Skip to content

Commit c773fd3

Browse files
feat: permit lambda write access only to it's own logs (#95)
Co-authored-by: Moritz Zimmer <moritzzimmer@users.noreply.github.com>
1 parent fede66e commit c773fd3

File tree

2 files changed

+35
-9
lines changed

2 files changed

+35
-9
lines changed

README.md

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -365,11 +365,12 @@ No modules.
365365
| [aws_cloudwatch_log_group.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_group) | resource |
366366
| [aws_cloudwatch_log_subscription_filter.cloudwatch_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/cloudwatch_log_subscription_filter) | resource |
367367
| [aws_iam_policy.event_sources](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
368+
| [aws_iam_policy.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
368369
| [aws_iam_policy.ssm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_policy) | resource |
369370
| [aws_iam_role.lambda](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role) | resource |
370371
| [aws_iam_role_policy_attachment.cloudwatch_lambda_insights](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
371-
| [aws_iam_role_policy_attachment.cloudwatch_logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
372372
| [aws_iam_role_policy_attachment.event_sources](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
373+
| [aws_iam_role_policy_attachment.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
373374
| [aws_iam_role_policy_attachment.ssm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
374375
| [aws_iam_role_policy_attachment.tracing_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
375376
| [aws_iam_role_policy_attachment.vpc_attachment](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/iam_role_policy_attachment) | resource |
@@ -383,6 +384,7 @@ No modules.
383384
| [aws_caller_identity.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/caller_identity) | data source |
384385
| [aws_iam_policy_document.assume_role_policy](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
385386
| [aws_iam_policy_document.event_sources](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
387+
| [aws_iam_policy_document.logs](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
386388
| [aws_iam_policy_document.ssm](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/iam_policy_document) | data source |
387389
| [aws_partition.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/partition) | data source |
388390
| [aws_region.current](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/data-sources/region) | data source |

iam.tf

Lines changed: 32 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -18,14 +18,6 @@ resource "aws_iam_role" "lambda" {
1818
assume_role_policy = data.aws_iam_policy_document.assume_role_policy.json
1919
}
2020

21-
22-
resource "aws_iam_role_policy_attachment" "cloudwatch_logs" {
23-
count = var.cloudwatch_logs_enabled ? 1 : 0
24-
25-
policy_arn = "arn:${data.aws_partition.current.partition}:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
26-
role = aws_iam_role.lambda.name
27-
}
28-
2921
resource "aws_iam_role_policy_attachment" "vpc_attachment" {
3022
count = var.vpc_config == null ? 0 : 1
3123

@@ -75,3 +67,35 @@ resource "aws_iam_role_policy_attachment" "ssm" {
7567
policy_arn = aws_iam_policy.ssm[count.index].arn
7668
role = aws_iam_role.lambda.name
7769
}
70+
71+
data "aws_iam_policy_document" "logs" {
72+
count = var.cloudwatch_logs_enabled ? 1 : 0
73+
74+
statement {
75+
effect = "Allow"
76+
77+
actions = [
78+
"logs:CreateLogStream",
79+
"logs:PutLogEvents",
80+
]
81+
82+
resources = [
83+
"${aws_cloudwatch_log_group.lambda.arn}:*"
84+
]
85+
}
86+
}
87+
88+
resource "aws_iam_policy" "logs" {
89+
count = var.cloudwatch_logs_enabled ? 1 : 0
90+
91+
description = "Provides minimum CloudWatch Logs write permissions."
92+
name = "${var.function_name}-logs-${data.aws_region.current.name}"
93+
policy = data.aws_iam_policy_document.logs[count.index].json
94+
}
95+
96+
resource "aws_iam_role_policy_attachment" "logs" {
97+
count = var.cloudwatch_logs_enabled ? 1 : 0
98+
99+
policy_arn = aws_iam_policy.logs[count.index].arn
100+
role = aws_iam_role.lambda.name
101+
}

0 commit comments

Comments
 (0)