Skip to content

Lambda CloudWatch log group not created when used existing role of other lambda

0

I have a lambda lambdaA with execution role lambdaA-role-123 and its logs are getting created in CloudWatch group /aws/lambda/lambdaA Then, I created a new lambdaB but I have used the same existing execution lambdaA-role-123. After execution of lambdaB, I noticed that 1) CloudWatch group /aws/lambda/lambdaB was not created automatically and 2) logs of lambdaB were getting created in the CloudWatch log group /aws/lambda/lambdaA 3) I got 3 different errors on "Monitor" section of lambdaB indicating it could not create CloudWatch log group . Is this a expected a behaviour ?

When I asked 'Amazon Q' about this, I got a contradicting response "Based on the AWS documentation, CloudWatch will create a new log group for your Lambda function lb. Here's why: Default CloudWatch Log Group Behaviour: By default, AWS Lambda automatically creates a separate CloudWatch log group for each Lambda function when it's first invoked Your new Lambda lb will get its own log group: /aws/lambda/lambdaB" This sounds like a bug to me. Could you shed some light on this please ? Happy to provide more details about my lambdas if required.

2 Answers
0

Hello.

It is highly likely that the IAM policy set for the IAM role "lambdaA-role-123" is configured to create "/aws/lambda/lambdaA".
By default, Lambda uses a log group named "/aws/lambda/<function name>".
https://docs.aws.amazon.com/lambda/latest/dg/monitoring-cloudwatchlogs-loggroups.html

By default, CloudWatch automatically creates a log group named /aws/lambda/<function name> for your function when it's first invoked. To configure your function to send logs to an existing log group, or to create a new log group for your function, you can use the Lambda console or the AWS CLI. You can also configure custom log groups using the CreateFunction and UpdateFunctionConfiguration Lambda API commands and the AWS Serverless Application Model (AWS SAM) AWS::Serverless::Function resource.

When you create a Lambda function from the management console with default settings, the IAM policy will also be set accordingly. As a result, if you reuse the IAM role in other Lambda functions, you may encounter a problem where logs cannot be output.

In other words, it appears that the IAM role "lambdaA-role-123" has the following IAM policy configured, which restricts logs to being output only to "/aws/lambda/lambdaA".

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": "logs:CreateLogGroup",
            "Resource": "arn:aws:logs:your-region:AWS-Account-ID:*"
        },
        {
            "Effect": "Allow",
            "Action": [
                "logs:CreateLogStream",
                "logs:PutLogEvents"
            ],
            "Resource": [
                "arn:aws:logs:your-region:AWS-Account-ID:log-group:/aws/lambda/lambdaA:*"
            ]
        }
    ]
}

To resolve the issue, you need to either increase the number of log groups to output to using IAM policies, separate IAM roles and configure IAM policies to output to "/aws/lambda/lambdaB", or change the log group to output to in the Lambda settings.

and 2) logs of lambdaB were getting created in the CloudWatch log group /aws/lambda/lambdaA

By the way, regarding issue #2 that you encountered, I was unable to reproduce the same problem when I tried it on my AWS account.
Regarding issue #2, I believe this issue will not occur unless the log output destination has been changed in the Lambda function in question, and the IAM role used by the Lambda function has permission to access the target CloudWatch Logs log group.
To reproduce the problem, I think I would need to know the contents of your Lambda's IAM settings and log output settings.

EXPERT
answered 21 days ago
EXPERT
reviewed 21 days ago
  • Thanks for response.

    1. IAM role "lambdaA-role-123" indeed has the same IAM policy configured which you have mentioned in your reply. So I think easiest and quickest solution is to create a new and separate role "lambdaB-role-456" specifically for lambdaB OR I will have to explore other options that you have mentioned in your reply above.

    2. regarding issue #2 I can confirm once more time that logs of lambdaB are getting created in the CloudWatch log group /aws/lambda/lambdaA (I suppose as per the role "lambdaA-role-123") I have below on the "Configuration" tab of lambdaB, under "Monitoring and operation tools"

    Logging configuration Info Edit Log destination CloudWatch log group /aws/lambda/lambdaB Log content Log format Text

    I confirm that /aws/lambda/lambdaB was not created when the lambdaB was executed.

0

By design, AWS Lambda automatically creates a separate CloudWatch log group /aws/lambda/<function-name> for each function when it is first invoked, provided the execution role has the correct CloudWatch Logs permissions. If you reused the same execution role across multiple functions without properly scoping the IAM policy, logs may be written to the wrong group or fail to create. This is expected behavior if the IAM policy only grants access to one log group.

https://docs.aws.amazon.com/lambda/latest/dg/monitoring-cloudwatchlogs.html

https://repost.aws/knowledge-center/lambda-cloudwatch-log-streams-error

https://stackoverflow.com/questions/67842484/log-group-does-not-exist-error-when-using-aws-lambda

EXPERT
answered 21 days ago
EXPERT
reviewed 21 days ago
  • Thanks for response. I will explore above links will respond once I am ready.

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.