AWS Event Bus fails to write logs to CloudWatch on a custom log group from AWS Lambda

Question

I have an AWS lambda whose job it is to consume logs from an external source and write these logs to a custom CloudWatch log group. Please note that this lambda is already writing logs to its own log group, that's not my question. What I want is for it to write the externally-derived logs to another CloudWatch group.

Following the AWS documentation, and using CloudFormation, I created an event bus and a rule that targets CloudWatch:

redacted

I have omitted most of the CloudFormation template for clarity, just leaving in the parts that seem relevant.

What I am finding is that the Lambda receives the logs (via Kinesis), processes them and sends them to the event bus in the code snippet below:

redacted

The last line above indicates that the event is sent to the event bus:

redacted

However the Event Bus, having i believe, received the event, does not send the event off to CloudWatch. Even if i manually create the log group: ${AWS::StackName}-form-log-batch-function (I have kept the stack reference as a parameter to preserve anonymity).

I have checked the CloudFormation creation and all resources are present (confirmed by the Lambda not experiencing any exceptions, when it tries to send the event).

Anyone understand what I am missing here?

Answer 1

You can't write to CloudWatch Logs (CWL) using your WebLogsEventBusLoggingRole role. As AWS docs explain, you have to use CWL resource-based permissions:

When CloudWatch Logs is the target of a rule, EventBridge creates log streams, and CloudWatch Logs stores the text from the triggering events as log entries. To allow EventBridge to create the log stream and log the events, CloudWatch Logs must include a resource-based policy that enables EventBridge to write to CloudWatch Logs.

Sadly, you can't setup such permissions from vanila CloudFormation (CFN). This is not supported:

• AWS::Events::Rule targetting Cloudwatch logs

To do it from CFN, you have to create custom resource in a form of a lambda function. The function would set CWL permissions using AWS SDK.