Execution role for Kinesis consumer

execution-role.json

{
  "roleName": "LogsConsumerRole",
  "policies": [
    {
      "document": {
        "Version": "2012-10-17",
        "Statement": [
          {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
              "kinesis:GetShardIterator",
              "kinesis:GetRecords",
              "kinesis:DescribeStream"
            ],
            "Resource": "arn:aws:kinesis:AWS_REGION:ACCOUNT_ID:stream/cloudwatch-logs"
          },
          {
            "Sid": "VisualEditor1",
            "Effect": "Allow",
            "Action": "kinesis:ListStreams",
            "Resource": "*"
          }
        ]
      },
      "name": "ReadLogsStream",
      "id": "ANPAIEWKJFLJDV43GIICM",
      "type": "managed",
      "arn": "arn:aws:iam::ACCOUNT_ID:policy/ReadLogsStream"
    }
  ],
  "trustedEntities": [
    "lambda.amazonaws.com"
  ]
}