fix pivot role logs actions privileges (#350)

### Feature or Bugfix - Bugfix ### Detail For for setting up privileges for logs related actions. Currently due to the incorrect settings logs for Custom Resources and Glue are not visible. By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
data-dot-all · Mar 6, 2023 · 8dffce2 · 8dffce2
1 parent 4827daf
commit 8dffce2
Show file tree

Hide file tree

Showing 2 changed files with 6 additions and 6 deletions.
diff --git a/deploy/pivot_role/pivotRole.yaml b/deploy/pivot_role/pivotRole.yaml
@@ -133,9 +133,9 @@ Resources:
               - 'logs:CreateLogStream'
               - 'logs:PutLogEvents'
             Resource:
-              - !Sub 'arn:aws:logs:*:${AWS::AccountId}:/aws-glue/*'
-              - !Sub 'arn:aws:logs:*:${AWS::AccountId}:/aws-lambda/*'
-              - !Sub 'arn:aws:logs:*:${AWS::AccountId}:/${EnvironmentResourcePrefix}*'
+              - !Sub 'arn:aws:logs:*:${AWS::AccountId}:log-group:/aws-glue/*'
+              - !Sub 'arn:aws:logs:*:${AWS::AccountId}:log-group:/aws/lambda/*'
+              - !Sub 'arn:aws:logs:*:${AWS::AccountId}:log-group:/${EnvironmentResourcePrefix}*'
           - Sid: Logging
             Action:
               - 'logs:PutLogEvents'

diff --git a/deploy/pivot_role/pivotRoleCDK/dataall_base_infra.py b/deploy/pivot_role/pivotRoleCDK/dataall_base_infra.py
@@ -179,9 +179,9 @@ def _create_dataall_policy0(self, env_resource_prefix: str) -> iam.ManagedPolicy
                                              "logs:PutLogEvents"
                                          ],
                                          resources=[
-                                             f"arn:aws:logs:*:{self.account}:/aws-glue/*",
-                                             f"arn:aws:logs:*:{self.account}:/aws-lambda/*",
-                                             f"arn:aws:logs:*:{self.account}:/{env_resource_prefix}*"
+                                             f"arn:aws:logs:*:{self.account}:log-group:/aws-glue/*",
+                                             f"arn:aws:logs:*:{self.account}:log-group:/aws/lambda/*",
+                                             f"arn:aws:logs:*:{self.account}:log-group:/{env_resource_prefix}*",
                                          ]
                                      ),
                                      # Logging