Cloudwatch to s3 lambda: Add log export/stream permissions to lambda …

…role (#2303) * Add cloudwatch permissions to lambda role; remove redundant logs:GetLogEvents.
cisagov · Oct 12, 2023 · b8f2717 · b8f2717
1 parent d8741fe
commit b8f2717
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/backend/serverless.yml b/backend/serverless.yml
@@ -44,7 +44,6 @@ provider:
             - ecs:RunTask
             - ecs:ListTasks
             - iam:PassRole
-            - logs:GetLogEvents
           Resource: '*'
         - Effect: Allow
           Action:
@@ -70,9 +69,12 @@ provider:
           Resource: '*'
         - Effect: Allow
           Action:
+            - logs:CreateExportTask
+            - logs:CreateLogStream
             - logs:Describe*
             - logs:Get*
             - logs:List*
+            - logs:PutLogEvents
             - logs:StartQuery
             - logs:StopQuery
             - logs:TestMetricFilter