Getting started with LogStitch

LogStitch is a native macOS app that reads your AWS Lambda logs from CloudWatch and stitches them back into the invocations they belong to. It runs entirely on your Mac using your own AWS credentials — there's no LogStitch cloud in the middle. This guide walks a brand-new user from first launch to their first stitched invocation.

Before you start

LogStitch connects to your AWS account, so it's built for developers already working with AWS Lambda. You'll want:

• A Mac running macOS 26.1 or later (LogStitch is a Universal app — Intel and Apple Silicon).
• An AWS account with Lambda functions you want to look at.
• AWS credentials in one of three forms: an existing AWS CLI config (~/.aws), an access key ID and secret access key, or SSO (IAM Identity Center). Any one works — pick whichever you already have.

That's the only real prerequisite. There's no account to create with us and no data leaves your machine. The free 14-day trial needs no signup and has no limits, so you can point it at a real account and click through the steps below right away.

1

Connect an AWS profile

On first launch, LogStitch greets you with a Welcome screen offering three ways to connect. Choose the one that matches how you already access AWS:

Import from AWS CLI

Scans your existing ~/.aws/config and credentials files, lists the profiles it finds, and imports the ones you tick.

Best if you use the AWS CLI

Enter credentials manually

Paste an access key ID and secret access key, pick a region, and go. A session token is optional.

Best for a single key pair

Configure SSO

Connect with AWS IAM Identity Center (SSO). LogStitch runs the device-authorization sign-in for you.

Best for org SSO

Whichever you pick, LogStitch validates the credentials against AWS immediately and shows you exactly which account and identity you connected as, so you know it worked before moving on. If something's off, it explains what to fix in plain language instead of showing a raw error code. You can also give each profile a color (with smart suggestions like red for prod) so multiple accounts stay visually distinct.

3

Open a function to read stitched logs

Select a function and LogStitch fetches its recent logs and stitches them into invocations by request ID. Instead of scrolling a timestamp-sorted stream where concurrent executions are interleaved, you read one Lambda execution as a single ordered story: every log line in order, parsed JSON, cold-start flags, and duration in one place. That's the whole core loop — add a profile, open it, click a function.

What LogStitch needs from AWS

LogStitch is read-only. It never creates, changes, or deletes anything in your AWS account. It needs just enough access to list your functions, read their logs, pull basic metrics, and confirm which account you're connected to. If you'd rather grant a dedicated, least-privilege policy instead of using broad existing credentials, here's the exact minimum — the same policy is available inside the app under Help → AWS Permissions Required.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "LambdaReadAccess",
            "Effect": "Allow",
            "Action": [
                "lambda:ListFunctions",
                "lambda:ListTags"
            ],
            "Resource": "*"
        },
        {
            "Sid": "CloudWatchLogsAccess",
            "Effect": "Allow",
            "Action": [
                "logs:DescribeLogStreams",
                "logs:GetLogEvents",
                "logs:FilterLogEvents"
            ],
            "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/*:*"
        },
        {
            "Sid": "CloudWatchMetricsAccess",
            "Effect": "Allow",
            "Action": ["cloudwatch:GetMetricStatistics"],
            "Resource": "*"
        },
        {
            "Sid": "STSIdentity",
            "Effect": "Allow",
            "Action": ["sts:GetCallerIdentity"],
            "Resource": "*"
        }
    ]
}

You can scope the CloudWatchLogsAccess resource down further to specific log groups or regions if you want to restrict LogStitch to a subset of your functions. SSO and assume-role users grant the equivalent permissions on the role they sign in as.

Tips for a smooth start

• ↳Use "Test Connection" any time. If a profile ever stops working (say an SSO session expired), the Test Connection button re-validates it and tells you what's wrong.
• ↳Color-code your accounts. Give prod a distinct color so you always know which account a tab belongs to before you act on it.
• ↳No functions showing? Lambda is region-specific. If a profile's region has no functions, switch the profile to the region your functions are deployed in.
• ↳Learn the shortcuts when you're ready. Press ⌘/ for the keyboard-shortcut cheat sheet — quick search, global search, new tab, switch profile, and more. None of them are required for the core flow.
• ↳Not sure about permissions? Open Help → AWS Permissions Required in the app for the exact IAM actions, what each is for, and a copy-and-paste policy.

Getting-started FAQ