logs: Support Resource policies

Reproduction Steps

const cloudWatchLogGroup = new logs.LogGroup(this, 'ElasticSearchLogGroup', {
  retention: logs.RetentionDays.THREE_MONTHS,
});

cloudWatchLogGroup.grantWrite(new iam.ServicePrincipal('es.amazonaws.com')).assertSuccess();

Also fails with the resource policy that I need.

const cloudWatchLogGroup = new logs.LogGroup(this, 'ElasticSearchLogGroup', {
  retention: logs.RetentionDays.THREE_MONTHS,
});

cloudWatchLogGroup
  .grant(
    new iam.ServicePrincipal('es.amazonaws.com'),
    'logs:PutLogEvents',
    'logs:PutLogEventsBatch',
    'logs:CreateLogStream'
  )
  .assertSuccess();

Error Log

Error: Permissions for 'ServicePrincipal(es.amazonaws.com)' to call 'logs:CreateLogStream,logs:PutLogEvents' on '${Token[TOKEN.507]}' could not be added on either identity or resource policy.

Error: Permissions for 'ServicePrincipal(es.amazonaws.com)' to call 'logs:PutLogEvents,logs:PutLogEventsBatch,logs:CreateLogStream' on '${Token[TOKEN.507]}' could not be added on either identity or resource policy.

Environment

• CLI Version :1.18.0
• Framework Version:1.18.0
• OS :macOS
• Language :TypeScript

Other

---

This is 🐛 Bug Report

[blimmer]

In case others run into this, I used the AwsCustomResource construct to help accomplish our goal here.

Here’s some code to hopefully help out if folks need to use this workaround in the meantime. Please note that this code is very specific to our use-case, so you’ll almost undoubtedly need to modify it to work for you.

// Cloudwatch logs have global resource policies that allow EventBridge to
// write logs to a given Cloudwatch Log group. That's currently not exposed
// via CloudFormation, so we use a Custom Resource here.
// See https://github.com/aws/aws-cdk/issues/5343
const policyName = '<fill in your unique policy name>'
new cr.AwsCustomResource(this, "CloudwatchLogResourcePolicy", {
  resourceType: "Custom::CloudwatchLogResourcePolicy",
  onUpdate: {
    service: "CloudWatchLogs",
    action: "putResourcePolicy",
    parameters: {
      policyName,
      // PolicyDocument must be provided as a string, so we can't use the iam.PolicyDocument provisions
      // or other CDK niceties here.
      policyDocument: JSON.stringify({
        Version: "2012-10-17",
        Statement: [
          {
            Sid: policyName,
            Effect: "Allow",
            Principal: {
              Service: ["delivery.logs.amazonaws.com", "events.amazonaws.com"],
            },
            Action: ["logs:CreateLogStream", "logs:PutLogEvents"],
            // I'd prefer to use cdk.Arn.format() here, but that creates Fn::Join's in the template,
            // which AwsCustomResource can't handle.
            Resource: '<fill in your arn here>',
          },
        ],
      }),
    },
    physicalResourceId: cr.PhysicalResourceId.of(policyName),
  },
  onDelete: {
    service: "CloudWatchLogs",
    action: "deleteResourcePolicy",
    parameters: {
      policyName,
    },
  },
  policy: cr.AwsCustomResourcePolicy.fromStatements([
    new iam.PolicyStatement({
      actions: ["logs:PutResourcePolicy", "logs:DeleteResourcePolicy"],
      // Resource Policies are global in Cloudwatch Logs per-region, per-account.
      resources: ["*"],
    }),
  ]),
});

[cmckni3]

^ @cmckni3 appreciate the suggestion, but I did try that and unfortunately Aws.PARTITION is a token and not resolvable in the context of this Aspect

Yeah make sense depending on how you synth.