Output Cloudwatch: IAM permissions #913
Description
On this file
pipeline/outputs/cloudwatch.md
for version 1.9.7 the IAM policy
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:CreateLogGroup",
"logs:PutLogEvents"
],
"Resource": "*"
}]
}
doesn't works
generating an error similar to
User: arn:aws:sts::ACCOUNTID:assumed-role/TASKROLE/f8fe25c51f804adaaaa3822a47476353 is not authorized to perform: logs:DescribeLogStreams on resource: arn:aws:logs:eu-south-1:ACCOUNTID:log-group:LOGGROUP:log-stream: because no identity-based policy allows the logs:DescribeLogStreams action\n\tstatus code: 400, request id: 2436cba2-f56a-44f7-b94e-113d217328b6\n" func="github.com/aws/amazon-cloudwatch-logs-for-fluent-bit/cloudwatch.(*OutputPlugin).AddEvent()" file="cloudwatch.go:389"
{
"Version": "2012-10-17",
"Statement": [{
"Effect": "Allow",
"Action": [
"logs:CreateLogStream",
"logs:CreateLogGroup",
"logs:PutLogEvents",
"logs:DescribeLogStreams"
],
"Resource": "*"
}]
}