logs: Support Resource policies

[cmckni3]

Reproduction Steps

const cloudWatchLogGroup = new logs.LogGroup(this, 'ElasticSearchLogGroup', {
  retention: logs.RetentionDays.THREE_MONTHS,
});

cloudWatchLogGroup.grantWrite(new iam.ServicePrincipal('es.amazonaws.com')).assertSuccess();

Also fails with the resource policy that I need.

const cloudWatchLogGroup = new logs.LogGroup(this, 'ElasticSearchLogGroup', {
  retention: logs.RetentionDays.THREE_MONTHS,
});

cloudWatchLogGroup
  .grant(
    new iam.ServicePrincipal('es.amazonaws.com'),
    'logs:PutLogEvents',
    'logs:PutLogEventsBatch',
    'logs:CreateLogStream'
  )
  .assertSuccess();

Error Log

Error: Permissions for 'ServicePrincipal(es.amazonaws.com)' to call 'logs:CreateLogStream,logs:PutLogEvents' on '${Token[TOKEN.507]}' could not be added on either identity or resource policy.

Error: Permissions for 'ServicePrincipal(es.amazonaws.com)' to call 'logs:PutLogEvents,logs:PutLogEventsBatch,logs:CreateLogStream' on '${Token[TOKEN.507]}' could not be added on either identity or resource policy.

Environment

• CLI Version :1.18.0
• Framework Version:1.18.0
• OS :macOS
• Language :TypeScript

Other

---

This is 🐛 Bug Report

[cmckni3]

maybe LogGroup is missing addToResourcePolicy (IResourceWithPolicy)?

[rix0rrr]

Correct, but as far as I know CloudWatch Log Groups don't have resource policies?

[rix0rrr]

So what seems to be the case is that CloudWatch supports account-wide log policies, but CloudFormation doesn't support creating them.

These log policies seem to apply to all log groups at the same time though, not individual ones. Marking this as a "needs cfn" feature request.

[cmckni3]

Correct, I was trying to create a policy for ES to attach a log group to ES domain.

https://docs.aws.amazon.com/elasticsearch-service/latest/developerguide/es-createupdatedomains.html

https://docs.aws.amazon.com/AmazonCloudWatchLogs/latest/APIReference/API_PutResourcePolicy.html

[rix0rrr]

Your workaround for any feature that is not supported by CFN will be "custom resource".