The AWS service called Chatbot allows CloudWatch Alarms to be relayed into a Slack channel. The message includes two buttons: Show logs and Show error logs.
However, when I press either of these buttons, I receive an error message like this:
❗️ I can't get the logs for you because the role arn:aws:iam::123412341234:role/my-chatbot in account 123412341234 is missing necessary permissions related to commands.
If you want to get logs, go to the AWS Chatbot console and choose or create a role that includes Read-only command permission for this channel.
However, the recommended way of accomplishing this (the way automatically set up by AWS Console) grants Chatbot the
ReadOnlyAccess policy which is way too permissive for my tastes. I don't want Chatbot to be able to read any object from any of our S3 buckets!
What is the minimal IAM policy that enables Chatbot to read CloudWatch Logs for Lambda functions?