aws-samples / aws-samples/sample-kickstart-migration

get_apps_role definition in kickstart_stack.py specifies a Log Group prefix in the permissions that does not match the Lambda configuration

Open
#43 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
TypeScript
Stars
3
Forks
0
PR merge metrics
No merged PRs in 30d

Description

The get_apps_role definition in the kickstart_stack.py specifies a certain Log Group prefix. However the Lambda function wants to write to a different Log Group based on the name of the function created by the stack. This causes the lambda function logs to not be captured even though executions were visible in the monitoring console. Once the permissions were corrected the Lambda function was able to write logs to the appropriate Log Group.

```
get_apps_role.add_to_policy(iam.PolicyStatement(
effect=iam.Effect.ALLOW,
resources=[
f"arn:aws:logs:{Aws.REGION}:{Aws.ACCOUNT_ID}:log-group:/aws/lambda/get_apps*" <--------
],
actions=[
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
]
))

# Function: Fetch app data from DynamoDB
get_apps_function = _lambda.Function(self, f"get_apps",
runtime=_lambda.Runtime.PYTHON_3_13,
handler="main.handler",
code=_lambda.Code.from_asset("lambda/get_apps"),
role=get_apps_role,
environment={
"TABLE_NAME": kickstart_table_name,
"ALLOWED_CORS_ORIGINS": f'["https://{kickstart_distribution_url}"]',
"ALLOWED_CORS_METHODS": '["GET"]'
}
)
kickstart_table.grant_read_data(get_apps_function)
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.