Imported LogGroups don't have :* in resource ARN grants

[kohidave]

❓ General Issue

Feedback around LogGroupBase:grant

The Question

Right now, there seems to be an assumption that the LogGroupArn is always appended with :* - I think this is true when the value is retrieved from GetAtt.

aws-cdk/packages/@aws-cdk/aws-logs/lib/log-group.ts

Line 163 in cf8c831

public grant(grantee: iam.IGrantable, ...actions: string[]) {

But when customers construct the LogGroup themselves with fromLogGroupArn or fromLogGroupName then they would probably exclude the :* suffix.

I think this ends up being confusing when a policy is created through grant when passed one of these constructed log groups - since the generated policy won't have permissions to create streams.

When using fromLogGroupArn or fromLogGroupName the generated policy looks like:

{
	"Action": [
		"logs:CreateLogStream",
		"logs:PutLogEvents"
	],
	"Resource": "arn:aws:logs:us-west-2:***:log-group:SOME_STREAM_PREFIX",
	"Effect": "Allow"
}

But it should look like:

{
	"Action": [
		"logs:CreateLogStream",
		"logs:PutLogEvents"
	],
	"Resource": "arn:aws:logs:us-west-2:***:log-group:SOME_STREAM_PREFIX:*",
	"Effect": "Allow"
}

Environment

• CDK CLI Version: v1.31.0
• OS: all
• Language: all

Other information

This is related to one of the comments in this thread: #5954

THANK YOU!