add TagLogGroup iam permission

Setup lambda function fails to create node functions with error: Error: Creating CloudWatch Log Group failed: AccessDeniedException: User with accountId: xxx is not authorized to perform CreateLogGroup with Tags
mantil-io · Nov 7, 2022 · 89d864c · 89d864c
1 parent f5d3b09
commit 89d864c
Show file tree

Hide file tree

Showing 4 changed files with 5 additions and 1 deletion.
diff --git a/cli/controller/setup_stack_template.yml b/cli/controller/setup_stack_template.yml
@@ -104,6 +104,7 @@ Resources:
                   - logs:UpdateLogDelivery
                   - logs:ListLogDeliveries
                   - logs:DeleteLogDelivery
+                  - logs:TagLogGroup
                 Resource:
                   - "*"
               - Effect: Allow

diff --git a/cli/controller/testdata/template.yml b/cli/controller/testdata/template.yml
@@ -104,6 +104,7 @@ Resources:
                   - logs:UpdateLogDelivery
                   - logs:ListLogDeliveries
                   - logs:DeleteLogDelivery
+                  - logs:TagLogGroup
                 Resource:
                   - "*"
               - Effect: Allow

diff --git a/node/api/setup/setup.go b/node/api/setup/setup.go
@@ -208,7 +208,8 @@ const apiCloudwatchRolePolicy = `{
                 "logs:DescribeLogStreams",
                 "logs:PutLogEvents",
                 "logs:GetLogEvents",
-                "logs:FilterLogEvents"
+                "logs:FilterLogEvents",
+                "logs:TagLogGroup"
             ],
             "Resource": "*"
         }

diff --git a/node/terraform/modules/functions-node/iam.tf b/node/terraform/modules/functions-node/iam.tf
@@ -66,6 +66,7 @@ data "aws_iam_policy_document" "deploy" {
       "logs:PutRetentionPolicy",
       "logs:PutLogEvents",
       "logs:DeleteLogGroup",
+      "logs:TagLogGroup",
     ]
     resources = [
       "arn:aws:logs:*:*:log-group:*-${var.suffix}",