What minimal IAM permissions are needed by AWS Chatbot so that it can show logs?

Question

The AWS service called Chatbot allows CloudWatch Alarms to be relayed into a Slack channel. The message includes two buttons: Show logs and Show error logs.

However, when I press either of these buttons, I receive an error message like this:

❗️ I can't get the logs for you because the role arn:aws:iam::123412341234:role/my-chatbot in account 123412341234 is missing necessary permissions related to commands.

If you want to get logs, go to the AWS Chatbot console and choose or create a role that includes Read-only command permission for this channel.

However, the recommended way of accomplishing this (the way automatically set up by AWS Console) grants Chatbot the ReadOnlyAccess policy which is way too permissive for my tastes. I don't want Chatbot to be able to read any object from any of our S3 buckets!

What is the minimal IAM policy that enables Chatbot to read CloudWatch Logs for Lambda functions?

Answer 1

AWS Chatbot uses CloudWatch Logs Insights, so the IAM policy for Chatbot must include these two statements:

{
    "Sid": "QueryLogs",
    "Effect": "Allow",
    "Action": [
        "logs:StopQuery",
        "logs:StartQuery",
        "logs:DescribeQueries"
    ],
    "Resource": "arn:aws:logs:::log-group:/aws/lambda/*"
},
{
    "Sid": "GetQueryResults",
    "Effect": "Allow",
    "Action": "logs:GetQueryResults",
    "Resource": "*"
}

With these statements in place, pressing the logs button will yield an initial message from Chatbot like this:

I ran this CloudWatch Logs Insights query to fetch logs from 2020-11-18T09:02 UTC to 2020-11-18T09:07 UTC.

... as well as several follow-up messages containing a plaintext dump of the logs.

Answer 2

I solved this issue with these IAM permissions,

{
    "Sid": "query",
    "Effect": "Allow",
    "Action": [
        "logs:StopQuery",
        "logs:StartQuery"
    ],
    "Resource": "arn:aws:logs:us-east-1:*:log-group:/aws/lambda/my-lambda-function-name*:*"
},
{
    "Sid": "logstream",
    "Effect": "Allow",
    "Action": [
        "logs:GetQueryResults",
        "logs:DescribeLogGroups"
    ],
    "Resource": "arn:aws:logs:us-east-1:*:log-group::log-stream:*"
}

(you need to change the region us-east-1 and my-lambda-function-name to your lambda function name)

Answer 3

Just add the managed policy CloudWatchReadOnlyAccess as proposed in the documentation.