add missing subscriber permissions

axiomhq · Apr 8, 2024 · 98ec1dd · 98ec1dd
1 parent 653f29f
commit 98ec1dd
Showing 1 changed file with 7 additions and 0 deletions.
diff --git a/cloudwatch-subscriber-axiom-cloudformation-stack.template.yaml b/cloudwatch-subscriber-axiom-cloudformation-stack.template.yaml
@@ -104,6 +104,12 @@ Resources:
               - logs:DescribeLogGroups
               - lambda:AddPermission
               - lambda:RemovePermission
+              - lambda:InvokeFunction
+              - lambda:GetFunction
+              - logs:DescribeLogStreams
+              - logs:DescribeSubscriptionFilters
+              - logs:FilterLogEvents
+              - logs:GetLogEvents
             Effect: Allow
             Resource: "*"
       PolicyName: cloudwatch-subscriber-axiom-policy
@@ -120,6 +126,7 @@ Resources:
             Principal:
               Service:
                 - lambda.amazonaws.com
+                - logs.amazonaws.com
       ManagedPolicyArns:
         - "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
   AxiomCloudWatchLogsSubscriber: