MSK Connectors are not getting deleted because of disable logs permission.

Question

Connector state information

Code: InvalidInput.WorkerLogsError

```
Message: Could not enable/disable worker logs. For more information, see the Amazon MSK Connect Developer Guide. Message: User: arn:aws:sts::**:assumed-role/a@b.com/a@b.com is not authorized to perform: logs:DeleteLogDelivery because no identity-based policy allows the logs:DeleteLogDelivery action.
```

what does the above error exactly say, and what kind of permission it's expecting ?

on deleting the connector the DELETE operation fails and gives the below error

```
Failed to delete connector connector1. Check your connector configuration and try again.
```

Answer

Hello there,

As you may know **logs:DeleteLogDelivery** indicates that it "Grants permission to delete the log delivery information for specified log delivery.".

The user who wants to create or delete the MSK Connector, must be having the required permissions which are mentioned in the below document[1]. In those actions, logs:DeleteLogDelivery is one of them. It seems that your User/IAM role missing this action. Please verify it at your end and add the actions which are missing.

[1] https://docs.aws.amazon.com/msk/latest/developerguide/mkc-iam-policy-examples.html

If you are still facing the issue, please reach back to us over a support case.

MSK Connectors are not getting deleted because of disable logs permission.

Relevant content