This is an automated email from the ASF dual-hosted git repository.

singhpk234 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/polaris.git


The following commit(s) were added to refs/heads/main by this push:
     new 20753edd4 AWS CloudWatch Event Sink Implementation (#1965)
20753edd4 is described below

commit 20753edd47c5b44b412fd394bc76bacfbfa777bd
Author: Adnan Hemani <[email protected]>
AuthorDate: Wed Sep 3 11:37:42 2025 -0700

    AWS CloudWatch Event Sink Implementation (#1965)
---
 gradle/libs.versions.toml                          |   1 +
 runtime/service/build.gradle.kts                   |   4 +
 .../PropertyMapEventListener.java                  |  43 +++
 .../aws/cloudwatch/AwsCloudWatchConfiguration.java |  31 ++
 .../aws/cloudwatch/AwsCloudWatchEventListener.java | 190 +++++++++++
 .../QuarkusAwsCloudWatchConfiguration.java         |  99 ++++++
 .../cloudwatch/AwsCloudWatchEventListenerTest.java | 346 +++++++++++++++++++++
 .../aws/cloudwatch/Dockerfile-localstack-version   |  22 ++
 site/content/in-dev/unreleased/configuration.md    |  85 ++---
 9 files changed, 781 insertions(+), 40 deletions(-)

diff --git a/gradle/libs.versions.toml b/gradle/libs.versions.toml
index 7becf77c6..25b84aa5c 100644
--- a/gradle/libs.versions.toml
+++ b/gradle/libs.versions.toml
@@ -76,6 +76,7 @@ jakarta-ws-rs-api = { module = 
"jakarta.ws.rs:jakarta.ws.rs-api", version = "4.0
 jandex = { module = "io.smallrye.jandex:jandex", version ="3.4.0" }
 javax-servlet-api = { module = "javax.servlet:javax.servlet-api", version = 
"4.0.1" }
 junit-bom = { module = "org.junit:junit-bom", version = "5.13.4" }
+localstack = { module = "org.testcontainers:localstack", version = "1.19.7" }
 keycloak-admin-client = { module = "org.keycloak:keycloak-admin-client", 
version = "26.0.6" }
 jcstress-core = { module = "org.openjdk.jcstress:jcstress-core", version = 
"0.16" }
 jmh-core = { module = "org.openjdk.jmh:jmh-core", version.ref = "jmh" }
diff --git a/runtime/service/build.gradle.kts b/runtime/service/build.gradle.kts
index 5f01f93df..b7c599dd4 100644
--- a/runtime/service/build.gradle.kts
+++ b/runtime/service/build.gradle.kts
@@ -87,6 +87,7 @@ dependencies {
   implementation("software.amazon.awssdk:sts")
   implementation("software.amazon.awssdk:iam-policy-builder")
   implementation("software.amazon.awssdk:s3")
+  implementation("software.amazon.awssdk:cloudwatchlogs")
   implementation("software.amazon.awssdk:apache-client") {
     exclude("commons-logging", "commons-logging")
   }
@@ -128,6 +129,9 @@ dependencies {
   testImplementation("io.quarkus:quarkus-rest-client")
   testImplementation("io.quarkus:quarkus-rest-client-jackson")
   testImplementation("io.rest-assured:rest-assured")
+  testImplementation(libs.localstack)
+  testImplementation("org.testcontainers:testcontainers")
+  testImplementation(project(":polaris-container-spec-helper"))
 
   testImplementation(libs.threeten.extra)
   testImplementation(libs.hawkular.agent.prometheus.scraper)
diff --git 
a/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/PropertyMapEventListener.java
 
b/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/PropertyMapEventListener.java
new file mode 100644
index 000000000..28db713db
--- /dev/null
+++ 
b/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/PropertyMapEventListener.java
@@ -0,0 +1,43 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.polaris.service.events.jsonEventListener;
+
+import java.util.HashMap;
+import org.apache.polaris.service.events.AfterTableRefreshedEvent;
+import org.apache.polaris.service.events.PolarisEventListener;
+
+/**
+ * This class provides a common framework for transforming Polaris events into 
a HashMap, which can
+ * be used to transform the event further, such as transforming into a JSON 
string, and send them to
+ * various destinations. Concrete implementations should override the
+ * {{@code @link#transformAndSendEvent(HashMap)}} method to define how the 
event data should be
+ * transformed into a JSON string, transmitted, and/or stored.
+ */
+public abstract class PropertyMapEventListener extends PolarisEventListener {
+  protected abstract void transformAndSendEvent(HashMap<String, Object> 
properties);
+
+  @Override
+  public void onAfterTableRefreshed(AfterTableRefreshedEvent event) {
+    HashMap<String, Object> properties = new HashMap<>();
+    properties.put("event_type", event.getClass().getSimpleName());
+    properties.put("table_identifier", event.tableIdentifier().toString());
+    transformAndSendEvent(properties);
+  }
+}
diff --git 
a/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchConfiguration.java
 
b/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchConfiguration.java
new file mode 100644
index 000000000..46e07f569
--- /dev/null
+++ 
b/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchConfiguration.java
@@ -0,0 +1,31 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.polaris.service.events.jsonEventListener.aws.cloudwatch;
+
+/** Configuration interface for AWS CloudWatch event listener settings. */
+public interface AwsCloudWatchConfiguration {
+  String awsCloudWatchLogGroup();
+
+  String awsCloudWatchLogStream();
+
+  String awsCloudWatchRegion();
+
+  boolean synchronousMode();
+}
diff --git 
a/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchEventListener.java
 
b/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchEventListener.java
new file mode 100644
index 000000000..87cf70a2f
--- /dev/null
+++ 
b/runtime/service/src/main/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchEventListener.java
@@ -0,0 +1,190 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.polaris.service.events.jsonEventListener.aws.cloudwatch;
+
+import com.fasterxml.jackson.core.JsonProcessingException;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import io.smallrye.common.annotation.Identifier;
+import jakarta.annotation.PostConstruct;
+import jakarta.annotation.PreDestroy;
+import jakarta.enterprise.context.ApplicationScoped;
+import jakarta.inject.Inject;
+import jakarta.ws.rs.core.Context;
+import jakarta.ws.rs.core.SecurityContext;
+import java.time.Clock;
+import java.util.HashMap;
+import java.util.List;
+import java.util.concurrent.CompletableFuture;
+import java.util.function.Supplier;
+import org.apache.polaris.core.auth.PolarisPrincipal;
+import org.apache.polaris.core.context.CallContext;
+import org.apache.polaris.service.config.PolarisIcebergObjectMapperCustomizer;
+import 
org.apache.polaris.service.events.jsonEventListener.PropertyMapEventListener;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import software.amazon.awssdk.regions.Region;
+import 
software.amazon.awssdk.services.cloudwatchlogs.CloudWatchLogsAsyncClient;
+import 
software.amazon.awssdk.services.cloudwatchlogs.model.CreateLogGroupRequest;
+import 
software.amazon.awssdk.services.cloudwatchlogs.model.CreateLogStreamRequest;
+import 
software.amazon.awssdk.services.cloudwatchlogs.model.DescribeLogGroupsRequest;
+import 
software.amazon.awssdk.services.cloudwatchlogs.model.DescribeLogStreamsRequest;
+import software.amazon.awssdk.services.cloudwatchlogs.model.InputLogEvent;
+import 
software.amazon.awssdk.services.cloudwatchlogs.model.PutLogEventsRequest;
+import 
software.amazon.awssdk.services.cloudwatchlogs.model.PutLogEventsResponse;
+
+@ApplicationScoped
+@Identifier("aws-cloudwatch")
+public class AwsCloudWatchEventListener extends PropertyMapEventListener {
+  private static final Logger LOGGER = 
LoggerFactory.getLogger(AwsCloudWatchEventListener.class);
+  final ObjectMapper objectMapper = new ObjectMapper();
+
+  private CloudWatchLogsAsyncClient client;
+
+  private final String logGroup;
+  private final String logStream;
+  private final Region region;
+  private final boolean synchronousMode;
+  private final Clock clock;
+
+  @Inject CallContext callContext;
+
+  @Context SecurityContext securityContext;
+
+  @Inject
+  public AwsCloudWatchEventListener(
+      AwsCloudWatchConfiguration config,
+      Clock clock,
+      PolarisIcebergObjectMapperCustomizer customizer) {
+    this.logStream = config.awsCloudWatchLogStream();
+    this.logGroup = config.awsCloudWatchLogGroup();
+    this.region = Region.of(config.awsCloudWatchRegion());
+    this.synchronousMode = config.synchronousMode();
+    this.clock = clock;
+    customizer.customize(this.objectMapper);
+  }
+
+  @PostConstruct
+  void start() {
+    this.client = createCloudWatchAsyncClient();
+    ensureLogGroupAndStream();
+  }
+
+  protected CloudWatchLogsAsyncClient createCloudWatchAsyncClient() {
+    return CloudWatchLogsAsyncClient.builder().region(region).build();
+  }
+
+  private void ensureLogGroupAndStream() {
+    ensureResourceExists(
+        () ->
+            client
+                .describeLogGroups(
+                    
DescribeLogGroupsRequest.builder().logGroupNamePrefix(logGroup).build())
+                .join()
+                .logGroups()
+                .stream()
+                .anyMatch(g -> g.logGroupName().equals(logGroup)),
+        () ->
+            client
+                
.createLogGroup(CreateLogGroupRequest.builder().logGroupName(logGroup).build())
+                .join(),
+        "group",
+        logGroup);
+    ensureResourceExists(
+        () ->
+            client
+                .describeLogStreams(
+                    DescribeLogStreamsRequest.builder()
+                        .logGroupName(logGroup)
+                        .logStreamNamePrefix(logStream)
+                        .build())
+                .join()
+                .logStreams()
+                .stream()
+                .anyMatch(s -> s.logStreamName().equals(logStream)),
+        () ->
+            client
+                .createLogStream(
+                    CreateLogStreamRequest.builder()
+                        .logGroupName(logGroup)
+                        .logStreamName(logStream)
+                        .build())
+                .join(),
+        "stream",
+        logStream);
+  }
+
+  private static void ensureResourceExists(
+      Supplier<Boolean> existsCheck,
+      Runnable createAction,
+      String resourceType,
+      String resourceName) {
+    if (existsCheck.get()) {
+      LOGGER.debug("Log {} [{}] already exists", resourceType, resourceName);
+    } else {
+      LOGGER.debug("Attempting to create log {}: {}", resourceType, 
resourceName);
+      createAction.run();
+    }
+  }
+
+  @PreDestroy
+  void shutdown() {
+    if (client != null) {
+      client.close();
+      client = null;
+    }
+  }
+
+  @Override
+  protected void transformAndSendEvent(HashMap<String, Object> properties) {
+    properties.put("realm_id", 
callContext.getRealmContext().getRealmIdentifier());
+    properties.put("principal", securityContext.getUserPrincipal().getName());
+    properties.put(
+        "activated_roles", ((PolarisPrincipal) 
securityContext.getUserPrincipal()).getRoles());
+    // TODO: Add request ID when it is available
+    String eventAsJson;
+    try {
+      eventAsJson = objectMapper.writeValueAsString(properties);
+    } catch (JsonProcessingException e) {
+      LOGGER.error("Error processing event into JSON string: ", e);
+      LOGGER.debug("Failed to convert the following object into JSON string: 
{}", properties);
+      return;
+    }
+    InputLogEvent inputLogEvent =
+        
InputLogEvent.builder().message(eventAsJson).timestamp(clock.millis()).build();
+    PutLogEventsRequest.Builder requestBuilder =
+        PutLogEventsRequest.builder()
+            .logGroupName(logGroup)
+            .logStreamName(logStream)
+            .logEvents(List.of(inputLogEvent));
+    CompletableFuture<PutLogEventsResponse> future =
+        client
+            .putLogEvents(requestBuilder.build())
+            .whenComplete(
+                (resp, err) -> {
+                  if (err != null) {
+                    LOGGER.error(
+                        "Error writing log to CloudWatch. Event: {}, Error: ", 
inputLogEvent, err);
+                  }
+                });
+    if (synchronousMode) {
+      future.join();
+    }
+  }
+}
diff --git 
a/runtime/service/src/main/java/org/apache/polaris/service/quarkus/events/jsonEventListener/aws/cloudwatch/QuarkusAwsCloudWatchConfiguration.java
 
b/runtime/service/src/main/java/org/apache/polaris/service/quarkus/events/jsonEventListener/aws/cloudwatch/QuarkusAwsCloudWatchConfiguration.java
new file mode 100644
index 000000000..91c32ce06
--- /dev/null
+++ 
b/runtime/service/src/main/java/org/apache/polaris/service/quarkus/events/jsonEventListener/aws/cloudwatch/QuarkusAwsCloudWatchConfiguration.java
@@ -0,0 +1,99 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+package 
org.apache.polaris.service.quarkus.events.jsonEventListener.aws.cloudwatch;
+
+import io.quarkus.runtime.annotations.StaticInitSafe;
+import io.smallrye.config.ConfigMapping;
+import io.smallrye.config.WithDefault;
+import io.smallrye.config.WithName;
+import jakarta.enterprise.context.ApplicationScoped;
+import 
org.apache.polaris.service.events.jsonEventListener.aws.cloudwatch.AwsCloudWatchConfiguration;
+
+/**
+ * Quarkus-specific configuration interface for AWS CloudWatch event listener 
integration.
+ *
+ * <p>This interface extends the base {@link AwsCloudWatchConfiguration} and 
provides
+ * Quarkus-specific configuration mappings for AWS CloudWatch logging 
functionality.
+ */
+@StaticInitSafe
+@ConfigMapping(prefix = "polaris.event-listener.aws-cloudwatch")
+@ApplicationScoped
+public interface QuarkusAwsCloudWatchConfiguration extends 
AwsCloudWatchConfiguration {
+
+  /**
+   * Returns the AWS CloudWatch log group name for event logging.
+   *
+   * <p>The log group is a collection of log streams that share the same 
retention, monitoring, and
+   * access control settings. If not specified, defaults to 
"polaris-cloudwatch-default-group".
+   *
+   * <p>Configuration property: {@code 
polaris.event-listener.aws-cloudwatch.log-group}
+   *
+   * @return a String containing the log group name, or the default value if 
not configured
+   */
+  @WithName("log-group")
+  @WithDefault("polaris-cloudwatch-default-group")
+  @Override
+  String awsCloudWatchLogGroup();
+
+  /**
+   * Returns the AWS CloudWatch log stream name for event logging.
+   *
+   * <p>A log stream is a sequence of log events that share the same source. 
Each log stream belongs
+   * to one log group. If not specified, defaults to 
"polaris-cloudwatch-default-stream".
+   *
+   * <p>Configuration property: {@code 
polaris.event-listener.aws-cloudwatch.log-stream}
+   *
+   * @return a String containing the log stream name, or the default value if 
not configured
+   */
+  @WithName("log-stream")
+  @WithDefault("polaris-cloudwatch-default-stream")
+  @Override
+  String awsCloudWatchLogStream();
+
+  /**
+   * Returns the AWS region where CloudWatch logs should be sent.
+   *
+   * <p>This specifies the AWS region for the CloudWatch service endpoint. The 
region must be a
+   * valid AWS region identifier. If not specified, defaults to "us-east-1".
+   *
+   * <p>Configuration property: {@code 
polaris.event-listener.aws-cloudwatch.region}
+   *
+   * @return a String containing the AWS region, or the default value if not 
configured
+   */
+  @WithName("region")
+  @WithDefault("us-east-1")
+  @Override
+  String awsCloudWatchRegion();
+
+  /**
+   * Returns the synchronous mode setting for CloudWatch logging.
+   *
+   * <p>When set to "true", log events are sent to CloudWatch synchronously, 
which may impact
+   * application performance but ensures immediate delivery. When set to 
"false" (default), log
+   * events are sent asynchronously for better performance.
+   *
+   * <p>Configuration property: {@code 
polaris.event-listener.aws-cloudwatch.synchronous-mode}
+   *
+   * @return a boolean value indicating the synchronous mode setting
+   */
+  @WithName("synchronous-mode")
+  @WithDefault("false")
+  @Override
+  boolean synchronousMode();
+}
diff --git 
a/runtime/service/src/test/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchEventListenerTest.java
 
b/runtime/service/src/test/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchEventListenerTest.java
new file mode 100644
index 000000000..e7225e156
--- /dev/null
+++ 
b/runtime/service/src/test/java/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/AwsCloudWatchEventListenerTest.java
@@ -0,0 +1,346 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one
+ * or more contributor license agreements.  See the NOTICE file
+ * distributed with this work for additional information
+ * regarding copyright ownership.  The ASF licenses this file
+ * to you under the Apache License, Version 2.0 (the
+ * "License"); you may not use this file except in compliance
+ * with the License.  You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing,
+ * software distributed under the License is distributed on an
+ * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+ * KIND, either express or implied.  See the License for the
+ * specific language governing permissions and limitations
+ * under the License.
+ */
+
+package org.apache.polaris.service.events.jsonEventListener.aws.cloudwatch;
+
+import static 
org.apache.polaris.containerspec.ContainerSpecHelper.containerSpecHelper;
+import static org.assertj.core.api.Assertions.assertThat;
+import static org.mockito.Mockito.when;
+
+import com.fasterxml.jackson.databind.PropertyNamingStrategies;
+import io.quarkus.runtime.configuration.MemorySize;
+import jakarta.ws.rs.core.SecurityContext;
+import java.math.BigInteger;
+import java.security.Principal;
+import java.time.Clock;
+import java.time.Duration;
+import java.util.Set;
+import java.util.concurrent.ExecutorService;
+import java.util.concurrent.Executors;
+import java.util.concurrent.TimeUnit;
+import org.apache.iceberg.catalog.TableIdentifier;
+import org.apache.polaris.core.PolarisCallContext;
+import org.apache.polaris.core.auth.PolarisPrincipal;
+import org.apache.polaris.core.context.CallContext;
+import org.apache.polaris.core.context.RealmContext;
+import org.apache.polaris.service.config.PolarisIcebergObjectMapperCustomizer;
+import org.apache.polaris.service.events.AfterTableRefreshedEvent;
+import org.awaitility.Awaitility;
+import org.junit.jupiter.api.AfterEach;
+import org.junit.jupiter.api.BeforeEach;
+import org.junit.jupiter.api.Test;
+import org.mockito.Mock;
+import org.mockito.Mockito;
+import org.mockito.MockitoAnnotations;
+import org.slf4j.Logger;
+import org.slf4j.LoggerFactory;
+import org.testcontainers.containers.localstack.LocalStackContainer;
+import software.amazon.awssdk.auth.credentials.AwsBasicCredentials;
+import software.amazon.awssdk.auth.credentials.StaticCredentialsProvider;
+import software.amazon.awssdk.regions.Region;
+import 
software.amazon.awssdk.services.cloudwatchlogs.CloudWatchLogsAsyncClient;
+import 
software.amazon.awssdk.services.cloudwatchlogs.model.CreateLogGroupRequest;
+import 
software.amazon.awssdk.services.cloudwatchlogs.model.CreateLogStreamRequest;
+import 
software.amazon.awssdk.services.cloudwatchlogs.model.DescribeLogGroupsRequest;
+import 
software.amazon.awssdk.services.cloudwatchlogs.model.DescribeLogGroupsResponse;
+import 
software.amazon.awssdk.services.cloudwatchlogs.model.DescribeLogStreamsRequest;
+import 
software.amazon.awssdk.services.cloudwatchlogs.model.DescribeLogStreamsResponse;
+import 
software.amazon.awssdk.services.cloudwatchlogs.model.GetLogEventsRequest;
+import 
software.amazon.awssdk.services.cloudwatchlogs.model.GetLogEventsResponse;
+
+class AwsCloudWatchEventListenerTest {
+  private static final Logger LOGGER =
+      LoggerFactory.getLogger(AwsCloudWatchEventListenerTest.class);
+
+  private static final LocalStackContainer localStack =
+      new LocalStackContainer(
+              containerSpecHelper("localstack", 
AwsCloudWatchEventListenerTest.class)
+                  .dockerImageName(null))
+          .withServices(LocalStackContainer.Service.CLOUDWATCHLOGS);
+
+  private static final String LOG_GROUP = "test-log-group";
+  private static final String LOG_STREAM = "test-log-stream";
+  private static final String REALM = "test-realm";
+  private static final String TEST_USER = "test-user";
+  private static final Clock clock = Clock.systemUTC();
+  private static final BigInteger MAX_BODY_SIZE = BigInteger.valueOf(1024 * 
1024);
+  private static final PolarisIcebergObjectMapperCustomizer customizer =
+      new PolarisIcebergObjectMapperCustomizer(new MemorySize(MAX_BODY_SIZE));
+
+  @Mock private AwsCloudWatchConfiguration config;
+
+  private ExecutorService executorService;
+  private AutoCloseable mockitoContext;
+
+  @BeforeEach
+  void setUp() {
+    mockitoContext = MockitoAnnotations.openMocks(this);
+    executorService = Executors.newSingleThreadExecutor();
+
+    // Configure the mocks
+    when(config.awsCloudWatchLogGroup()).thenReturn(LOG_GROUP);
+    when(config.awsCloudWatchLogStream()).thenReturn(LOG_STREAM);
+    when(config.awsCloudWatchRegion()).thenReturn("us-east-1");
+    when(config.synchronousMode()).thenReturn(false); // Default to async mode
+  }
+
+  @AfterEach
+  void tearDown() throws Exception {
+    if (mockitoContext != null) {
+      mockitoContext.close();
+    }
+    if (executorService != null) {
+      executorService.shutdownNow();
+      if (!executorService.awaitTermination(5, TimeUnit.SECONDS)) {
+        LOGGER.warn("ExecutorService did not terminate in time");
+      }
+    }
+    if (localStack.isRunning()) {
+      localStack.stop();
+    }
+  }
+
+  private CloudWatchLogsAsyncClient createCloudWatchAsyncClient() {
+    if (!localStack.isRunning()) {
+      localStack.start();
+    }
+    return CloudWatchLogsAsyncClient.builder()
+        .endpointOverride(localStack.getEndpoint())
+        .credentialsProvider(
+            StaticCredentialsProvider.create(
+                AwsBasicCredentials.create(localStack.getAccessKey(), 
localStack.getSecretKey())))
+        .region(Region.of(localStack.getRegion()))
+        .build();
+  }
+
+  private AwsCloudWatchEventListener createListener(CloudWatchLogsAsyncClient 
client) {
+    AwsCloudWatchEventListener listener =
+        new AwsCloudWatchEventListener(config, clock, customizer) {
+          @Override
+          protected CloudWatchLogsAsyncClient createCloudWatchAsyncClient() {
+            return client;
+          }
+        };
+
+    // Set up call context and security context
+    CallContext callContext = Mockito.mock(CallContext.class);
+    PolarisCallContext polarisCallContext = 
Mockito.mock(PolarisCallContext.class);
+    RealmContext realmContext = Mockito.mock(RealmContext.class);
+    SecurityContext securityContext = Mockito.mock(SecurityContext.class);
+    Principal principal = Mockito.mock(PolarisPrincipal.class);
+    when(callContext.getRealmContext()).thenReturn(realmContext);
+    when(callContext.getPolarisCallContext()).thenReturn(polarisCallContext);
+    when(realmContext.getRealmIdentifier()).thenReturn(REALM);
+    when(securityContext.getUserPrincipal()).thenReturn(principal);
+    when(principal.getName()).thenReturn(TEST_USER);
+    when(((PolarisPrincipal) principal).getRoles()).thenReturn(Set.of("role1", 
"role2"));
+    listener.callContext = callContext;
+    listener.securityContext = securityContext;
+
+    return listener;
+  }
+
+  @Test
+  void shouldCreateLogGroupAndStream() {
+    CloudWatchLogsAsyncClient client = createCloudWatchAsyncClient();
+    AwsCloudWatchEventListener listener = createListener(client);
+
+    // Start the listener which should create the log group and stream
+    listener.start();
+
+    try {
+      verifyLogGroupAndStreamExist(client);
+    } finally {
+      client.close();
+      listener.shutdown();
+    }
+  }
+
+  @Test
+  void shouldAcceptPreviouslyCreatedLogGroupAndStream() {
+    CloudWatchLogsAsyncClient client = createCloudWatchAsyncClient();
+    
client.createLogGroup(CreateLogGroupRequest.builder().logGroupName(LOG_GROUP).build()).join();
+    client
+        .createLogStream(
+            CreateLogStreamRequest.builder()
+                .logGroupName(LOG_GROUP)
+                .logStreamName(LOG_STREAM)
+                .build())
+        .join();
+    verifyLogGroupAndStreamExist(client);
+
+    AwsCloudWatchEventListener listener = createListener(client);
+    listener.start();
+    try {
+      verifyLogGroupAndStreamExist(client);
+    } finally {
+      client.close();
+      listener.shutdown();
+    }
+  }
+
+  @Test
+  void shouldSendEventToCloudWatch() {
+    CloudWatchLogsAsyncClient client = createCloudWatchAsyncClient();
+    AwsCloudWatchEventListener listener = createListener(client);
+    listener.start();
+    try {
+      // Create and send a test event
+      TableIdentifier testTable = TableIdentifier.of("test_namespace", 
"test_table");
+      AfterTableRefreshedEvent event = new AfterTableRefreshedEvent(testTable);
+      listener.onAfterTableRefreshed(event);
+
+      Awaitility.await("expected amount of records should be sent to 
CloudWatch")
+          .atMost(Duration.ofSeconds(30))
+          .pollDelay(Duration.ofMillis(100))
+          .pollInterval(Duration.ofMillis(100))
+          .untilAsserted(
+              () -> {
+                GetLogEventsResponse resp =
+                    client
+                        .getLogEvents(
+                            GetLogEventsRequest.builder()
+                                .logGroupName(LOG_GROUP)
+                                .logStreamName(LOG_STREAM)
+                                .build())
+                        .join();
+                assertThat(resp.events().size()).isGreaterThan(0);
+              });
+      GetLogEventsResponse logEvents =
+          client
+              .getLogEvents(
+                  GetLogEventsRequest.builder()
+                      .logGroupName(LOG_GROUP)
+                      .logStreamName(LOG_STREAM)
+                      .build())
+              .join();
+
+      assertThat(logEvents.events())
+          .hasSize(1)
+          .first()
+          .satisfies(
+              logEvent -> {
+                String message = logEvent.message();
+                assertThat(message).contains(REALM);
+                
assertThat(message).contains(AfterTableRefreshedEvent.class.getSimpleName());
+                assertThat(message).contains(TEST_USER);
+                assertThat(message).contains(testTable.toString());
+              });
+    } finally {
+      // Clean up
+      listener.shutdown();
+      client.close();
+    }
+  }
+
+  @Test
+  void shouldSendEventInSynchronousMode() {
+    CloudWatchLogsAsyncClient client = createCloudWatchAsyncClient();
+
+    // Test synchronous mode
+    when(config.synchronousMode()).thenReturn(true);
+    AwsCloudWatchEventListener syncListener = createListener(client);
+    syncListener.start();
+    try {
+      // Create and send a test event synchronously
+      TableIdentifier syncTestTable = TableIdentifier.of("test_namespace", 
"test_table_sync");
+      AfterTableRefreshedEvent syncEvent = new 
AfterTableRefreshedEvent(syncTestTable);
+      syncListener.onAfterTableRefreshed(syncEvent);
+
+      Awaitility.await("expected amount of records should be sent to 
CloudWatch")
+          .atMost(Duration.ofSeconds(30))
+          .pollDelay(Duration.ofMillis(100))
+          .pollInterval(Duration.ofMillis(100))
+          .untilAsserted(
+              () -> {
+                GetLogEventsResponse resp =
+                    client
+                        .getLogEvents(
+                            GetLogEventsRequest.builder()
+                                .logGroupName(LOG_GROUP)
+                                .logStreamName(LOG_STREAM)
+                                .build())
+                        .join();
+                assertThat(resp.events().size()).isGreaterThan(0);
+              });
+
+      GetLogEventsResponse logEvents =
+          client
+              .getLogEvents(
+                  GetLogEventsRequest.builder()
+                      .logGroupName(LOG_GROUP)
+                      .logStreamName(LOG_STREAM)
+                      .build())
+              .join();
+
+      assertThat(logEvents.events()).hasSize(1);
+
+      // Verify sync event
+      assertThat(logEvents.events())
+          .anySatisfy(
+              logEvent -> {
+                String message = logEvent.message();
+                assertThat(message).contains("test_table_sync");
+                assertThat(message).contains("AfterTableRefreshedEvent");
+              });
+    } finally {
+      // Clean up
+      syncListener.shutdown();
+      client.close();
+    }
+  }
+
+  @Test
+  void ensureObjectMapperCustomizerIsApplied() {
+    AwsCloudWatchEventListener listener = 
createListener(createCloudWatchAsyncClient());
+    listener.start();
+
+    assertThat(listener.objectMapper.getPropertyNamingStrategy())
+        .isInstanceOf(PropertyNamingStrategies.KebabCaseStrategy.class);
+    
assertThat(listener.objectMapper.getFactory().streamReadConstraints().getMaxDocumentLength())
+        .isEqualTo(MAX_BODY_SIZE.longValue());
+  }
+
+  private void verifyLogGroupAndStreamExist(CloudWatchLogsAsyncClient client) {
+    // Verify log group exists
+    DescribeLogGroupsResponse groups =
+        client
+            .describeLogGroups(
+                
DescribeLogGroupsRequest.builder().logGroupNamePrefix(LOG_GROUP).build())
+            .join();
+    assertThat(groups.logGroups())
+        .hasSize(1)
+        .first()
+        .satisfies(group -> 
assertThat(group.logGroupName()).isEqualTo(LOG_GROUP));
+
+    // Verify log stream exists
+    DescribeLogStreamsResponse streams =
+        client
+            .describeLogStreams(
+                DescribeLogStreamsRequest.builder()
+                    .logGroupName(LOG_GROUP)
+                    .logStreamNamePrefix(LOG_STREAM)
+                    .build())
+            .join();
+    assertThat(streams.logStreams())
+        .hasSize(1)
+        .first()
+        .satisfies(stream -> 
assertThat(stream.logStreamName()).isEqualTo(LOG_STREAM));
+  }
+}
diff --git 
a/runtime/service/src/test/resources/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/Dockerfile-localstack-version
 
b/runtime/service/src/test/resources/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/Dockerfile-localstack-version
new file mode 100644
index 000000000..fd6552451
--- /dev/null
+++ 
b/runtime/service/src/test/resources/org/apache/polaris/service/events/jsonEventListener/aws/cloudwatch/Dockerfile-localstack-version
@@ -0,0 +1,22 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements.  See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership.  The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License.  You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied.  See the License for the
+# specific language governing permissions and limitations
+# under the License.
+#
+
+# Dockerfile to provide the image name and tag to a test.
+# Version is managed by Renovate - do not edit.
+FROM localstack/localstack:3.4
diff --git a/site/content/in-dev/unreleased/configuration.md 
b/site/content/in-dev/unreleased/configuration.md
index fec8940d6..103b8c948 100644
--- a/site/content/in-dev/unreleased/configuration.md
+++ b/site/content/in-dev/unreleased/configuration.md
@@ -78,46 +78,51 @@ read-only mode, as Polaris only reads the configuration 
file once, at startup.
 
 ## Polaris Configuration Options Reference
 
-| Configuration Property                                                       
          | Default Value         | Description                                 
                                                                                
                                                                                
                                                                                
                                                                  |
-|----------------------------------------------------------------------------------------|-----------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
-| `polaris.persistence.type`                                                   
          | `relational-jdbc`     | Define the persistence backend used by 
Polaris (`in-memory`, `relational-jdbc`, `eclipse-link` (deprecated)). See 
[Configuring Apache Polaris for Production)[{{% ref 
"configuring-polaris-for-production.md" %}})                                    
                                                                                
                        |
-| `polaris.persistence.relational.jdbc.max-retries`                            
          | `1`                   | Total number of retries JDBC persistence 
will attempt on connection resets or serialization failures before giving up.   
                                                                                
                                                                                
                                                                     |
-| `polaris.persistence.relational.jdbc.max_duaration_in_ms`                    
          | `5000 ms`             | Max time interval (ms) since the start of a 
transaction when retries can be attempted.                                      
                                                                                
                                                                                
                                                                  |
-| `polaris.persistence.relational.jdbc.initial_delay_in_ms`                    
          | `100 ms`              | Initial delay before retrying. The delay is 
doubled after each retry.                                                       
                                                                                
                                                                                
                                                                  |
-| `polaris.persistence.eclipselink.configurationFile`                          
          |                       | Define the location of the 
`persistence.xml`. By default, it's the built-in `persistence.xml` in use.      
                                                                                
                                                                                
                                                                                
   |
-| `polaris.persistence.eclipselink.persistenceUnit`                            
          | `polaris`             | Define the name of the persistence unit to 
use, as defined in the `persistence.xml`.                                       
                                                                                
                                                                                
                                                                   |
-| `polaris.realm-context.type`                                                 
          | `default`             | Define the type of the Polaris realm to 
use.                                                                            
                                                                                
                                                                                
                                                                      |
-| `polaris.realm-context.realms`                                               
          | `POLARIS`             | Define the list of realms to use.           
                                                                                
                                                                                
                                                                                
                                                                  |
-| `polaris.realm-context.header-name`                                          
          | `Polaris-Realm`       | Define the header name defining the realm 
context.                                                                        
                                                                                
                                                                                
                                                                    |
-| `polaris.features."ENFORCE_PRINCIPAL_CREDENTIAL_ROTATION_REQUIRED_CHECKING"` 
          | `false`               | Flag to enforce check if credential 
rotation.                                                                       
                                                                                
                                                                                
                                                                          |
-| `polaris.features."SUPPORTED_CATALOG_STORAGE_TYPES"`                         
          | `FILE`                | Define the catalog supported storage. 
Supported values are `S3`, `GCS`, `AZURE`, `FILE`.                              
                                                                                
                                                                                
                                                                        |
-| 
`polaris.features.realm-overrides."my-realm"."SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION"`
 | `true`                | "Override" realm features, here the skip credential 
subscoping indirection flag.                                                    
                                                                                
                                                                                
                                                          |
-| `polaris.authentication.authenticator.type`                                  
          | `default`             | Define the Polaris authenticator type.      
                                                                                
                                                                                
                                                                                
                                                                  |
-| `polaris.authentication.token-service.type`                                  
          | `default`             | Define the Polaris token service type.      
                                                                                
                                                                                
                                                                                
                                                                  |
-| `polaris.authentication.token-broker.type`                                   
          | `rsa-key-pair`        | Define the Polaris token broker type. Also 
configure the location of the key files. For RSA: if the locations of the key 
files are not configured, an ephemeral key-pair will be created on each Polaris 
server instance startup, which breaks existing tokens after server restarts and 
is also incompatible with running multiple Polaris server instances. |
-| `polaris.authentication.token-broker.max-token-generation`                   
          | `PT1H`                | Define the max token generation policy on 
the token broker.                                                               
                                                                                
                                                                                
                                                                    |
-| `polaris.authentication.token-broker.rsa-key-pair.private-key-file`          
          |                       | Define the location of the RSA-256 private 
key file, if present the `public-key` file must be specified, too.              
                                                                                
                                                                                
                                                                   |
-| `polaris.authentication.token-broker.rsa-key-pair.public-key-file`           
          |                       | Define the location of the RSA-256 public 
key file, if present the `private-key` file must be specified, too.             
                                                                                
                                                                                
                                                                    |
-| `polaris.authentication.token-broker.symmetric-key.secret`                   
          | `secret`              | Define the secret of the symmetric key.     
                                                                                
                                                                                
                                                                                
                                                                  |
-| `polaris.authentication.token-broker.symmetric-key.file`                     
          | `/tmp/symmetric.key`  | Define the location of the symmetric key 
file.                                                                           
                                                                                
                                                                                
                                                                     |
-| `polaris.storage.aws.access-key`                                             
          | `accessKey`           | Define the AWS S3 access key. If unset, the 
default credential provider chain will be used.                                 
                                                                                
                                                                                
                                                                  |
-| `polaris.storage.aws.secret-key`                                             
          | `secretKey`           | Define the AWS S3 secret key. If unset, the 
default credential provider chain will be used.                                 
                                                                                
                                                                                
                                                                  |
-| `polaris.storage.gcp.token`                                                  
          | `token`               | Define the Google Cloud Storage token. If 
unset, the default credential provider chain will be used.                      
                                                                                
                                                                                
                                                                    |
-| `polaris.storage.gcp.lifespan`                                               
          | `PT1H`                | Define the Google Cloud Storage lifespan 
type. If unset, the default credential provider chain will be used.             
                                                                                
                                                                                
                                                                     |
-| `polaris.log.request-id-header-name`                                         
          | `Polaris-Request-Id`  | Define the header name to match request ID 
in the log.                                                                     
                                                                                
                                                                                
                                                                   |
-| `polaris.log.mdc.aid`                                                        
          | `polaris`             | Define the log context (e.g. MDC) AID.      
                                                                                
                                                                                
                                                                                
                                                                  |
-| `polaris.log.mdc.sid`                                                        
          | `polaris-service`     | Define the log context (e.g. MDC) SID.      
                                                                                
                                                                                
                                                                                
                                                                  |
-| `polaris.rate-limiter.filter.type`                                           
          | `no-op`               | Define the Polaris rate limiter. Supported 
values are `no-op`, `token-bucket`.                                             
                                                                                
                                                                                
                                                                   |
-| `polaris.rate-limiter.token-bucket.type`                                     
          | `default`             | Define the token bucket rate limiter.       
                                                                                
                                                                                
                                                                                
                                                                  |
-| `polaris.rate-limiter.token-bucket.requests-per-second`                      
          | `9999`                | Define the number of requests per second 
for the token bucket rate limiter.                                              
                                                                                
                                                                                
                                                                     |
-| `polaris.rate-limiter.token-bucket.window`                                   
          | `PT10S`               | Define the window type for the token bucket 
rate limiter.                                                                   
                                                                                
                                                                                
                                                                  |
-| `polaris.metrics.tags.<tag-name>=<tag-value>`                                
          | `application=Polaris` | Define arbitrary metric tags to include in 
every request.                                                                  
                                                                                
                                                                                
                                                                   |
-| `polaris.metrics.realm-id-tag.api-metrics-enabled`                           
          | `false`               | Whether to enable the `realm_id` metric tag 
in API metrics.                                                                 
                                                                                
                                                                                
                                                                  |
-| `polaris.metrics.realm-id-tag.http-metrics-enabled`                          
          | `false`               | Whether to enable the `realm_id` metric tag 
in HTTP request metrics.                                                        
                                                                                
                                                                                
                                                                  |
-| `polaris.metrics.realm-id-tag.http-metrics-max-cardinality`                  
          | `100`                 | The maximum cardinality for the `realm_id` 
tag in HTTP request metrics.                                                    
                                                                                
                                                                                
                                                                   |
-| `polaris.tasks.max-concurrent-tasks`                                         
          | `100`                 | Define the max number of concurrent tasks.  
                                                                                
                                                                                
                                                                                
                                                                  |
-| `polaris.tasks.max-queued-tasks`                                             
          | `1000`                | Define the max number of tasks in queue.    
                                                                                
                                                                                
                                                                                
                                                                  |
- | `polaris.config.rollback.compaction.on-conflicts.enabled`                   
           | `false`              | When set to true Polaris will apply the 
deconfliction by rollbacking those REPLACE operations snapshots which have the 
property of `polaris.internal.rollback.compaction.on-conflict` in their 
snapshot summary set to `rollback`, to resolve conflicts at the server end.     
                                                                               |
+| Configuration Property                                                       
          | Default Value                      | Description                    
                                                                                
                                                                                
                                                                                
                                                                               |
+|----------------------------------------------------------------------------------------|------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|
+| `polaris.persistence.type`                                                   
          | `relational-jdbc`                  | Define the persistence backend 
used by Polaris (`in-memory`, `relational-jdbc`, `eclipse-link` (deprecated)). 
See [Configuring Apache Polaris for Production)[{{% ref 
"configuring-polaris-for-production.md" %}})                                    
                                                                                
                        |
+| `polaris.persistence.relational.jdbc.max-retries`                            
          | `1`                                | Total number of retries JDBC 
persistence will attempt on connection resets or serialization failures before 
giving up.                                                                      
                                                                                
                                                                                
  |
+| `polaris.persistence.relational.jdbc.max_duaration_in_ms`                    
          | `5000 ms`                          | Max time interval (ms) since 
the start of a transaction when retries can be attempted.                       
                                                                                
                                                                                
                                                                                
 |
+| `polaris.persistence.relational.jdbc.initial_delay_in_ms`                    
          | `100 ms`                           | Initial delay before retrying. 
The delay is doubled after each retry.                                          
                                                                                
                                                                                
                                                                               |
+| `polaris.persistence.eclipselink.configurationFile`                          
          |                                    | Define the location of the 
`persistence.xml`. By default, it's the built-in `persistence.xml` in use.      
                                                                                
                                                                                
                                                                                
   |
+| `polaris.persistence.eclipselink.persistenceUnit`                            
          | `polaris`                          | Define the name of the 
persistence unit to use, as defined in the `persistence.xml`.                   
                                                                                
                                                                                
                                                                                
       |
+| `polaris.realm-context.type`                                                 
          | `default`                          | Define the type of the Polaris 
realm to use.                                                                   
                                                                                
                                                                                
                                                                               |
+| `polaris.realm-context.realms`                                               
          | `POLARIS`                          | Define the list of realms to 
use.                                                                            
                                                                                
                                                                                
                                                                                
 |
+| `polaris.realm-context.header-name`                                          
          | `Polaris-Realm`                    | Define the header name 
defining the realm context.                                                     
                                                                                
                                                                                
                                                                                
       |
+| `polaris.features."ENFORCE_PRINCIPAL_CREDENTIAL_ROTATION_REQUIRED_CHECKING"` 
          | `false`                            | Flag to enforce check if 
credential rotation.                                                            
                                                                                
                                                                                
                                                                                
     |
+| `polaris.features."SUPPORTED_CATALOG_STORAGE_TYPES"`                         
          | `FILE`                             | Define the catalog supported 
storage. Supported values are `S3`, `GCS`, `AZURE`, `FILE`.                     
                                                                                
                                                                                
                                                                                
 |
+| 
`polaris.features.realm-overrides."my-realm"."SKIP_CREDENTIAL_SUBSCOPING_INDIRECTION"`
 | `true`                             | "Override" realm features, here the 
skip credential subscoping indirection flag.                                    
                                                                                
                                                                                
                                                                          |
+| `polaris.authentication.authenticator.type`                                  
          | `default`                          | Define the Polaris 
authenticator type.                                                             
                                                                                
                                                                                
                                                                                
           |
+| `polaris.authentication.token-service.type`                                  
          | `default`                          | Define the Polaris token 
service type.                                                                   
                                                                                
                                                                                
                                                                                
     |
+| `polaris.authentication.token-broker.type`                                   
          | `rsa-key-pair`                     | Define the Polaris token 
broker type. Also configure the location of the key files. For RSA: if the 
locations of the key files are not configured, an ephemeral key-pair will be 
created on each Polaris server instance startup, which breaks existing tokens 
after server restarts and is also incompatible with running multiple Polaris 
server instances. |
+| `polaris.authentication.token-broker.max-token-generation`                   
          | `PT1H`                             | Define the max token 
generation policy on the token broker.                                          
                                                                                
                                                                                
                                                                                
         |
+| `polaris.authentication.token-broker.rsa-key-pair.private-key-file`          
          |                                    | Define the location of the 
RSA-256 private key file, if present the `public-key` file must be specified, 
too.                                                                            
                                                                                
                                                                                
     |
+| `polaris.authentication.token-broker.rsa-key-pair.public-key-file`           
          |                                    | Define the location of the 
RSA-256 public key file, if present the `private-key` file must be specified, 
too.                                                                            
                                                                                
                                                                                
     |
+| `polaris.authentication.token-broker.symmetric-key.secret`                   
          | `secret`                           | Define the secret of the 
symmetric key.                                                                  
                                                                                
                                                                                
                                                                                
     |
+| `polaris.authentication.token-broker.symmetric-key.file`                     
          | `/tmp/symmetric.key`               | Define the location of the 
symmetric key file.                                                             
                                                                                
                                                                                
                                                                                
   |
+| `polaris.storage.aws.access-key`                                             
          | `accessKey`                        | Define the AWS S3 access key. 
If unset, the default credential provider chain will be used.                   
                                                                                
                                                                                
                                                                                
|
+| `polaris.storage.aws.secret-key`                                             
          | `secretKey`                        | Define the AWS S3 secret key. 
If unset, the default credential provider chain will be used.                   
                                                                                
                                                                                
                                                                                
|
+| `polaris.storage.gcp.token`                                                  
          | `token`                            | Define the Google Cloud 
Storage token. If unset, the default credential provider chain will be used.    
                                                                                
                                                                                
                                                                                
      |
+| `polaris.storage.gcp.lifespan`                                               
          | `PT1H`                             | Define the Google Cloud 
Storage lifespan type. If unset, the default credential provider chain will be 
used.                                                                           
                                                                                
                                                                                
       |
+| `polaris.log.request-id-header-name`                                         
          | `Polaris-Request-Id`               | Define the header name to 
match request ID in the log.                                                    
                                                                                
                                                                                
                                                                                
    |
+| `polaris.log.mdc.aid`                                                        
          | `polaris`                          | Define the log context (e.g. 
MDC) AID.                                                                       
                                                                                
                                                                                
                                                                                
 |
+| `polaris.log.mdc.sid`                                                        
          | `polaris-service`                  | Define the log context (e.g. 
MDC) SID.                                                                       
                                                                                
                                                                                
                                                                                
 |
+| `polaris.rate-limiter.filter.type`                                           
          | `no-op`                            | Define the Polaris rate 
limiter. Supported values are `no-op`, `token-bucket`.                          
                                                                                
                                                                                
                                                                                
      |
+| `polaris.rate-limiter.token-bucket.type`                                     
          | `default`                          | Define the token bucket rate 
limiter.                                                                        
                                                                                
                                                                                
                                                                                
 |
+| `polaris.rate-limiter.token-bucket.requests-per-second`                      
          | `9999`                             | Define the number of requests 
per second for the token bucket rate limiter.                                   
                                                                                
                                                                                
                                                                                
|
+| `polaris.rate-limiter.token-bucket.window`                                   
          | `PT10S`                            | Define the window type for the 
token bucket rate limiter.                                                      
                                                                                
                                                                                
                                                                               |
+| `polaris.metrics.tags.<tag-name>=<tag-value>`                                
          | `application=Polaris`              | Define arbitrary metric tags 
to include in every request.                                                    
                                                                                
                                                                                
                                                                                
 |
+| `polaris.metrics.realm-id-tag.api-metrics-enabled`                           
          | `false`                            | Whether to enable the 
`realm_id` metric tag in API metrics.                                           
                                                                                
                                                                                
                                                                                
        |
+| `polaris.metrics.realm-id-tag.http-metrics-enabled`                          
          | `false`                            | Whether to enable the 
`realm_id` metric tag in HTTP request metrics.                                  
                                                                                
                                                                                
                                                                                
        |
+| `polaris.metrics.realm-id-tag.http-metrics-max-cardinality`                  
          | `100`                              | The maximum cardinality for 
the `realm_id` tag in HTTP request metrics.                                     
                                                                                
                                                                                
                                                                                
  |
+| `polaris.tasks.max-concurrent-tasks`                                         
          | `100`                              | Define the max number of 
concurrent tasks.                                                               
                                                                                
                                                                                
                                                                                
     |
+| `polaris.tasks.max-queued-tasks`                                             
          | `1000`                             | Define the max number of tasks 
in queue.                                                                       
                                                                                
                                                                                
                                                                               |
+| `polaris.config.rollback.compaction.on-conflicts.enabled`                    
          | `false`                            | When set to true Polaris will 
apply the deconfliction by rollbacking those REPLACE operations snapshots which 
have the property of `polaris.internal.rollback.compaction.on-conflict` in 
their snapshot summary set to `rollback`, to resolve conflicts at the server 
end.                                                                            
        |
+| `polaris.event-listener.type`                                                
          | `no-op`                            | Define the Polaris event 
listener type. Supported values are `no-op`, `aws-cloudwatch`.                  
                                                                                
                                                                                
                                                                                
     |
+| `polaris.event-listener.aws-cloudwatch.log-group`                            
          | `polaris-cloudwatch-default-group` | Define the AWS CloudWatch log 
group name for the event listener.                                              
                                                                                
                                                                                
                                                                                
|
+| `polaris.event-listener.aws-cloudwatch.log-stream`                           
          | `polaris-cloudwatch-default-stream`| Define the AWS CloudWatch log 
stream name for the event listener. Ensure that Polaris' IAM credentials have 
the following actions: "PutLogEvents", "DescribeLogStreams", and 
"DescribeLogGroups" on the specified log stream/group. If the specified log 
stream/group does not exist, then "CreateLogStream" and "CreateLogGroup" will 
also be required.      |
+| `polaris.event-listener.aws-cloudwatch.region`                               
          | `us-east-1`                        | Define the AWS region for the 
CloudWatch event listener.                                                      
                                                                                
                                                                                
                                                                                
|
+| `polaris.event-listener.aws-cloudwatch.synchronous-mode`                     
          | `false`                            | Define whether log events are 
sent to CloudWatch synchronously. When set to true, events are sent 
synchronously which may impact performance but ensures immediate delivery. When 
false (default), events are sent asynchronously for better performance.         
                                                                                
            |
 
 There are non Polaris configuration properties that can be useful:
 

Reply via email to