Resource Policy for CloudWatch Logs with CloudFormation - Route53 query log

deploy_lambda.yaml

---
AWSTemplateFormatVersion: '2010-09-09'
Resources:
  LambdaExecutionRole:
    Type: "AWS::IAM::Role"
    Properties:
      RoleName: 'Enable-Role'
      Path: "/"     
      AssumeRolePolicyDocument:
        Version: '2012-10-17'
        Statement:
        - Effect: Allow
          Principal:
            Service: lambda.amazonaws.com
          Action: sts:AssumeRole      
  RolePolicies:
    Type: "AWS::IAM::ManagedPolicy"
    Properties:
      ManagedPolicyName: "LambdaExecutionRole-policy"
      Roles:
        - Ref: "LambdaExecutionRole"
      PolicyDocument:
        Version: "2012-10-17"
        Statement:       
        - Effect: Allow
          Action:
          - logs:CreateLogGroup
          - logs:CreateLogStream
          - logs:PutLogEvents
          - logs:PutResourcePolicy
          - logs:DeleteResourcePolicy
          Resource:
          - "*" 

  Lambda: 
    Type: "AWS::Lambda::Function"
    Properties: 
      Handler: "index.handler"
      Role: 
        Fn::GetAtt: 
          - "LambdaExecutionRole"
          - "Arn"
      Code: 
        ZipFile: |
          import json
          import cfnresponse
          import boto3
          from botocore.exceptions import ClientError

          client = boto3.client("logs")

          def PutPolicy(arn,policyname):
            response = client.put_resource_policy(
              policyName=policyname,
              policyDocument="{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"route53.amazonaws.com\"},\"Action\":[\"logs:CreateLogStream\",\"logs:PutLogEvents\"],\"Resource\":\""+ arn + "\"}]}",
            )
            return

          def DeletePolicy(policyname):
            response = client.delete_resource_policy(
              policyName=policyname
            )
            return

          def handler(event, context):

            CloudWatchLogsLogGroupArn = event['ResourceProperties']['CloudWatchLogsLogGroupArn']
            PolicyName = event['ResourceProperties']['PolicyName']
            responseData = {}
            try:
              if event['RequestType'] == "Delete":
                DeletePolicy(PolicyName)
              if event['RequestType'] == "Create":
                PutPolicy(CloudWatchLogsLogGroupArn,PolicyName)
              responseData['Data'] = "SUCCESS"
              status=cfnresponse.SUCCESS
            except ClientError as e:
              responseData['Data'] = "FAILED"
              status=cfnresponse.FAILED
              print("Unexpected error: %s" % e)
            cfnresponse.send(event, context, status, responseData, "CustomResourcePhysicalID")
      Runtime: "python3.6"

PutResourcePolicy.py

import json
import cfnresponse
import boto3
from botocore.exceptions import ClientError

client = boto3.client("logs")

def PutPolicy(arn,policyname):
	response = client.put_resource_policy(
	  policyName=policyname,
	  policyDocument="{\"Version\":\"2012-10-17\",\"Statement\":[{\"Effect\":\"Allow\",\"Principal\":{\"Service\":\"route53.amazonaws.com\"},\"Action\":[\"logs:CreateLogStream\",\"logs:PutLogEvents\"],\"Resource\":\""+ arn + "\"}]}",
	)
	return

def DeletePolicy(policyname):
	response = client.delete_resource_policy(
	  policyName=policyname
	)
	return

def handler(event, context):

	CloudWatchLogsLogGroupArn = event['ResourceProperties']['CloudWatchLogsLogGroupArn']
	PolicyName = event['ResourceProperties']['PolicyName']
	responseData = {}
	try:
		if event['RequestType'] == "Delete":
			DeletePolicy(PolicyName)
		if event['RequestType'] == "Create":
			PutPolicy(CloudWatchLogsLogGroupArn,PolicyName)
		responseData['Data'] = "SUCCESS"
		status=cfnresponse.SUCCESS
	except ClientError as e:
		responseData['Data'] = "FAILED"
		status=cfnresponse.FAILED
		print("Unexpected error: %s" % e)
	cfnresponse.send(event, context, status, responseData, "CustomResourcePhysicalID")

sample.yaml

---
AWSTemplateFormatVersion: '2010-09-09'
Resources:
  LogGroup: 
    Type: "AWS::Logs::LogGroup"
    Properties: 
      RetentionInDays: 7

  DNS:
    DependsOn: AddResourcePolicy
    Type: "AWS::Route53::HostedZone"
    Properties: 
      HostedZoneConfig: 
        Comment: "My hosted zone for example.com"
      Name: "google.com"
      QueryLoggingConfig:
        CloudWatchLogsLogGroupArn: !GetAtt LogGroup.Arn

  AddResourcePolicy:
    Type: Custom::AddResourcePolicy
    Version: '1.0'
    Properties:
      ServiceToken: arn:aws:lambda:us-east-1:8xxxxx965194:function:test-lambda-deploy-Lambda-15R963QKCI80A
      CloudWatchLogsLogGroupArn: !GetAtt LogGroup.Arn
      PolicyName: "testpolicy"

Hi, thanks! This is useful.

Do you have any tips for creating the policy to be passed to the custom resource? My use case is that I don't have access to create resources in higher environments for my application besides thru cloudformation, so I can't create the policy via the command line.

I tried creating the policy via Cloudformation, but it requires a Role, User, or Group to be specified during creation and may not allow specifying a principal in the policy (which in my case will be "es.amazonaws.com" since I am creating groups for publish elasticsearch logs).

Do you have any ideas on how I can accomplish this in cloudformation?

Edit: I guess it could be done with another custom resource, i will have to look into that.