aws ds create-log-subscription
Creates a subscription to forward real-time Directory Service domain controller security logs to the specified Amazon CloudWatch log group in your Amazon Web Services account. AWS CLI reference
2 options Its page in the AWS CLI reference
Options
--directory-idIdentifier of the directory to which you want to subscribe and receive real-time logs to your specified CloudWatch log group.--log-group-nameThe name of the CloudWatch log group where the real-time domain controller logs are forwarded.