S3 log export

Export any combination of check run logs, code review analytics, and user activity on an hourly or daily schedule. Each window contains gzip-compressed NDJSON parts and a manifest. See the export schema. Setup requires a Macroscope workspace admin and permission to create an AWS bucket and IAM role. Macroscope assumes the role with Google-issued OIDC tokens; it does not store AWS access keys.

IAM trust policy

Settings → Workspace → Log Export provides a trust policy containing your workspace audience and Macroscope’s export service account ID. Use those exact values in a role with a Custom trust policy:

{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": { "Federated": "accounts.google.com" },
    "Action": "sts:AssumeRoleWithWebIdentity",
    "Condition": {
      "StringEquals": {
        "accounts.google.com:sub": "MACROSCOPE_SERVICE_ACCOUNT_ID",
        "accounts.google.com:oaud": "sts.amazonaws.com/ws/{workspace_type}/{workspace_id}"
      }
    }
  }]
}

The service account is the same for save-time validation and scheduled exports. The workspace audience prevents cross-workspace role assumption. Each role ARN can belong to only one Macroscope workspace. AWS’s built-in Google provider maps accounts.google.com:oaud to the token’s aud claim; accounts.google.com:aud maps to azp. Do not substitute one for the other or register a separate OIDC provider for this integration.

Bucket permissions

Keep the bucket private. Grant the role bucket-location access and write access to your export prefix:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:GetBucketLocation",
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME"
    },
    {
      "Effect": "Allow",
      "Action": "s3:PutObject",
      "Resource": "arn:aws:s3:::YOUR_BUCKET_NAME/macroscope/*"
    }
  ]
}

This example uses the macroscope/ prefix. Match the resource to your configured prefix. For SSE-KMS with a customer-managed key, also grant the role kms:GenerateDataKey and kms:Encrypt on that key and allow access in its key policy. Optional s3:DeleteObject access lets Macroscope clean up stale part files after a re-export. Consumers must ignore unlisted parts regardless.

Export settings

Field	Required	Value
Bucket name	Yes	Your bucket’s name.
Bucket region	Yes	AWS region, such as `us-east-1`.
Role ARN	Yes	`arn:aws:iam::<account>:role/<role>`.
Key prefix	No	Must end in `/`, such as `macroscope/`.
Frequency	Yes	Hourly or daily.

Saving validates role assumption and bucket writes before enabling exports. Settings show the next run, last successful window, and latest failure. Pausing preserves configuration. Resuming starts at the next scheduled window. Deleting configuration stops exports without deleting existing S3 objects.

Read exported data

aws s3 ls s3://YOUR_BUCKET_NAME/macroscope/ --recursive
aws s3 cp s3://YOUR_BUCKET_NAME/path/to/window.manifest.json - | jq .
aws s3 cp s3://YOUR_BUCKET_NAME/path/to/listed.part-0001.ndjson.gz - | gunzip | jq .

Read only the parts named in the window’s manifest. Prefix-globbing can include stale parts from a previous export. The manifest is written last; empty windows still produce a manifest. Object layout and record fields document all three export types and the code-review aggregate.

Troubleshooting

Error	Check
`422`, role assumption failed	Built-in `accounts.google.com` principal, exact service-account `sub`, and workspace `oaud` from the generated trust policy.
`422`, `s3:PutObject` denied	Bucket/region, prefix permissions, and KMS access if applicable.
`InvalidIdentityToken`	A separately registered Google OIDC provider can conflict with the built-in provider. Review the IAM configuration.
`409 Conflict`	The role is registered to another workspace; use a separate role.
Missing window	A window is permanently skipped after five failed retry attempts. Later windows continue. Check the latest failure in settings.

Pricing

Code Review

Status

API & Integrations

Workspace

Resources

IAM trust policy

Bucket permissions

Export settings

Read exported data

Troubleshooting

​IAM trust policy

​Bucket permissions

​Export settings

​Read exported data

​Troubleshooting

IAM trust policy

Bucket permissions

Export settings

Read exported data

Troubleshooting