# Elastic Serverless Forwarder Cannot Connect to my Elastic Cloud Deployment

**URL:** <https://discuss.elastic.co/t/elastic-serverless-forwarder-cannot-connect-to-my-elastic-cloud-deployment/371959>\
**Category:** Logs\
**Created:** [December 13, 2024, 1:40pm UTC](https://discuss.elastic.co/t/elastic-serverless-forwarder-cannot-connect-to-my-elastic-cloud-deployment/371959 "2024-12-13T13:40:43Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [December 13, 2024, 1:40pm UTC](https://discuss.elastic.co/t/elastic-serverless-forwarder-cannot-connect-to-my-elastic-cloud-deployment/371959/1 "2024-12-13T13:40:43Z")

</div>

Hello,

I'm having trouble sending CloudWatch logs to Elastic Cloud via Elastic Serverless Forwarder (ESF). I've configured my config.yml per the official elastic documentation. I also enabled the DEBUG logs to add verboseness. I then found error "Forbidden due to traffic filtering". Is there anyway to see these Traffic Filtering logs in Elastic Cloud? So that I may add the IP to my Elastic Cloud deployment? Or am I missing a step to allow this connection? Will deploying APM to the ESF show me more details?

config.yaml -

```auto
inputs:
  - type: "kinesis-data-stream"
    id: "arn:aws:kinesis:/ElasticRecipientStream"
    tags:
      - "aws-comm-serverless-kinesis"
    outputs:
      - type: "elasticsearch"
        args:
          # either elasticsearch_url or cloud_id, elasticsearch_url takes precedence
          # elasticsearch_url: "http(s)://domain.tld:port"
          cloud_id: "<cloud_id>"
          # either api_key or username/password, api_key takes precedence
          api_key: "<API_KEY>"
          # username: "elastic"
          # password: ""
          es_datastream_name: "logs-aws.cloudwatch-serverless"
          batch_max_actions: 500
          batch_max_bytes: 10485760
          ssl_assert_fingerprint: ""

```

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 13, 2024, 2:33pm UTC](https://discuss.elastic.co/t/elastic-serverless-forwarder-cannot-connect-to-my-elastic-cloud-deployment/371959/2 "2024-12-13T14:33:29Z")

</div>

Hi @pkward

You or your elastic Cloud admin needs to log into The elastic Cloud Cloud admin console and take a look.. The traffic filters are applied onto the deployment through the cloud console or perhaps terraform someone's doing that.  
That's what's blocking your traffic

> **[Traffic Filtering | Elasticsearch Service Documentation | Elastic](https://www.elastic.co/guide/en/cloud/current/ec-traffic-filtering-deployment-configuration.html)**

---

<div class="post-metadata">

**Author:** ![pkward](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/pkward/32/95305_2.png) [@pkward](https://discuss.elastic.co/u/pkward)\
**Post date:** [December 13, 2024, 2:59pm UTC](https://discuss.elastic.co/t/elastic-serverless-forwarder-cannot-connect-to-my-elastic-cloud-deployment/371959/3 "2024-12-13T14:59:22Z")

</div>

Okay, I'm the Cloud Admin but I'm unsure where to look for the Traffic Filter logs. I understand how traffic filters work and how to implement them. I guess from an ESF standpoint, how can I find the IP of the ESF to add to the traffic filter? Also, do I need to do anything additionally on AWS to allow outbound traffic from my ESF Lambda?

---

<div class="post-metadata">

**Author:** ![stephenb](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/stephenb/32/40856_2.png) [@stephenb](https://discuss.elastic.co/u/stephenb)\
**Post date:** [December 13, 2024, 3:41pm UTC](https://discuss.elastic.co/t/elastic-serverless-forwarder-cannot-connect-to-my-elastic-cloud-deployment/371959/4 "2024-12-13T15:41:06Z")

</div>

Steps by Step Instructions here

> **[IP traffic filters | Elasticsearch Service Documentation | Elastic](https://www.elastic.co/guide/en/cloud/current/ec-traffic-filtering-ip.html#ec-create-traffic-filter-ip-rule-set)**

This is where you create them...  
[https://cloud.elastic.co/deployment-features/traffic-filters](https://cloud.elastic.co/deployment-features/traffic-filters)

 ![Screenshot 2024-12-13 at 7.38.19 AM](https://us1.discourse-cdn.com/elastic/original/3X/c/d/cdbf468d7ce660b0795641c51f0a213ae388b2b0.png)

The when you manage a deployment ... you apply them on the deployment

 ![Screenshot 2024-12-13 at 7.38.36 AM](https://us1.discourse-cdn.com/elastic/original/3X/0/2/02a4f97e4b943d99b6e29bda0dadf171ac61a92b.png)