Amazon Aurora
User Guide for Aurora (API Version 2014-10-31)

Creating an IAM Policy to Access CloudWatch Logs Resources

Aurora can access CloudWatch Logs to export audit log data from an Aurora DB cluster. However, you must first create an IAM policy that provides the log group and log stream permissions that allow Aurora to access CloudWatch Logs.

The following policy adds the permissions required by Aurora to access Amazon CloudWatch Logs on your behalf, and the minimum required permissions to create log groups and export data.

{ "Version": "2012-10-17", "Statement": [ { "Sid": "EnableCreationAndManagementOfRDSCloudwatchLogGroups", "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:PutRetentionPolicy" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*" ] }, { "Sid": "EnableCreationAndManagementOfRDSCloudwatchLogStreams", "Effect": "Allow", "Action": [ "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:GetLogEvents" ], "Resource": [ "arn:aws:logs:*:*:log-group:/aws/rds/*:log-stream:*" ] } ] }

You can use the following steps to create an IAM policy that provides the minimum required permissions for Aurora to access CloudWatch Logs on your behalf. To allow Aurora full access to CloudWatch Logs, you can skip these steps and use the CloudWatchLogsFullAccess predefined IAM policy instead of creating your own. For more information, see Using Identity-Based Policies (IAM Policies) for CloudWatch Logs in the Amazon CloudWatch User Guide.

To create an IAM policy to grant access to your CloudWatch Logs resources

  1. Open the IAM console.

  2. In the navigation pane, choose Policies.

  3. Choose Create policy.

  4. On the Visual editor tab, choose Choose a service, and then choose CloudWatch Logs.

  5. Choose Expand all under Actions and then choose the Amazon CloudWatch Logs permissions needed for the IAM policy.

    Ensure that the following permissions are selected:

    • CreateLogGroup

    • CreateLogStream

    • DescribeLogStreams

    • GetLogEvents

    • PutLogEvents

    • PutRetentionPolicy

  6. Choose Resources and choose Add ARN for log-group.

  7. In the Add ARN(s) dialog box, enter log-group:/aws/rds/* for Log Group Name, and choose Add.

  8. Choose Add ARN for log-stream.

  9. In the Add ARN(s) dialog box, enter the following values:

    • Log Group Namelog-group:/aws/rds/*

    • Log Streamlog-stream

    • Log Stream Name*

  10. In the Add ARN(s) dialog box, choose Add

  11. Choose Review policy.

  12. Set Name to a name for your IAM policy, for example AmazonRDSCloudWatchLogs. You use this name when you create an IAM role to associate with your Aurora DB cluster. You can also add an optional Description value.

  13. Choose Create policy.

  14. Complete the steps in Creating an IAM Role to Allow Amazon Aurora to Access AWS Services.