How to define Resource Policy for CloudWatch Logs with CloudFormation?

Question

When I configure DNS Query Logging with Route53, I can create a resource policy for Route53 to log to my log group. I can confirm this policy with the cli aws logs describe-resource-policies and see something like:

{
  "resourcePolicies": [
    {
        "policyName": "test-logging-policy", 
        "policyDocument": "{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"route53.amazonaws.com\"},\"Action\":[\"logs:CreateLogStream\",\"logs:PutLogEvents\"],\"Resource\":\"arn:aws:logs:us-east-1:xxxxxx:log-group:test-route53*\"}]}", 
        "lastUpdatedTime": 1520865407511
    }
  ]
}

The cli also has a put-resource-policy to create one of these. I also see that Terraform has a resource aws_cloudwatch_log_resource_policy which does the same.

So the question: How do I do this with CloudFormation???

Answer 1

You can't use the CloudWatch console to create or edit a resource policy. You must use the CloudWatch API, one of the AWS SDKs, or the AWS CLI.

There is no Cloudformation support for creating a resource policy right now, but you create a custom lambda resource to do this.

https://gist.github.com/sudharsans/cf9c52d7c78a81818a4a47872982bd76

CloudFormation Custom resource:

  AddResourcePolicy:
    Type: Custom::AddResourcePolicy
    Version: '1.0'
    Properties:
      ServiceToken: arn:aws:lambda:us-east-1:872673965194:function:test-lambda-deploy-Lambda-15R963QKCI80A
      CloudWatchLogsLogGroupArn: !GetAtt LogGroup.Arn
      PolicyName: "testpolicy"

lambda:

import cfnresponse
import boto3
def PutPolicy(arn,policyname):
    response = client.put_resource_policy(
      policyName=policyname,
      policyDocument="....",
    )
    return

def handler(event, context):
    ......
        if event['RequestType'] == "Delete":
            DeletePolicy(PolicyName)
        if event['RequestType'] == "Create":
            PutPolicy(CloudWatchLogsLogGroupArn,PolicyName)
        responseData['Data'] = "SUCCESS"
        status=cfnresponse.SUCCESS
     .....

Answer 2

4 years later, this still doesn't seem to work through Cloudformation although there is apparently support for this included now