Using the official CLI (aws logs get-log-events) or https://github.com/jorgebastida/awslogs is pretty close to SSH-ing and grepping.

Oh thanks I'll have to give that a shot! It may also just be that I need to not get so caught up in learning a new way to do something.

I hear you, and when I did some research on this in the past, going to get logs was the most common reason for engineers to SSH to production hosts.

As a security guy, I hate SSH to production (the whole "cattle, not pets" thing). In my last company we had an internal tool to federate you to the AWS console. We had runbooks in a wiki, and had links literally to the logs for a particular component/service/region - the link would federate you to the right account and take you directly to the target log in cloudwatch logs in the appropriate region. Safer and easier than ssh-to-prod.