Give lambdas readonly access of cloudwatch logs (#2263)

cisagov · Sep 29, 2023 · 03a5f69 · 03a5f69
1 parent dac9afe
commit 03a5f69
Showing 1 changed file with 12 additions and 0 deletions.
diff --git a/backend/serverless.yml b/backend/serverless.yml
@@ -57,6 +57,18 @@ provider:
             - s3:PutObject
             - s3:PutObjectAcl
           Resource: '*'
+        - Effect: Allow
+          Action:
+            - logs:Describe*,
+            - logs:Get*,
+            - logs:List*,
+            - logs:StartQuery,
+            - logs:StopQuery,
+            - logs:TestMetricFilter,
+            - logs:FilterLogEvents,
+            - logs:StartLiveTail,
+            - logs:StopLiveTail
+          Resource: '*'
 
 functions:
   - ${file(./src/tasks/functions.yml)}