Issue with EventBridge Rule Triggering SSM Document

Have you thought about using lambda than SSM document?

import boto3
import json
import os

# Default retention period in days (e.g., 14 days)
DEFAULT_RETENTION_DAYS = int(os.getenv("RETENTION_DAYS", 14))

def lambda_handler(event, context):
    logs_client = boto3.client('logs')

    # Extract log group name from the event
    log_group_name = event['detail']['requestParameters']['logGroupName']

    try:
        # Set the retention policy
        logs_client.put_retention_policy(
            logGroupName=log_group_name,
            retentionInDays=DEFAULT_RETENTION_DAYS
        )
        print(f"Retention policy set to {DEFAULT_RETENTION_DAYS} days for log group: {log_group_name}")
    except Exception as e:
        print(f"Error setting retention policy for {log_group_name}: {str(e)}")

Environment Variables You can set an environment variable RETENTION_DAYS for the Lambda function to control the retention period dynamically.

Permissions for the Lambda Function Attach the following IAM permissions to the Lambda function's execution role:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:PutRetentionPolicy"
      ],
      "Resource": "*"
    }
  ]
}

Enable CloudTrail Logging (if Not Already Enabled)

Ensure that CloudTrail is enabled and configured to log CreateLogGroup API events.

Go to the CloudTrail console. Ensure you have a trail enabled that logs Management events. Verify that the Event read/write type is set to Write-only or All.