Menu
Amazon CloudWatch Logs
User Guide

Modifying Destination Membership at Runtime

You might encounter situations where you have to add or remove membership of some users from a destination that you own. You can use the PutDestinationPolicy action on your destination with new access policy. In the following example, a previously added account 234567890123 is stopped from sending any more log data, and account 345678901234 is enabled.

  1. Fetch the policy that is currently associated with the destination testDestination and make a note of the AccessPolicy:

    aws logs describe-destinations \
        --destination-name-prefix "testDestination"
    
    {
     "Destinations": [
       {
         "DestinationName": "testDestination",
         "RoleArn": "arn:aws:iam::123456789012:role/CWLtoKinesisRole",
         "DestinationArn": "arn:aws:logs:us-east-1:123456789012:destination:testDestination",
         "TargetArn": "arn:aws:kinesis:us-east-1:123456789012:stream/RootAccess",
         "AccessPolicy": "{\"Version\": \"2012-10-17\", \"Statement\": [{\"Sid\": \"\", \"Effect\": \"Allow\", \"Principal\": {\"AWS\": \"234567890123\"}, \"Action\": \"logs:PutSubscriptionFilter\", \"Resource\": \"arn:aws:logs:us-east-1:123456789012:destination:testDestination\"}] }"
       }
     ]
    }
  2. Update the policy to reflect that account 234567890123 is stopped, and that account 345678901234 is enabled. Put this policy in the ~/NewAccessPolicy.json file:

    {
      "Version" : "2012-10-17",
      "Statement" : [
        {
          "Sid" : "",
          "Effect" : "Allow",
          "Principal" : {
            "AWS" : "345678901234"
          },
          "Action" : "logs:PutSubscriptionFilter",
          "Resource" : "arn:aws:logs:us-east-1:123456789012:destination:testDestination"
        }
      ]
    }
  3. Call PutDestinationPolicy to associate the policy defined in the NewAccessPolicy.json file with the destination:

    aws logs put-destination-policy \
    --destination-name "testDestination" \
    --access-policy file://~/NewAccessPolicy.json

    This will eventually disable the log events from account ID 234567890123. Log events from account ID 345678901234 start flowing to the destination as soon as the owner of account 345678901234 creates a subscription filter using PutSubscriptionFilter.