EventBridge Rule for Logging to CloudWatch Logs

gistfile1.txt

AWSTemplateFormatVersion: '2010-09-09'
Transform: AWS::Serverless-2016-10-31
Description: EventBridge Rule Test

Resources:
  CFNLogGroup:
    Type: AWS::Logs::LogGroup
    Properties:
      RetentionInDays: 3
      LogGroupName: '/aws/events/eventbridgeLog'

  MyALLRule:
    Type: AWS::Events::Rule
    Properties: 
      Description: Collects everything
      EventPattern:
        account: 
        - "123412341234"
      RoleArn: !GetAtt EBAllRole.Arn
      Targets:
        - Id: 'CloudwatchLogsTarget'
          Arn: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:${CFNLogGroup}"
          
  EBAllRole:
    Type: "AWS::IAM::Role"
    Properties: 
      AssumeRolePolicyDocument:
        Version: "2012-10-17"
        Statement:
          - 
            Effect: "Allow"
            Principal:
              Service: "events.amazonaws.com" 
            Action: 
              - "sts:AssumeRole"
      Policies: 
        - PolicyName: AllowAllEventsToBeLogged
          PolicyDocument:
            Version: '2012-10-17'
            Statement:
              Effect: Allow
              Action:
              - logs:CreateLogStream
              - logs:PutLogEvents
              Resource: '*'

Hi all, I am trying to do the same as @RawQD -- recreate this setup in terraform -- I tried setting the RoleArn on the terraform rule rather than the target also, after getting a similar error -- no joy :-/

Any suggestions would be gratefully appreciated.

Hi @jbesw! I'm trying to do this with a Rule with a specific EventBusName, but it doesn't seem to be working (no log streams created, no logs).

Is there something different about how custom buses work that affects log delivery? Is the custom bus the reason you're using an AWS::Logs::ResourcePolicy here instead of this Role-based permission ☝️ ?