name <InstanceProfileName>

$ aws iam add-role-to-instance-profile \
    --instance-profile-name <InstanceProfileName> \
    --role-name <IAMRoleName>
```

Expected Command Output:

```shellscript
{
    "InstanceProfile": {
        "Path": "/",
        "InstanceProfileName": "<InstanceProfileName>",
        "InstanceProfileId": "<INSTANCE_PROFILE_ID>",
        "Arn": "arn:aws:iam::<AWS_ACCOUNT_ID>:instance-profile/<InstanceProfileName>",
        "CreateDate": "2026-08-13T20:53:01+00:00",
        "Roles": []
    }
}
```

### Launch the EC2 Instance

Launch the EC2 instance using the target AMI and attach the IAM Instance Profile created previously:

```shellscript
$ aws ec2 run-instances \
    --image-id <AMI_ID> \
    --instance-type <InstanceType> \
    --key-name <SSHKeyName> \
    --security-group-ids <SecurityGroupID> \
    --subnet-id <SubnetID> \
    --iam-instance-profile Name="<InstanceProfileName>" \
    --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":40,"VolumeType":"gp3"}}]' \
    --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=<EC2Username>}]' \
    --region <Region>
```

{% hint style="info" icon="notes-sticky" %}
**Note:**

* Ensure that the specified `--security-group-ids` and `--subnet-id` belong to the same VPC prior to execution.
* To locate the shared AMI ID in the target account, run:

  ```shellscript
  $ aws ec2 describe-images --owners self <AWS_ACCOUNT_ID> --region <Region> --output table
  ```
* If Subnet or Security Group IDs are already known, skip retrieving infrastructure details; otherwise, run the following CLI commands for your region:
  * Subnets:&#x20;

    ```shellscript
    $ aws ec2 describe-subnets --region <Region> --query 'Subnets[*].[SubnetId, AvailabilityZone]' --output table
    ```
  * Security Groups:&#x20;

    ```shellscript
    $ aws ec2 describe-security-groups --region <Region> --query 'SecurityGroups[*].[GroupId, GroupName]' --output table
    ```

{% endhint %}

**Parameter Table:**

<table><thead><tr><th width="229.5555419921875">Parameter</th><th width="98.99993896484375">Type</th><th>Description</th></tr></thead><tbody><tr><td><code>--image-id</code></td><td><strong>Required</strong></td><td>Target region Amazon Machine Image (AMI) ID (e.g., <code>ami-&#x3C;00xxx00xx></code>).</td></tr><tr><td><code>--instance-type</code></td><td><strong>Required</strong></td><td>Hardware configuration size for the EC2 instance (e.g., <code>t3.large</code>).</td></tr><tr><td><code>--key-name</code></td><td><strong>Required</strong></td><td>SSH Key Pair identifier created in the target region (e.g., <code>&#x3C;key-name></code>)</td></tr><tr><td><code>--security-group-ids</code></td><td><strong>Required</strong></td><td>VPC Security Group ID regulating inbound and outbound network access rules (e.g., <code>sg-&#x3C;00xxx00xx></code>).</td></tr><tr><td><code>--subnet-id</code></td><td><strong>Required</strong></td><td>Specific Subnet and Availability Zone ID where the instance is deployed (e.g., <code>subnet-&#x3C;00xxx00xx></code>).</td></tr><tr><td><code>--iam-instance-profile</code></td><td><strong>Required</strong></td><td>IAM Instance Profile name granting S3 and CloudWatch access to the instance (e.g., <code>&#x3C;InstanceProfileName></code>).</td></tr><tr><td><code>--block-device-mappings</code></td><td><strong>Required</strong></td><td>Storage volume configurations specifying a 40GB <code>gp3</code> root volume.</td></tr><tr><td><code>--tag-specifications</code></td><td><strong>Required</strong></td><td>Resource identification tags in key-value format (e.g., <code>Name=&#x3C;EC2Username></code>).</td></tr><tr><td><code>--region</code></td><td><strong>Required</strong></td><td>Target AWS Region code where infrastructure is hosted (e.g., <code>&#x3C;region-code></code>).</td></tr><tr><td><code>--count</code></td><td><em>Optional</em></td><td>Number of identical instances to launch simultaneously (Default: <code>1</code>).</td></tr><tr><td><code>--associate-public-ip-address</code></td><td><em>Optional</em></td><td>Flag to automatically assign a public IP address.</td></tr><tr><td><code>--user-data</code></td><td><em>Optional</em></td><td>Path to a bootstrapping script executed automatically upon instance boot.</td></tr><tr><td><code>--ebs-optimized</code></td><td><em>Optional</em></td><td>Flag enabling dedicated EBS throughput for high performance.</td></tr><tr><td><code>--instance-initiated-shutdown-behavior</code></td><td><em>Optional</em></td><td>Action taken when OS-level shutdown is initiated (<code>stop</code> or <code>terminate</code>).</td></tr></tbody></table>

#### Check Instance Access

#### **SSH Access (Public Deployment)**

Check instance access to confirm SSH connectivity for public deployments by running the appropriate command for the selected AMI:

```shellscript
Amazon Linux:
$ ssh -i /path/to/key.pem ec2-user@<PUBLIC_IP>

Ubuntu:
$ ssh -i /path/to/key.pem ubuntu@<PUBLIC_IP>
```

#### **SSM Access (Private Deployments)**

For instances deployed in a private subnet without a public IP address, establish an interactive shell session using AWS Systems Manager (SSM) Session Manager.

{% hint style="success" %}
**Important:**

* The AWS Systems Manager Session Manager plugin must be installed on the local machine.
* The EC2 instance must have the `AmazonSSMManagedInstanceCore` policy attached via its IAM Instance Profile.
  {% endhint %}

**Connect via AWS CLI**

Start a session using the EC2 Instance ID:

```shellscript
$ aws ssm start-session \
    --target <INSTANCE_ID> \
    --region <Region>
```

### Policy Creation and Upload to S3 Bucket

#### Create Policy

Policy artifacts must be generated, signed, and uploaded to the target Amazon S3 bucket prior to starting or updating the service daemon. The BlueRock instance uses the TREX tool that resides at `/opt/bluerock/trex` to generate a signed policy blob (`.tar`), extract the signed files, and verify digital signatures during startup.

For detailed instructions on generating public keys, configuring `trex.toml`, and building policy templates, refer to the [Policy Builder documentation](/policy-configuration/policy-builder.md).

#### Required Policy Package Artifacts

| **File**             | **Purpose**                                                                     |
| -------------------- | ------------------------------------------------------------------------------- |
| `policy.json`        | The core JSON policy file containing the defined enforcement rules.             |
| `policy.json.sha256` | The cryptographic hash file used to verify JSON integrity.                      |
| `policy.json.sig`    | The digital signature file used to authenticate the policy file.                |
| `dynpol_pubkey.pem`  | The public key certificate used by the daemon to validate the policy signature. |

#### Upload Policy Files to S3

Copy the policy package artifacts to the configured S3 bucket path:

```shellscript
$ aws s3 cp policy.json s3://<BucketName>/
$ aws s3 cp policy.json.sig s3://<BucketName>/
$ aws s3 cp dynpol_pubkey.pem s3://<BucketName>/
```

{% hint style="info" icon="notes-sticky" %}
**Note:**

Ensure file names and bucket paths match the target locations specified in the [BlueRock Instance Configuration](#bluerock-instance-configuration) section. The private key used for signing policy files must never be uploaded to S3.
{% endhint %}

### OTEL Configuration&#x20;

Configure the OTEL Collector to capture runtime telemetry and log events from `bluerockd` and route them to Amazon CloudWatch Logs for centralized monitoring and auditing. The default configuration file resides at `/opt/bluerock/otel` with file name `otel-config.yaml`, includes standard OTLP HTTP receivers and batch processors. Only the `exporters` section requires modification to establish the target CloudWatch Logs integration.

Locate the OTEL config file:

```shellscript
$ cd /opt/bluerock/otel
$ ls
otel-config.yaml
```

Modify the `exporters` block in `otel-config.yaml` to specify the CloudWatch Log Group, Log Stream, and regional API endpoint:

{% code title="otel-config.yaml" lineNumbers="true" %}

```yaml
exporters:
  debug:
    verbosity: detailed
  awscloudwatchlogs:
    log_group_name: "<LogGroupName>"
    log_stream_name: "<LogStreamName>"
    region: "<Region>"
    endpoint: https://logs.<Region>.amazonaws.com
```

{% endcode %}

#### Configuration Parameters Table

<table><thead><tr><th width="241.99993896484375">Parameter</th><th width="143.4444580078125">Section</th><th>Description</th></tr></thead><tbody><tr><td><code>exporters.debug.verbosity</code></td><td>Exporter Config</td><td>Detail level of debug output generated by the collector (<code>basic</code>, <code>normal</code>, or <code>detailed</code>).</td></tr><tr><td><code>exporters.awscloudwatchlogs.log_group_name</code></td><td>Exporter Config</td><td>Target Amazon CloudWatch Log Group name where log events are published.</td></tr><tr><td><code>exporters.awscloudwatchlogs.log_stream_name</code></td><td>Exporter Config</td><td>Specific Amazon CloudWatch Log Stream name within the log group.</td></tr><tr><td><code>exporters.awscloudwatchlogs.region</code></td><td>Exporter Config</td><td>AWS Region code hosting the CloudWatch Logs endpoint (e.g., <code>&#x3C;Region></code>).</td></tr><tr><td><code>exporters.awscloudwatchlogs.endpoint</code></td><td>Exporter Config</td><td>Regional CloudWatch Logs API endpoint URL (e.g., <code>https://logs.&#x3C;Region>.amazonaws.com</code>).</td></tr></tbody></table>

Enable the OTel service:

```shellscript
$ sudo systemctl enable otelcol.service
```

Start the otel service:

```shellscript
$ sudo systemctl start otelcol.service
```

Check the status of the OTel service:

```shellscript
$ sudo systemctl status otelcol.service
```

Expected output:

```shellscript
● otelcol.service - OpenTelemetry Collector (Bluerock)
     Loaded: loaded (/etc/systemd/system/otelcol.service; enabled; preset: enabled)
     Active: active (running) since Thu 2026-08-13 17:13:18 UTC; 6 days ago
       Docs: https://opentelemetry.io/docs/collector/
   Main PID: <PID> (aws-otel-collec)
      Tasks: 10 (limit: 18781)
     Memory: 128.3M (peak: 144.3M)
        CPU: 7min 8.857s
     CGroup: /system.slice/otelcol.service
             └─<PID> /opt/aws/aws-otel-collector/bin/aws-otel-collector --config=/opt/bluerock/otel/otel-config.yaml

Aug 19 20:58:52 ip-<IP_ADDRESS> run-otelcol.sh[<PID>]: 2026-08-19T20:58:52.945Z        debug        cwlogs@v0.130.0/pusher.go:271        logpusher: publish log events successfully.        {>
Aug 19 21:00:34 ip-<IP_ADDRESS> run-otelcol.sh[<PID>]: 2026-08-19T21:00:34.533Z        debug        cwlogs@v0.130.0/pusher.go:271        logpusher: publish log events successfully.        {>
Aug 19 21:00:34 ip-<IP_ADDRESS> run-otelcol.sh[<PID>]: 2026-08-19T21:00:34.559Z        debug        cwlogs@v0.130.0/pusher.go:271        logpusher: publish log events successfully.        {>
Aug 19 21:00:34 ip-<IP_ADDRESS> run-otelcol.sh[<PID>]: 2026-08-19T21:00:34.573Z        debug        cwlogs@v0.130.0/pusher.go:271        logpusher: publish log events successfully.        {>
Aug 19 21:00:35 ip-<IP_ADDRESS> run-otelcol.sh[<PID>]: 2026-08-19T21:00:35.444Z        debug        cwlogs@v0.130.0/pusher.go:271        logpusher: publish log events successfully.        {>
Aug 19 21:02:34 ip-<IP_ADDRESS> run-otelcol.sh[<PID>]: 2026-08-19T21:02:34.535Z        debug        cwlogs@v0.130.0/pusher.go:271        logpusher: publish log events successfully.        {>
Aug 19 21:04:34 ip-<IP_ADDRESS> run-otelcol.sh[<PID>]: 2026-08-19T21:04:34.580Z        debug        cwlogs@v0.130.0/pusher.go:271        logpusher: publish log events successfully.        {>
```

### BlueRock Instance Configuration

BlueRock instances have a configuration file `bluerockd.toml` to define telemetry and policy settings that reside at `/etc/bluerock/`.

{% code title="bluerockd.toml" lineNumbers="true" %}

```toml
[runtime]
metrics_timer = 1800
state_dir = "/var/lib/bluerockd/"

[policy]
public_key = "s3://<bucket-name>/<key>.pem"
poll_period = 300

[policy.source]
location   = "s3://<bucket-name>/"
policy     = "<policy>.json"
policy_sig = "<policy>.json.sig"

[policy.source.transport]
auth_method = "default"
region      = "us-east-1"

[policy.engine]
augment_events  = true

[otlp]
file = "/var/log/bluerockd/otel-events.log"

[otlp.http]
url = "http://<internal_ip>:4318/"
```

{% endcode %}

{% hint style="info" icon="notes-sticky" %}
**Note:**

The `<internal_ip>` placeholder specifies the local private IP address of the EC2 instance. This local address is used because the OTEL Collector service `otelcol.service` runs locally on the BlueRock instance.
{% endhint %}

| **Parameter**                         | **Type**      | **Description**                                                                                                                             |
| ------------------------------------- | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------- |
| `metrics_timer`                       | Integer       | How often (in seconds) the agent pushes its performance metrics (e.g., `1800` = 30 minutes).                                                |
| `state_dir`                           | Path / String | The local directory path where the agent (`bluerockd`) stores its internal state data.                                                      |
| `policy.public_key`                   | S3 Path       | The Amazon S3 bucket location of the public key used to validate the policy signature file (`.pem` format).                                 |
| `policy.poll_period`                  | Integer       | How often (in seconds) the agent checks the source location for a new policy version (e.g., `300` = 5 minutes).                             |
| `policy.source.location`              | S3 Path       | The base Amazon S3 bucket path where the policy-related files are hosted.                                                                   |
| `policy.source.policy`                | File Name     | The specific JSON file name containing the agent's configuration rules.                                                                     |
| `policy.source.policy_sig`            | File Name     | The digital signature file used to verify that the core policy JSON file hasn't been tampered with.                                         |
| `policy.source.transport.auth_method` | String        | The authentication strategy used to access files. Setting it to `default` utilizes the EC2 instance's attached IAM Role / Instance Profile. |
| `policy.source.transport.region`      | String        | The Amazon Web Services (AWS) region where the storage resources are located (e.g., `us-east-1`).                                           |
| `policy.engine.augment_events`        | Boolean       | Determines whether the policy engine should enrich or add additional metadata/context to the captured events (`true` or `false`).           |
| `otlp.file`                           | Path / String | The local file path where OpenTelemetry log events are written.                                                                             |
| `otlp.http.url`                       | URL           | The local or internal HTTP endpoint (usually an OTLP/HTTP receiver or collector) where telemetry data is forwarded.                         |

After editing `bluerockd.toml`, restart the `bluerockd.service`:

```shellscript
$ sudo systemctl restart bluerockd.service
```

#### Verify `bluerockd` operation

Verify the operational status and log output of the `bluerockd` service after modifying `/etc/bluerock/bluerockd.toml` and restarting the service.

```shellscript
$ sudo systemctl status bluerockd.service
```

Expected output:

```shellscript
● bluerockd.service - BlueRock Daemon
     Loaded: loaded (/usr/lib/systemd/system/bluerockd.service; enabled; preset: enabled)
    Drop-In: /usr/lib/systemd/system/bluerockd.service.d
             └─10-containerd.conf
     Active: active (running) since Thu 2026-08-20 08:33:53 UTC; 6s ago
TriggeredBy: ● bluerockd.socket
             ● bluerockd-sandbox.socket
       Docs: https://bluerock.io/
   Main PID: <PID> (bluerockd)
      Tasks: 14 (limit: 18781)
     Memory: 39.0M (peak: 40.2M)
        CPU: 865ms
     CGroup: /system.slice/bluerockd.service
             └─<PID> /opt/bluerock/bin/bluerockd --config=/etc/bluerock/bluerockd.toml --socket=/run/bluerock/sensor.sock --stdout

Aug 20 08:33:53 ip-<IP_ADDRESS> bluerockd[<PID>]: 2026-08-20T08:33:53.898111427Z  INFO bluerockd: system/bluerockd/src/main.rs:186: Listening on socket-activated (/run/bluerock/sensor.sock)
Aug 20 08:33:53 ip-<IP_ADDRESS> bluerockd[<PID>]: 2026-08-20T08:33:53.899239699Z  INFO bluerockd: system/bluerockd/src/main.rs:190: Accepting new connection Handshake { pid: <PID>, protocol>
Aug 20 08:33:53 ip-<IP_ADDRESS> bluerockd[<PID>]: 2026-08-20T08:33:53.89992773Z  INFO bluerockd::pcm::connection: system/bluerockd/src/pcm/connection.rs:81: Connection 9318: New connection,>
Aug 20 08:33:53 ip-<IP_ADDRESS> bluerockd[<PID>]: 2026-08-20T08:33:53.899985321Z  INFO bluerockd::pcm::connection: system/bluerockd/src/pcm/connection.rs:164: Connection 9318: Notified mana>
Aug 20 08:33:53 ip-<IP_ADDRESS> bluerockd[<PID>]: 2026-08-20T08:33:53.899986599Z  INFO bluerockd::pcm::mgmt: system/bluerockd/src/pcm/mgmt.rs:294: Management Task: Received Status: 'Handlin>
Aug 20 08:33:53 ip-<IP_ADDRESS> bluerockd[<PID>]: 2026-08-20T08:33:53.900056787Z  INFO bluerockd::pcm::mgmt: system/bluerockd/src/pcm/mgmt.rs:318: Management Task: id=9318 - Current policy >
Aug 20 08:33:53 ip-<IP_ADDRESS> bluerockd[<PID>]: 2026-08-20T08:33:53.900137021Z  INFO bluerockd: system/bluerockd/src/main.rs:219: Sensor 9318: Spawn metadata updater
Aug 20 08:33:53 ip-<IP_ADDRESS> bluerockd[<PID>]: 2026-08-20T08:33:53.900167295Z  INFO bluerockd: system/bluerockd/src/main.rs:221: Sensor 9318: Spawning handler
Aug 20 08:33:53 ip-<IP_ADDRESS> bluerockd[<PID>]: 2026-08-20T08:33:53.901101875Z  INFO bluerockd::pcm::connection: system/bluerockd/src/pcm/connection.rs:421: Connection 9318: Selecting ker>
Aug 20 08:33:53 ip-<IP_ADDRESS> bluerockd[<PID>]: 2026-08-20T08:33:53.901450267Z  INFO bluerockd::pcm::connection: system/bluerockd/src/pcm/connection.rs:558: Connection 9318: HandshakeConf>
```

#### Check `bluerockd` Journal logs

Check `bluerockd` journal logs to confirm that policy files loaded successfully from the target S3 bucket location:

```shellscript
$ journalctl -u bluerockd
```

Expected output:

* Once the configured policies are loaded:

  ```shellscript
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.47823964Z  INFO bluerockd::pcm::downloaders::s3: system/bluerockd/src/pcm/downloaders/s3.rs:227: Creating S3 downloader with default AWS credential chain for region: <REGION>
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.50509293Z  INFO bluerockd::pcm::configmgr: system/bluerockd/src/pcm/configmgr.rs:184: Downloading public key from S3 URL s3://<BUCKET_NAME>/<PUBLIC_KEY_NAME>.pem
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.505149472Z  INFO bluerockd::pcm::downloaders::s3: system/bluerockd/src/pcm/downloaders/s3.rs:242: Downloading object from s3://<BUCKET_NAME>/<PUBLIC_KEY_NAME>.pem
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.622084622Z  INFO bluerockd::pcm::downloaders::s3: system/bluerockd/src/pcm/downloaders/s3.rs:260: Successfully downloaded 800 bytes from s3://<BUCKET_NAME>/<PUBLIC_KEY_NAME>.pem
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.622388861Z  INFO bluerockd::pcm::configmgr: system/bluerockd/src/pcm/configmgr.rs:218: Successfully downloaded and saved public key from S3 to /var/lib/bluerockd/<PUBLIC_KEY_NAME>.pem
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.622761955Z  INFO bluerockd::pcm::configmgr: system/bluerockd/src/pcm/configmgr.rs:422: Resolved public key local path: /var/lib/bluerockd/<PUBLIC_KEY_NAME>.pem (Source: config file S3 URL s3://<BUCKET_NAME>/<PUBLIC_KEY_NAME>.pem)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.622782861Z  INFO bluerockd::pcm: system/bluerockd/src/pcm/mod.rs:808: Using default hostid: <HOST_ID>
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.62280346Z  INFO bluerockd::pcm::cloud: system/bluerockd/src/pcm/cloud/mod.rs:114: Auto-detecting cloud provider environment...
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.6313084Z  INFO bluerockd::pcm::aws::imds: system/bluerockd/src/pcm/aws/imds.rs:52: Testing IMDS (Instance Metadata Service) accessibility...
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.640629106Z  INFO bluerockd::pcm::aws::imds: system/bluerockd/src/pcm/aws/imds.rs:66: IMDS Check: Requesting IMDSv2 token from http://169.254.169.254/latest/api/token...
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.652360689Z  INFO bluerockd::pcm::aws::imds: system/bluerockd/src/pcm/aws/imds.rs:79: IMDS Check: ✓ Successfully acquired IMDSv2 token (56 chars)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.652400198Z  INFO bluerockd::pcm::aws::imds: system/bluerockd/src/pcm/aws/imds.rs:107: IMDS Check: Testing security credentials endpoint...
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.654405361Z  INFO bluerockd::pcm::aws::imds: system/bluerockd/src/pcm/aws/imds.rs:124: IMDS Check: ✓ Found IAM role(s): <IAM_ROLE_NAME>
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.655109389Z  INFO bluerockd::pcm::cloud: system/bluerockd/src/pcm/cloud/mod.rs:134: Detected cloud provider: AWS
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.655136399Z  INFO bluerockd::pcm: system/bluerockd/src/pcm/mod.rs:784: Detected cloud provider: AWS
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.655161213Z  INFO bluerockd::pcm: system/bluerockd/src/pcm/mod.rs:529: Checking for policy in state directory: /var/lib/bluerockd//active-policy.json
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.655184552Z  INFO bluerockd::pcm: system/bluerockd/src/pcm/mod.rs:246: Starting policy validation for: /var/lib/bluerockd//active-policy.json
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.657101271Z  INFO bluerockd::pcm: system/bluerockd/src/pcm/mod.rs:307: Policy hash/version verification passed policy_file=/var/lib/bluerockd//active-policy.json policy_version=<POLICY_VERSION> policy_hash=<POLICY_HASH>
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.657133236Z  INFO bluerockd::pcm: system/bluerockd/src/pcm/mod.rs:319: Excluded cgroups that will be passed as policy addendum: None
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.667703856Z  INFO bluerockd::pcm: system/bluerockd/src/pcm/mod.rs:567: Policy (state directory): /var/lib/bluerockd//active-policy.json
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.668267975Z  INFO bluerockd::pcm: system/bluerockd/src/pcm/mod.rs:604: Management task spawned
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.668294831Z  INFO bluerockd::pcm::tasks: system/bluerockd/src/pcm/tasks.rs:61: Policy context initialization completed.
  ```
* IAM and other credential validation in `bluerockd` logs:

  ```shellscript
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.713101294Z  INFO bluerockd::pcm::aws::imds: system/bluerockd/src/pcm/aws/imds.rs:52: Testing IMDS (Instance Metadata Service) accessibility...
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.721588203Z  INFO bluerockd::pcm::aws::imds: system/bluerockd/src/pcm/aws/imds.rs:66: IMDS Check: Requesting IMDSv2 token from http://169.254.169.254/latest/api/token...
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.723210594Z  INFO bluerockd::pcm::aws::imds: system/bluerockd/src/pcm/aws/imds.rs:79: IMDS Check: ✓ Successfully acquired IMDSv2 token (56 chars)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.723245025Z  INFO bluerockd::pcm::aws::imds: system/bluerockd/src/pcm/aws/imds.rs:107: IMDS Check: Testing security credentials endpoint...
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.724073433Z  INFO bluerockd::pcm::aws::imds: system/bluerockd/src/pcm/aws/imds.rs:124: IMDS Check: ✓ Found IAM role(s): <IAM_ROLE_NAME>
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.724862577Z  INFO bluerockd::pcm::cloud: system/bluerockd/src/pcm/cloud/mod.rs:39: Early IMDS accessibility test passed: IMDS accessible with IAM role: <IAM_ROLE_NAME>
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.724889609Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:17: DEBUG: Checking AWS-related environment variables:
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.724902817Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:43: DEBUG: AWS_ACCESS_KEY_ID = (not set)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.724911666Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:43: DEBUG: AWS_SECRET_ACCESS_KEY = (not set)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.724918381Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:43: DEBUG: AWS_SESSION_TOKEN = (not set)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.72492495Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:43: DEBUG: AWS_PROFILE = (not set)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.724932067Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:43: DEBUG: AWS_REGION = (not set)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.724939111Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:43: DEBUG: AWS_DEFAULT_REGION = (not set)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.724945911Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:43: DEBUG: AWS_EC2_METADATA_DISABLED = (not set)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.724952283Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:43: DEBUG: AWS_EC2_METADATA_SERVICE_ENDPOINT = (not set)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.724959564Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:43: DEBUG: AWS_CONTAINER_CREDENTIALS_RELATIVE_URI = (not set)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.724966144Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:43: DEBUG: AWS_CONTAINER_CREDENTIALS_FULL_URI = (not set)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.724972681Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:43: DEBUG: AWS_WEB_IDENTITY_TOKEN_FILE = (not set)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.724979606Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:43: DEBUG: AWS_ROLE_ARN = (not set)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.72498625Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:43: DEBUG: AWS_ROLE_SESSION_NAME = (not set)
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.72499489Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:49: DEBUG: Loading AWS SDK config with default credential provider chain
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.725002394Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:70: DEBUG: Credential source hints: []
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.728726471Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:76: DEBUG: AWS SDK resolved region: us-east-1
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.728760434Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:92: DEBUG: Attempting STS GetCallerIdentity to verify credentials
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.762396019Z  INFO bluerockd::pcm::aws: system/bluerockd/src/pcm/aws/mod.rs:97: DEBUG: STS GetCallerIdentity succeeded, ARN: arn:aws:sts::<AWS_ACCOUNT_ID>:assumed-role/<IAM_ROLE_NAME>/<INSTANCE_ID>
  Aug 20 07:53:10 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T07:53:10.762795792Z  INFO bluerockd::pcm::cloud: system/bluerockd/src/pcm/cloud/mod.rs:48: Early AWS credentials verified for ARN: arn:aws:sts::<AWS_ACCOUNT_ID>:assumed-role/<IAM_ROLE_NAME>/<INSTANCE_ID>
  ```

### View Logs in AWS CloudWatch

**Check CloudWatch logs:**

1. Navigate to the **CloudWatch Console**

<figure><img src="https://1983702018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCNnVnPvaRpvlLmPT6IAN%2Fuploads%2FIa8Rqo7hFIN1APJ0nthb%2FScreenshot%202026-02-05%20at%206.17.23%E2%80%AFPM.png?alt=media&amp;token=00fdbad6-9b8a-40fd-b748-52780c5ca33e" alt=""><figcaption></figcaption></figure>

2. Go to **Log Groups**

<figure><img src="https://1983702018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCNnVnPvaRpvlLmPT6IAN%2Fuploads%2FOdfFZRM8iAI2qonyF2eh%2FScreenshot%202026-02-05%20at%206.19.28%E2%80%AFPM.png?alt=media&amp;token=78f1dd5c-76b4-48f4-aadc-e18ed2cf1f6d" alt=""><figcaption></figcaption></figure>

3. Find the BlueRock Log Group

<figure><img src="https://1983702018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCNnVnPvaRpvlLmPT6IAN%2Fuploads%2FBGSi0UH8FmGk1F1bf00t%2Fimage.png?alt=media&amp;token=b24baf90-db46-4757-9249-9943793fa71e" alt=""><figcaption></figcaption></figure>

3. **Verify:**

* Log entries are present
* Events originate from the EC2 instance
* Timestamps align with instance startup activity

<figure><img src="https://1983702018-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FCNnVnPvaRpvlLmPT6IAN%2Fuploads%2Fb8J10aMmAtAdodHMMsA2%2Fimage.png?alt=media&amp;token=a5e9297e-c3f6-4f66-95e5-7400da1dc187" alt=""><figcaption></figcaption></figure>

### Troubleshooting

Execute the following diagnostic checks on the local Amazon EC2 instance to resolve failed event processing or missing Amazon CloudWatch telemetry data.

#### Review `bluerockd` Logs

Review the `bluerockd` logs to identify failed OpenTelemetry (OTEL) event publishes:\
Bash

```shellscript
journalctl -u bluerockd
```

Expected error log indicating a failed publish:

```shellscript
Aug 20 08:10:19 ip-<IP_ADDRESS>.ec2.internal bluerockd[<PID>]: 2026-08-20T08:10:19.197004761Z ERROR opentelemetry_sdk: <BUILD_PATH>/opentelemetry_sdk-0.31.0/src/logs/batch_log_processor.rs:537:  name="BatchLogProcessor.ExportError" error="Operation failed: reqwest::Error { kind: Request, url: \"http://<INTERNAL_IP>:4318/v1/logs\", source: hyper_util::client::legacy::Error(Connect, ConnectError(\"tcp connect error\", <INTERNAL_IP>:4318, Os { code: 113, kind: HostUnreachable, message: \"No route to host\" })) }"
```

#### OpenTelemetry Connectivity Verification

If the `bluerockd` logs indicate a connection error to the OpenTelemetry endpoint, verify network reachability to the collector.

Execute the following command from the BlueRock Instance:

```shellscript
curl -v http://<INTERNAL_IP>:4318/v1/logs
```

Review the command output to determine the next action:

* **Connection established:** \
  Investigate the OpenTelemetry collector configuration files to resolve the export failure.
* **Connection failed:** \
  Verify the OpenTelemetry endpoint IP address configuration within the `/etc/bluerock/bluerockd.toml` file.

#### Verify BlueRock Kernel Sensor Service

Verify the operational status of the BlueRock Kernel Sensor service to ensure the activation of the underlying driver:

```shellscript
sudo systemctl status bluerock-kernel-sensor.service
```

Expected Output:

```shellscript
Warning: The unit file, source configuration file or drop-ins of bluerock-kernel-sensor.service changed on disk. Run 'systemctl daemon-reload' to reload units.
● bluerock-kernel-sensor.service - BlueRock Kernel Sensor
     Loaded: loaded (/usr/lib/systemd/system/bluerock-kernel-sensor.service; enabled; preset: enabled)
     Active: active (running) since Fri 2026-08-14 13:16:02 UTC; 4 days ago
       Docs: https://bluerock.io/
   Main PID: <PID> (kernel-sensor)
      Tasks: 7 (limit: 18781)
     Memory: 16.5M (peak: 17.1M)
        CPU: 258ms
     CGroup: /system.slice/bluerock-kernel-sensor.service
             └─<PID> /opt/bluerock/bin/kernel-sensor --socket=/run/bluerock/sensor.sock --directory=/sys/kernel/tracing/brs/ --mode=mmap

Aug 14 13:16:03 ip-<IP_ADDRESS> bluerock-kernel-sensor[<PID>]: 2026-08-14T13:16:03.364657821Z  INFO ThreadId(03) kernel_sensor: sensors/kernel-sensor/src/main.rs:761: Starting Thread[1]
Aug 14 13:16:03 ip-<IP_ADDRESS> bluerock-kernel-sensor[<PID>]: 2026-08-14T13:16:03.365904675Z  INFO ThreadId(03) kernel_sensor: sensors/kernel-sensor/src/main.rs:646: Thread1: events "/sys/>
Aug 14 13:16:03 ip-<IP_ADDRESS> bluerock-kernel-sensor[<PID>]: 2026-08-14T13:16:03.365962517Z  INFO ThreadId(03) kernel_sensor: sensors/kernel-sensor/src/main.rs:647: Thread1: response "/sy>
```

#### Verify BlueRock Kernel Sensor Logs

Review the BlueRock Kernel Sensor logs:

```shellscript
journalctl -u bluerock-kernel-sensor
```

Expected output:

```shellscript
Aug 13 10:28:19 ip-<IP_ADDRESS> systemd[1]: Starting bluerock-kernel-sensor.service - BlueRock Kernel Sensor...
Aug 13 10:28:20 ip-<IP_ADDRESS> systemd[1]: Started bluerock-kernel-sensor.service - BlueRock Kernel Sensor.
Aug 13 10:28:21 ip-<IP_ADDRESS> bluerock-kernel-sensor[<PID>]: 2026-08-13T10:28:21.671836262Z  INFO main acoustic::connector: libraries/acoustic/src/connector.rs:33: Using socket path: "/run/>
Aug 13 10:28:37 ip-<IP_ADDRESS> bluerock-kernel-sensor[<PID>]: 2026-08-13T10:28:37.496144373Z  INFO ThreadId(02) kernel_sensor: sensors/kernel-sensor/src/main.rs:761: Starting Thread[0]
Aug 13 10:28:37 ip-<IP_ADDRESS> bluerock-kernel-sensor[<PID>]: 2026-08-13T10:28:37.496873782Z  INFO ThreadId(02) kernel_sensor: sensors/kernel-sensor/src/main.rs:646: Thread0: events "/sys/ke>
```

#### Runtime Artifacts (BlueRock Sensor Socket)

Confirm the presence of the communication BlueRock Sensor Socket file in the runtime directory:

```shellscript
ls -l /run/bluerock/sensor.sock
```

Expected output:

```shellscript
srwxrwxrwx 1 root root 0 Aug 13 10:28 /run/bluerock/sensor.sock
```

#### Local OTEL Event Logs

List the log directory contents to confirm the generation of local OTEL event and metric logs:

```shellscript
sudo ls -l /var/log/bluerockd/
```

Expected output:

```shellscript
total 26660
-rw-r--r-- 1 root root 5325821 Jul 23 05:12 otel-events-otel-logs.log
-rw-r--r-- 1 root root 11112231 Jul 23 04:28 otel-events-otel-logs.log.20260623T042835
-rw-r--r-- 1 root root 5105497 Jul 23 05:00 otel-events-otel-logs.log.20260623T050028
-rw-r--r-- 1 root root 133534 Jul 23 05:12 otel-events-otel-metrics.log
```

#### OpenTelemetry Collector Logs

Verify the `otelcol` journal logs to confirm collector initialization and the active exportation of log events to Amazon CloudWatch Logs:

```shellscript
journalctl -u otelcol
```

Expected output:Plaintext

```shellscript
Aug 20 05:55:24 ip-<IP_ADDRESS>.ec2.internal run-otelcol.sh[<PID>]: 2026-08-20T05:55:24.216Z        debug        cwlogs@v0.130.0/pusher.go:271        logpusher: publish log events successfully.        {"resource": {"service.instance.id": "<SERVICE_INSTANCE_ID>", "service.name": "aws-otel-collector", "service.version": "v0.44.0"}, "otelcol.component.id": "awscloudwatchlogs", "otelcol.component.kind": "exporter", "otelcol.signal": "logs", "NumOfLogEvents": 16, "LogEventsSize": 16.70703125, "Time": 16}
Aug 20 05:55:25 ip-<IP_ADDRESS>.ec2.internal run-otelcol.sh[<PID>]: 2026-08-20T05:55:25.219Z        debug        cwlogs@v0.130.0/pusher.go:271        logpusher: publish log events successfully.        {"resource": {"service.instance.id": "<SERVICE_INSTANCE_ID>", "service.name": "aws-otel-collector", "service.version": "v0.44.0"}, "otelcol.component.id": "awscloudwatchlogs", "otelcol.component.kind": "exporter", "otelcol.signal": "logs", "NumOfLogEvents": 2, "LogEventsSize": 2.099609375, "Time": 19}
Aug 20 05:55:26 ip-<IP_ADDRESS>.ec2.internal run-otelcol.sh[<PID>]: 2026-08-20T05:55:26.215Z        debug        cwlogs@v0.130.0/pusher.go:271        logpusher: publish log events successfully.        {"resource": {"service.instance.id": "<SERVICE_INSTANCE_ID>", "service.name": "aws-otel-collector", "service.version": "v0.44.0"}, "otelcol.component.id": "awscloudwatchlogs", "otelcol.component.kind": "exporter", "otelcol.signal": "logs", "NumOfLogEvents": 2, "LogEventsSize": 1.9677734375, "Time": 13}
```


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.bluerock.io/deployment-guides/aws-deployments/aws-deployment-with-cli.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.