The state machine IAM Role is not authorized to access the Log Destination

Question

I am trying to deploy a CF stack which is failing because of an IAM permission issue. The concerning resources in the stack for this issue are:

1. state machine (step function)

2. Cloudwatch log group

3. A subscription filter for the log group

This subscription filter forwards the logs to Kenesis where the logs are streamed into splunk. Coming back to my issue, when I try to deploy the above CF stack, I get the following error: The state machine IAM Role is not authorized to access the Log Destination

I have given the following permissions to the role attached to the state machine

StateMachineRole:
  Type: AWS::IAM::Role
  DeletionPolicy: Retain
  Properties:
    RoleName: StateMachineRole-${self:custom.env.stage}
    AssumeRolePolicyDocument:
      Version: '2012-10-17'
      Statement:
        - Effect: Allow
          Principal:
            Service: states.amazonaws.com
          Action: sts:AssumeRole

  LambdaPolicy:
   Type: AWS::IAM::Policy
   DeletionPolicy: Retain
   DependsOn: CustomLogGroup
   Properties:
     PolicyName: LambdaPolicy-${self:custom.env.stage}
     PolicyDocument:
       Version: '2012-10-17'
       Statement:
        - Effect: Allow
          Action:
            - 'lambda:InvokeFunction'
          Resource: lambdaArn
        - Effect: Allow
          Action:
            - 'logs:CreateLogDelivery'
            - 'logs:GetLogDelivery'
            - 'logs:UpdateLogDelivery'
            - 'logs:DeleteLogDelivery'
            - 'logs:ListLogDeliveries'
            - 'logs:PutLogEvents'
            - 'logs:PutResourcePolicy'
            - 'logs:DescribeResourcePolicies'
            - 'logs:DescribeLogGroups'
            - 'logs:PutDestination'
            - 'logs:PutSubscriptionFilter'
            - 'logs:PutDestinationPolicy'
          Resource: !GetAtt CustomLogGroup.Arn
  
  
  /*CustomLogGroup*/
  CustomLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      KmsKeyId: !ImportValue XXXXXXX
      LogGroupName: CustomLogGroupName
      RetentionInDays:  ${file(./.env.${self:custom.env.stage}.yaml):cloudwatchLogs.retentionDays

Referred to the following SO question: Aws step function deployment log access issue

Answer 1

Some of the actions don’t support Resource types, so using a wildcard * will solve your permission issue.

Resource: '*'

If want to follow the Least privilege access principle, there are some points about the CloudWatch permissions that you need to check:

• The LogDelivery and ResourcePolicy actions don’t support Resource types, so they must use a wildcard * on the Resources.

   - Effect: Allow
     Action:
       - 'logs:CreateLogDelivery'
       - 'logs:GetLogDelivery'
       - 'logs:UpdateLogDelivery'
       - 'logs:DeleteLogDelivery'
       - 'logs:ListLogDeliveries'
       - 'logs:PutResourcePolicy'
       - 'logs:DescribeResourcePolicies'
     Resource: '*'
  

• The PutLogEvents action are in the log-stream* level so if want to restrict, you need to follow something like this:

   - Effect: Allow
     Action:
       - 'logs:PutLogEvents'
     Resource: 'arn:aws:logs:${Region}:${Account}:log-group:${LogGroupName}:log-stream:${LogStreamName}
  

• The Destination related actions are in the destination* level, so if want to restrict, you need to follow something like this:

   - Effect: Allow
     Action:
       - 'logs:PutDestination'
       - 'logs:PutDestinationPolicy'
     Resource: 'arn:aws:logs:${Region}:${Account}:log-group:${LogGroupName}:destination:${DestinationName}'
  

• The PutSubscriptionFilter action are in the log-group and destination* levels.

More information about the CloudWatch Logs action and permissions can be found here:

Actions, resources, and condition keys for Amazon CloudWatch Logs