How to give a user access only to a specific group of cloudwatch logs

Question

Hello

I have created a user and I want to give him the permission to access only a specific group of cloudwatch logs.
For this, I have assigned the following strategy:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
	    "Effect": "Allow",
            "Action": [
                "logs:Describe*",
                "logs:Get*",
                "logs:List*",
                "logs:StartQuery",
                "logs:StopQuery",
                "logs:TestMetricFilter",
                "logs:FilterLogEvents"
            ],
            "Resource": "arn:aws:logs:::log-group:/ecs/copro*"
        }
    ]
}
```
When the user tries to access cloudwatch this is the error message he gets :

`User: arn:aws:iam:::user/poreck is not authorized to perform: logs:DescribeLogGroups on resource: arn:aws:logs:::log-group::log-stream: because no identity-based policy allows the logs:DescribeLogGroups action`

I understand that the action **logs:DescribeLogGroups** is not applicable to a specific resource. Because if in the strategy I replace the value of the **Resource **field with "*", the user has access to all the log groups and I don't want that.

My question is to know if there is a way to bypass this blocking by modifying the strategy. Or if there is a simple external solution that consists in retrieving these specific log groups.

Thanks for any help

Sincerely

Answer

The ARN for CloudWatch Log Groups follows this pattern:
`arn:aws:logs:us-east-1:123456789012:log-group:/loggroupname:*`

Note the last `:*`

That references each log stream. Please try modifying your policy as such:

```
{
    "Version": "2012-10-17",
    "Statement": [
        {
	    "Effect": "Allow",
            "Action": [
                "logs:Describe*",
                "logs:Get*",
                "logs:List*",
                "logs:StartQuery",
                "logs:StopQuery",
                "logs:TestMetricFilter",
                "logs:FilterLogEvents"
            ],
            "Resource": "arn:aws:logs:::log-group::*"
        }
    ]
}
```

How to give a user access only to a specific group of cloudwatch logs

Relevanter Inhalt