Lambda logging to CloudWatch seems to be broken?

0

For some reason, one of my Lambda's logs are no longer appearing on CloudWatch. I see output from a Test run in the Lambda's screen but the CloudWatch list of logs is persistently empty.

After some flailing around, I decided to try creating a new Lambda with the same code and configuration. Test ran. But when I hit "Click here to view the corresponding CloudWatch log group.", It opened CloudWatch looking at the expected log group name -- with a big red warning that this group did not exist. Clicking "(Logs)" at the top of the test output gave the same behavior. This is surprising; I thought I remembered that creating a Lambda created its log groups automagically...?

I tried creating the group manually, but now I'm back where I was -- the lambda runs, I get local log output, but the CloudWatch Log Group for my lambda still shows no Log Streams. I checked the CloudWatch configuration, and it does list both the old and new Lambda's ARNs as being allowed to create and write to log streams...

My oldest lambda (the one my Alexa skill uses directly) is still apparently writing to CloudWatch successfully.

I am very confused. I'm a relatively new user, and I'm willing to believe this is user error -- but I have no idea what that error might be. Any advice folks can offer on fixing this would be tremendously appreciated, especially since my Skill just went live and the failing lambda is the one that is triggered by an EventBridge cron job to update the database in the background. It does seem to be running OK for now -- but I need logs if I'm ever going to have to debug it again, and I need to understand why a new copy of that Lambda is having the same problem.

Programmer's mantra: "If it was easy, they wouldn't need us..."

asked 2 years ago3280 views
2 Answers
1
Accepted Answer

Looks like this was indeed self-inflicted. When I went to the IAM role, I discovered that logging was authorized only for a specific ARN. Checking the "authorize for all in this group" button resulted in my starting to get logs again.

I don't remember when I would have changed that, but.... Whew.

answered 2 years ago
0

Please check if your Lambda function's execution Role has permissions to write logs to CloudWatch. You can use the AWS managed policy AWSLambdaBasicExecutionRole or if you are creating the IAM role/policy manually (and follow least privilege), refer to this document: https://docs.aws.amazon.com/lambda/latest/operatorguide/access-logs.html

profile picture
joahna
answered 2 years ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions