1

The AWS service called Chatbot allows CloudWatch Alarms to be relayed into a Slack channel. The message includes two buttons: Show logs and Show error logs.

Slack message with attached buttons for Show logs and Show error logs

However, when I press either of these buttons, I receive an error message like this:

❗️ I can't get the logs for you because the role arn:aws:iam::123412341234:role/my-chatbot in account 123412341234 is missing necessary permissions related to commands.

If you want to get logs, go to the AWS Chatbot console and choose or create a role that includes Read-only command permission for this channel.

However, the recommended way of accomplishing this (the way automatically set up by AWS Console) grants Chatbot the ReadOnlyAccess policy which is way too permissive for my tastes. I don't want Chatbot to be able to read any object from any of our S3 buckets!

What is the minimal IAM policy that enables Chatbot to read CloudWatch Logs for Lambda functions?

  • You can check AWS Website for this – pioupiou Nov 25 at 7:43
  • @pioupiou I did not find the answer to my question on the AWS website. Could you provide a link? – Nic Nov 25 at 20:29
1

AWS Chatbot uses CloudWatch Logs Insights, so the IAM policy for Chatbot must include these two statements:

{
    "Sid": "QueryLogs",
    "Effect": "Allow",
    "Action": [
        "logs:StopQuery",
        "logs:StartQuery",
        "logs:DescribeQueries"
    ],
    "Resource": "arn:aws:logs:::log-group:/aws/lambda/*"
},
{
    "Sid": "GetQueryResults",
    "Effect": "Allow",
    "Action": "logs:GetQueryResults",
    "Resource": "*"
}

With these statements in place, pressing the logs button will yield an initial message from Chatbot like this:

I ran this CloudWatch Logs Insights query to fetch logs from 2020-11-18T09:02 UTC to 2020-11-18T09:07 UTC.

... as well as several follow-up messages containing a plaintext dump of the logs.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.