Logging permission for Lambda@Edge restricted to us-east-1

[ofhouse]

Hi, while playing around with Lambda@Edge I noticed that the deployed Lambdas were not logging anything to CloudWatch.

So I looked into the created cloudwatch policy and noticed that the log creation is currently restricted to the region where the lambda is deployed to:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Action": [
        "logs:PutLogEvents",
        "logs:CreateLogStream"
      ],
      "Resource": [
        "arn:aws:logs:us-east-1:123456789001:log-group:/aws/lambda/us-east-1.lambda-edge-test:*:*:*",
        "arn:aws:logs:us-east-1:123456789001:log-group:/aws/lambda/us-east-1.lambda-edge-test:*:*"
      ]
    }
  ]
}

While this is reasonable for normal Lambdas, Lambda@Edge uses the CloudWatch region which is closest to it's execution runtime so I think it would be better to drop the region from the resource when using Lambda@Edge:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "",
      "Effect": "Allow",
      "Action": [
        "logs:PutLogEvents",
        "logs:CreateLogStream"
      ],
      "Resource": [
        "arn:aws:logs:*:123456789001:log-group:/aws/lambda/us-east-1.lambda-edge-test:*:*:*",
        "arn:aws:logs:*:123456789001:log-group:/aws/lambda/us-east-1.lambda-edge-test:*:*"
      ]
    }
  ]
}

Don't know if there is a better solution for changing the region in an ARN, I added this code in iam.tf to change the arn scope:

+ data "aws_arn" "log_group_arn" {
+  arn = local.log_group_arn
+ }

+ locals {
+  log_group_arn_region = var.lambda_at_edge ? "arn:${data.aws_arn.log_group_arn.partition}:${data.aws_arn.log_group_arn.service}:*:${data.aws_arn.log_group_arn.account}:${data.aws_arn.log_group_arn.resource}" : local.log_group_arn
+ }

data "aws_iam_policy_document" "logs" {
  count = local.create_role && var.attach_cloudwatch_logs_policy ? 1 : 0

  statement {
    effect = "Allow"

    actions = [
      "logs:CreateLogStream",
      "logs:PutLogEvents",
    ]
-   resources = flatten([for _, v in ["%v:*", "%v:*:*"] : format(v, local.log_group_arn)])
+   resources = flatten([for _, v in ["%v:*", "%v:*:*"] : format(v, local.log_group_arn_region)])
  }
}

[antonbabenko]

Lambda@Edge is special kind of Lambda function, which is required to be deployed in us-east-1 along with the log groups.

Do you say that it doesn't log there?

[ofhouse]

Yeah it is deployed in us-east-1 but it actually logs to the region where it's executed.

Let's say the viewer-request comes from Frankfurt, Germany:
The lambda is then executed in eu-central-1 (Frankfurt) and the logs for that execution are also written to the CloudWatch in eu-central-1.

It's a bit complicated because that means to give terraform control over all log groups it have to create log groups in all regions. (https://advancedweb.hu/how-to-manage-lambda-log-groups-with-terraform/#lambdaedge)

[antonbabenko]

Now I see what you mean. I will try to take a look at this issue later this week. Maybe you can open a pull-request?

[ofhouse]

Sure, no problem. Opened #35

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.