How do I restrict access to CloudWatch Logs for a specific user or AWS service?

Short description

To restrict access to your log groups, use identity-based AWS Identity and Access Management (IAM) policies for users and service-linked roles for AWS services.

Note: To configure IAM permissions, use the AWS Management Console. To manage CloudWatch Logs resource-based policies, use API operations.

Resolution

Apply IAM policy to grant minimum required permissions

The following IAM policy provides detailed access permissions for a specific log group that allows users to list, describe, view, and query log events.

Use the following IAM policy to grant minimum required permissions to users:

{
   "Version": "2012-10-17",
   "Statement": [
      {
         "Action": [
            "logs:Describe*",
            "logs:Get*",
            "logs:List*",
            "logs:StartQuery",
            "logs:StopQuery",
            "logs:TestMetricFilter",
            "logs:FilterLogEvents",
            "logs:StartLiveTail",
            "logs:StopLiveTail",
            "cloudwatch:GenerateQuery"
         ],
         "Effect": "Allow",
         "Resource": "arn:aws:logs:example-region:123456789012:log-group:example-log-group:*"
      },
      {
         "Effect": "Allow",
         "Action": "logs:DescribeLogGroups",
         "Resource": "*"
      }
   ]
} 

Note: Replace example-region with your AWS Region and example-log-group with the name of your log group.

If a user connects to CloudWatch through a VPC endpoint, then use an IAM policy to restrict their actions at the VPC endpoint.

Note: A message similar to the following example shows that the user doesn't have permissions to perform the action that the message specifies:

"(AccessDeniedException) when calling the PutLogEvents operation: User: arn:aws:sts::accountID:assumed-role/CWEC2Role/ec2-id is not authorized to perform: logs:PutLogEvents on resource: arn:aws:logs:us-east-1:accountID:log-group:test.log:log-stream:test because no VPC endpoint policy allows the action"

The following IAM policy allows users to perform read actions on only log groups and streams at the endpoint:

{
   "Statement": [
      {
         "Action": [
            "logs:Describe*",
            "logs:Get*",
            "logs:List*"
         ],
         "Effect": "Allow",
         "Principal": "*",
         "Resource": "*"
      }
   ]
} 

For more information on using VPC endpoints for CloudWatch, see Using CloudWatch Logs with interface VPC endpoints.

Note: To control more permissions, use the actions, resources and condition keys in your IAM policies.

Configure CloudWatch Logs access for AWS services

To grant AWS services the required permissions to interact with CloudWatch Logs, use service-linked roles. CloudWatch automatically creates service-linked roles when you set up a service with CloudWatch Logs with the necessary permissions.