Creating an IAM policy to access CloudWatch Logs resources - Amazon Aurora

Creating an IAM policy to access CloudWatch Logs resources

Aurora can access CloudWatch Logs to export audit log data from an Aurora DB cluster. However, you must first create an IAM policy that provides the log group and log stream permissions that allow Aurora to access CloudWatch Logs.

The following policy adds the permissions required by Aurora to access Amazon CloudWatch Logs on your behalf, and the minimum required permissions to create log groups and export data.

{ "Version": "2012-10-17", "Statement": [ { "Sid": "EnableCreationAndManagementOfRDSCloudwatchLogEvents", "Effect": "Allow", "Action": [ "logs:GetLogEvents", "logs:PutLogEvents" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" }, { "Sid": "EnableCreationAndManagementOfRDSCloudwatchLogGroupsAndStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutRetentionPolicy", "logs:CreateLogGroup" ], "Resource": "arn:aws:logs:*:*:log-group:/aws/rds/*" } ] }

You can modify the ARNs in the policy to restrict access to a specific AWS Region and account.

You can use the following steps to create an IAM policy that provides the minimum required permissions for Aurora to access CloudWatch Logs on your behalf. To allow Aurora full access to CloudWatch Logs, you can skip these steps and use the CloudWatchLogsFullAccess predefined IAM policy instead of creating your own. For more information, see Using identity-based policies (IAM policies) for CloudWatch Logs in the Amazon CloudWatch User Guide.

To create an IAM policy to grant access to your CloudWatch Logs resources
  1. Open the IAM console.

  2. In the navigation pane, choose Policies.

  3. Choose Create policy.

  4. On the Visual editor tab, choose Choose a service, and then choose CloudWatch Logs.

  5. For Actions, choose Expand all (on the right), and then choose the Amazon CloudWatch Logs permissions needed for the IAM policy.

    Ensure that the following permissions are selected:

    • CreateLogGroup

    • CreateLogStream

    • DescribeLogStreams

    • GetLogEvents

    • PutLogEvents

    • PutRetentionPolicy

  6. Choose Resources and choose Add ARN for log-group.

  7. In the Add ARN(s) dialog box, enter the following values:

    • Region – An AWS Region or *

    • Account – An account number or *

    • Log Group Name/aws/rds/*

  8. In the Add ARN(s) dialog box, choose Add.

  9. Choose Add ARN for log-stream.

  10. In the Add ARN(s) dialog box, enter the following values:

    • Region – An AWS Region or *

    • Account – An account number or *

    • Log Group Name/aws/rds/*

    • Log Stream Name*

  11. In the Add ARN(s) dialog box, choose Add.

  12. Choose Review policy.

  13. Set Name to a name for your IAM policy, for example AmazonRDSCloudWatchLogs. You use this name when you create an IAM role to associate with your Aurora DB cluster. You can also add an optional Description value.

  14. Choose Create policy.

  15. Complete the steps in Creating an IAM role to allow Amazon Aurora to access AWS services.