aws-samples / aws-samples/sample-kickstart-migration
get_apps_role definition in kickstart_stack.py specifies a Log Group prefix in the permissions that does not match the Lambda configuration
- Dominant language
- TypeScript
- Stars
- 3
- Forks
- 0
- PR merge metrics
- No merged PRs in 30d
Description
The get_apps_role definition in the kickstart_stack.py specifies a certain Log Group prefix. However the Lambda function wants to write to a different Log Group based on the name of the function created by the stack. This causes the lambda function logs to not be captured even though executions were visible in the monitoring console. Once the permissions were corrected the Lambda function was able to write logs to the appropriate Log Group.
```
get_apps_role.add_to_policy(iam.PolicyStatement(
effect=iam.Effect.ALLOW,
resources=[
f"arn:aws:logs:{Aws.REGION}:{Aws.ACCOUNT_ID}:log-group:/aws/lambda/get_apps*" <--------
],
actions=[
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
]
))
# Function: Fetch app data from DynamoDB
get_apps_function = _lambda.Function(self, f"get_apps",
runtime=_lambda.Runtime.PYTHON_3_13,
handler="main.handler",
code=_lambda.Code.from_asset("lambda/get_apps"),
role=get_apps_role,
environment={
"TABLE_NAME": kickstart_table_name,
"ALLOWED_CORS_ORIGINS": f'["https://{kickstart_distribution_url}"]',
"ALLOWED_CORS_METHODS": '["GET"]'
}
)
kickstart_table.grant_read_data(get_apps_function)
```
Contributor guide
Assessment
This issue has not been assessed yet.