はじめに
個人の検証環境として使ってる AWS アカウントに AWS Health から「AWS CLOUDWATCH PLANNED LIFECYCLE EVENT」という AWS Health Event が来ていた．簡単に言うと「2027年4月26日から Amazon CloudWatch Logs の IAM ポリシーの評価方法が変わるから事前に対応よろしく！」という内容だった．
Starting April 26, 2027, IAM statements that authorize Log Group actions must use a Log Group ARN. Today, a Log Stream ARN also grants these Log Group-level actions - after this change, it will not.
今までは arn:aws:logs:ap-northeast-1:000000000000:log-group:xxxxx:* のように末尾に :* が付いたログストリーム形式の ARN を指定すればロググループに対するアクションも許可できていた．実際に AWS の API Reference でも :* を付けるようなアナウンスがあって該当するチームも多そう．今後はロググループに対するアクションには :* が付かないロググループ形式の ARN を指定する必要がある．
arn:aws:logs:<region>:<account-id>:log-group:<log-group-name>（ロググループ形式）arn:aws:logs:<region>:<account-id>:log-group:<log-group-name>:*（ログストリーム形式）
修正方法
AWS Health Event を読むと，以下の4つのアクションは今後もログストリーム形式の ARN で評価されると書いてあった．変更なし✅️
logs:PutLogEventslogs:GetLogEventslogs:CreateLogStreamlogs:DeleteLogStream
Four actions remain scoped to Log Streams and still require a Log Stream ARN: PutLogEvents, GetLogEvents, CreateLogStream, and DeleteLogStream.
よって，影響があるのは「ロググループに対するそれ以外のアクション」になる🔥たとえば以下など．
logs:CreateLogGrouplogs:DeleteLogGrouplogs:DescribeLogStreamslogs:PutRetentionPolicy
修正方法としては，既存のステートメントはそのまま残しつつ「ロググループ形式の ARN を指定したステートメントを追加する」ことになる．
Keep the existing Log Stream ARN statement in place. It's still needed for the four Log Stream actions and ensures uninterrupted access as this change rolls out region by region.
CloudWatch Logs IAM Policy Validator
影響のある IAM ポリシーを確認するためのツール「CloudWatch Logs IAM Policy Validator」も aws-samples に公開されている❗️今回の仕様変更に影響のある IAM ポリシーを洗い出すコマンドと IAM ポリシーの評価結果をシミュレートする Python スクリプトがある．今回使ってみた ＼( 'ω')／
検証で使う IAM Role
検証をするために Terraform で Amazon ECS タスクロールを想定した IAM Role を作る．Amazon CloudWatch Logs ロググループとログストリームに対するアクションを混ぜて :* 付きの ARN で許可をするインラインポリシーにしておく．
data "aws_caller_identity" "current" {} data "aws_iam_policy_document" "sandbox_assume_role" { statement { actions = [ "sts:AssumeRole", ] principals { type = "Service" identifiers = [ "ecs-tasks.amazonaws.com", ] } } } data "aws_iam_policy_document" "sandbox" { statement { actions = [ "logs:CreateLogGroup", "logs:PutRetentionPolicy", "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:PutLogEvents", ] resources = [ "arn:aws:logs:ap-northeast-1:${data.aws_caller_identity.current.account_id}:log-group:sandbox-log-group:*", ] } } resource "aws_iam_role" "sandbox" { name = "sandbox-role" assume_role_policy = data.aws_iam_policy_document.sandbox_assume_role.json } resource "aws_iam_role_policy" "sandbox" { name = "sandbox-policy" role = aws_iam_role.sandbox.id policy = data.aws_iam_policy_document.sandbox.json }
影響のある IAM ポリシーを洗い出す
まずは LIST_IMPACTED_POLICIES.md に載っているコマンドを実行する．aws iam get-account-authorization-details コマンドの結果を jq コマンド（複雑すぎるｗ）で処理して，:* や :log-stream: が含まれる ARN を指定しているカスタマー管理ポリシー・インラインポリシーを一覧できる．
実行結果は一部抜粋したけど，今回の検証で作った IAM Role sandbox-role のインラインポリシーはちゃんと検出されていた👌他にも AWS Lambda イベント関数の service-role や AWS CodeBuild の service-role でも検出されていた．
$ aws iam get-account-authorization-details \ --filter LocalManagedPolicy Role User Group \ --output json | jq -r ' def arr: if type=="array" then . else [.] end; def old: test("^arn:aws[a-z0-9-]*:logs:[^:]*:[^:]*:log-group:.*(:\\*$|:log-stream:)"); # Scan one policy document, emitting indented "<Effect>\t<Field>\t<Arn>" lines. def scan: (.Statement|arr)[] | .Effect as $e | ("Resource","NotResource") as $f | (.[$f]//empty|arr)[] | select(type=="string" and old) | " \($e // "Unknown")\t\($f)\t\(.)"; # Print header then hits, only if the doc has any. def report($hdr; doc): [doc|scan] | select(length>0) | ($hdr, .[]); ( .Policies[] | report("MANAGED \(.Arn)"; (.PolicyVersionList[]|select(.IsDefaultVersion)|.Document)) ), ( .UserDetailList[] | .Arn as $a | .UserPolicyList[]? | report("INLINE \($a) [\(.PolicyName)]"; .PolicyDocument) ), ( .GroupDetailList[] | .Arn as $a | .GroupPolicyList[]? | report("INLINE \($a) [\(.PolicyName)]"; .PolicyDocument) ), ( .RoleDetailList[] | .Arn as $a | .RolePolicyList[]? | report("INLINE \($a) [\(.PolicyName)]"; .PolicyDocument) ) ' MANAGED arn:aws:iam::000000000000:policy/service-role/AWSLambdaBasicExecutionRole-8ca2a1c1-379d-4fd7-a717-96ac3ca200b2 Allow Resource arn:aws:logs:ap-northeast-1:000000000000:log-group:/aws/lambda/xxxxx:* MANAGED arn:aws:iam::000000000000:policy/service-role/CodeBuildBasePolicy-sandbox-cdk-codebuild-role-ap-northeast-1 Allow Resource arn:aws:logs:ap-northeast-1:000000000000:log-group:/aws/codebuild/sandbox:* INLINE arn:aws:iam::000000000000:role/sandbox-cdk-codebuild-role [SandboxCdkCodeBuildRoleDefaultPolicy75732249] Allow Resource arn:aws:logs:ap-northeast-1:000000000000:log-group:/aws/codebuild/sandbox:* INLINE arn:aws:iam::000000000000:role/sandbox-role [sandbox-policy] Allow Resource arn:aws:logs:ap-northeast-1:000000000000:log-group:sandbox-log-group:*
評価結果を確認する: Before
次に simulate_cloudwatch_logs_policy.py を使って，IAM ポリシーの評価方法を確認する．内部的には IAM の SimulateCustomPolicy API を使っている．
まずは aws iam get-role-policy コマンドでインラインポリシーを JSON ファイルに書き出しておく．
$ aws iam get-role-policy \ --role-name sandbox-role \ --policy-name sandbox-policy \ --query PolicyDocument \ --output json > policy.json
以下のようになった．
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:PutRetentionPolicy", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Effect": "Allow", "Resource": "arn:aws:logs:ap-northeast-1:000000000000:log-group:sandbox-log-group:*" } ] }
そして simulate_cloudwatch_logs_policy.py を実行する．合計132個のアクションがログストリーム形式の ARN（LogStream 列）とロググループ形式の ARN（LogGroup 列）に対して評価される．
$ python3 simulate_cloudwatch_logs_policy.py policy.json sandbox-log-group --region ap-northeast-1 LogStream ARN: arn:aws:logs:ap-northeast-1:000000000000:log-group:sandbox-log-group:log-stream:* LogGroup ARN: arn:aws:logs:ap-northeast-1:000000000000:log-group:sandbox-log-group Actions simulated: 132 Action LogStream LogGroup --------------------------------------------- ------------ ------------ logs:AssociateKmsKey implicitDeny implicitDeny logs:AssociateSourceToS3TableIntegration implicitDeny implicitDeny logs:CallWithBearerToken implicitDeny implicitDeny logs:CancelExportTask implicitDeny implicitDeny logs:CancelImportTask implicitDeny implicitDeny logs:CreateDelivery implicitDeny implicitDeny logs:CreateExportTask implicitDeny implicitDeny logs:CreateImportTask implicitDeny implicitDeny logs:CreateLogAnomalyDetector implicitDeny implicitDeny logs:CreateLogDelivery implicitDeny implicitDeny logs:CreateLogGroup allowed implicitDeny logs:CreateLogStream allowed implicitDeny logs:CreateLookupTable implicitDeny implicitDeny logs:CreateScheduledQuery implicitDeny implicitDeny logs:DeleteAccountPolicy implicitDeny implicitDeny logs:DeleteDataProtectionPolicy implicitDeny implicitDeny logs:DeleteDelivery implicitDeny implicitDeny logs:DeleteDeliveryDestination implicitDeny implicitDeny logs:DeleteDeliveryDestinationPolicy implicitDeny implicitDeny logs:DeleteDeliverySource implicitDeny implicitDeny logs:DeleteDestination implicitDeny implicitDeny logs:DeleteIndexPolicy implicitDeny implicitDeny logs:DeleteIntegration implicitDeny implicitDeny logs:DeleteLogAnomalyDetector implicitDeny implicitDeny logs:DeleteLogDelivery implicitDeny implicitDeny logs:DeleteLogGroup implicitDeny implicitDeny logs:DeleteLogStream implicitDeny implicitDeny logs:DeleteLookupTable implicitDeny implicitDeny logs:DeleteMetricFilter implicitDeny implicitDeny logs:DeletePipelineRule implicitDeny implicitDeny logs:DeleteQueryDefinition implicitDeny implicitDeny logs:DeleteResourcePolicy implicitDeny implicitDeny logs:DeleteRetentionPolicy implicitDeny implicitDeny logs:DeleteScheduledQuery implicitDeny implicitDeny logs:DeleteSubscriptionFilter implicitDeny implicitDeny logs:DeleteSyslogConfiguration implicitDeny implicitDeny logs:DeleteTransformer implicitDeny implicitDeny logs:DescribeAccountPolicies implicitDeny implicitDeny logs:DescribeConfigurationTemplates implicitDeny implicitDeny logs:DescribeDeliveries implicitDeny implicitDeny logs:DescribeDeliveryDestinations implicitDeny implicitDeny logs:DescribeDeliverySources implicitDeny implicitDeny logs:DescribeDestinations implicitDeny implicitDeny logs:DescribeExportTasks implicitDeny implicitDeny logs:DescribeFieldIndexes implicitDeny implicitDeny logs:DescribeImportTaskBatches implicitDeny implicitDeny logs:DescribeImportTasks implicitDeny implicitDeny logs:DescribeIndexPolicies implicitDeny implicitDeny logs:DescribeLogGroups implicitDeny implicitDeny logs:DescribeLogStreams allowed implicitDeny logs:DescribeLookupTables implicitDeny implicitDeny logs:DescribeMetricFilters implicitDeny implicitDeny logs:DescribeQueries implicitDeny implicitDeny logs:DescribeQueryDefinitions implicitDeny implicitDeny logs:DescribeResourcePolicies implicitDeny implicitDeny logs:DescribeSubscriptionFilters implicitDeny implicitDeny logs:DisassociateKmsKey implicitDeny implicitDeny logs:DisassociateSourceFromS3TableIntegration implicitDeny implicitDeny logs:FilterLogEvents implicitDeny implicitDeny logs:GetDataProtectionPolicy implicitDeny implicitDeny logs:GetDelivery implicitDeny implicitDeny logs:GetDeliveryDestination implicitDeny implicitDeny logs:GetDeliveryDestinationPolicy implicitDeny implicitDeny logs:GetDeliverySource implicitDeny implicitDeny logs:GetIntegration implicitDeny implicitDeny logs:GetLogAnomalyDetector implicitDeny implicitDeny logs:GetLogDelivery implicitDeny implicitDeny logs:GetLogEvents implicitDeny implicitDeny logs:GetLogFields implicitDeny implicitDeny logs:GetLogGroupFields implicitDeny implicitDeny logs:GetLogRecord implicitDeny implicitDeny logs:GetLookupTable implicitDeny implicitDeny logs:GetQueryResults implicitDeny implicitDeny logs:GetScheduledQuery implicitDeny implicitDeny logs:GetScheduledQueryHistory implicitDeny implicitDeny logs:GetStorageTierPolicy implicitDeny implicitDeny logs:GetTransformer implicitDeny implicitDeny logs:IntegrateWithS3Table implicitDeny implicitDeny logs:Link implicitDeny implicitDeny logs:ListAggregateLogGroupSummaries implicitDeny implicitDeny logs:ListAnomalies implicitDeny implicitDeny logs:ListEntitiesForLogGroup implicitDeny implicitDeny logs:ListIntegrations implicitDeny implicitDeny logs:ListLogAnomalyDetectors implicitDeny implicitDeny logs:ListLogDeliveries implicitDeny implicitDeny logs:ListLogGroups implicitDeny implicitDeny logs:ListLogGroupsForEntity implicitDeny implicitDeny logs:ListLogGroupsForQuery implicitDeny implicitDeny logs:ListScheduledQueries implicitDeny implicitDeny logs:ListSourcesForS3TableIntegration implicitDeny implicitDeny logs:ListSyslogConfigurations implicitDeny implicitDeny logs:ListTagsForResource implicitDeny implicitDeny logs:ListTagsLogGroup implicitDeny implicitDeny logs:ProcessWithPipeline implicitDeny implicitDeny logs:PutAccountPolicy implicitDeny implicitDeny logs:PutBearerTokenAuthentication implicitDeny implicitDeny logs:PutDataProtectionPolicy implicitDeny implicitDeny logs:PutDeliveryDestination implicitDeny implicitDeny logs:PutDeliveryDestinationPolicy implicitDeny implicitDeny logs:PutDeliverySource implicitDeny implicitDeny logs:PutDestination implicitDeny implicitDeny logs:PutDestinationPolicy implicitDeny implicitDeny logs:PutIndexPolicy implicitDeny implicitDeny logs:PutIntegration implicitDeny implicitDeny logs:PutLogEvents allowed implicitDeny logs:PutLogGroupDeletionProtection implicitDeny implicitDeny logs:PutMetricFilter implicitDeny implicitDeny logs:PutPipelineRule implicitDeny implicitDeny logs:PutQueryDefinition implicitDeny implicitDeny logs:PutResourcePolicy implicitDeny implicitDeny logs:PutRetentionPolicy allowed implicitDeny logs:PutStorageTierPolicy implicitDeny implicitDeny logs:PutSubscriptionFilter implicitDeny implicitDeny logs:PutSyslogConfiguration implicitDeny implicitDeny logs:PutTransformer implicitDeny implicitDeny logs:StartLiveTail implicitDeny implicitDeny logs:StartQuery implicitDeny implicitDeny logs:StopLiveTail implicitDeny implicitDeny logs:StopQuery implicitDeny implicitDeny logs:TagLogGroup implicitDeny implicitDeny logs:TagResource implicitDeny implicitDeny logs:TestMetricFilter implicitDeny implicitDeny logs:TestTransformer implicitDeny implicitDeny logs:Unmask implicitDeny implicitDeny logs:UntagLogGroup implicitDeny implicitDeny logs:UntagResource implicitDeny implicitDeny logs:UpdateAnomaly implicitDeny implicitDeny logs:UpdateDeliveryConfiguration implicitDeny implicitDeny logs:UpdateLogAnomalyDetector implicitDeny implicitDeny logs:UpdateLogDelivery implicitDeny implicitDeny logs:UpdateLookupTable implicitDeny implicitDeny logs:UpdateScheduledQuery implicitDeny implicitDeny
ポイントを抜粋すると，ロググループ形式の ARN を指定する必要がある logs:CreateLogGroup・logs:PutRetentionPolicy・logs:DescribeLogStreams の3つは2027年4月26日以降に implicitDeny（暗黙の拒否） になってしまう🔥
Action LogStream LogGroup --------------------------------------------- ------------ ------------ logs:CreateLogGroup allowed implicitDeny logs:CreateLogStream allowed implicitDeny logs:DescribeLogStreams allowed implicitDeny logs:PutLogEvents allowed implicitDeny logs:PutRetentionPolicy allowed implicitDeny
ちなみに logs:CreateLogStream と logs:PutLogEvents はログストリーム形式の ARN を指定すれば良いため問題ないと判断できる．アクションごとに期待される指定方法はドキュメントに載っている．
評価結果を確認する: After
今度はロググループ形式の ARN を指定したステートメントを追加する．既存のステートメントもそのまま残しておく👌
data "aws_iam_policy_document" "sandbox" { statement { actions = [ "logs:CreateLogGroup", "logs:PutRetentionPolicy", "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:PutLogEvents", ] resources = [ "arn:aws:logs:ap-northeast-1:${data.aws_caller_identity.current.account_id}:log-group:sandbox-log-group:*", ] } statement { actions = [ "logs:CreateLogGroup", "logs:PutRetentionPolicy", "logs:DescribeLogStreams", ] resources = [ "arn:aws:logs:ap-northeast-1:${data.aws_caller_identity.current.account_id}:log-group:sandbox-log-group", ] } }
もう一度 aws iam get-role-policy コマンドでインラインポリシーを JSON ファイルに書き出しておく．
$ aws iam get-role-policy \ --role-name sandbox-role \ --policy-name sandbox-policy \ --query PolicyDocument \ --output json > policy.json
以下のようになった．
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:PutRetentionPolicy", "logs:PutLogEvents", "logs:DescribeLogStreams", "logs:CreateLogStream", "logs:CreateLogGroup" ], "Effect": "Allow", "Resource": "arn:aws:logs:ap-northeast-1:000000000000:log-group:sandbox-log-group:*" }, { "Action": [ "logs:PutRetentionPolicy", "logs:DescribeLogStreams", "logs:CreateLogGroup" ], "Effect": "Allow", "Resource": "arn:aws:logs:ap-northeast-1:000000000000:log-group:sandbox-log-group" } ] }
そして simulate_cloudwatch_logs_policy.py を実行する．
$ python3 simulate_cloudwatch_logs_policy.py policy.json sandbox-log-group --region ap-northeast-1 LogStream ARN: arn:aws:logs:ap-northeast-1:000000000000:log-group:sandbox-log-group:log-stream:* LogGroup ARN: arn:aws:logs:ap-northeast-1:000000000000:log-group:sandbox-log-group Actions simulated: 132 Action LogStream LogGroup --------------------------------------------- ------------ ------------ logs:AssociateKmsKey implicitDeny implicitDeny logs:AssociateSourceToS3TableIntegration implicitDeny implicitDeny logs:CallWithBearerToken implicitDeny implicitDeny logs:CancelExportTask implicitDeny implicitDeny logs:CancelImportTask implicitDeny implicitDeny logs:CreateDelivery implicitDeny implicitDeny logs:CreateExportTask implicitDeny implicitDeny logs:CreateImportTask implicitDeny implicitDeny logs:CreateLogAnomalyDetector implicitDeny implicitDeny logs:CreateLogDelivery implicitDeny implicitDeny logs:CreateLogGroup allowed allowed logs:CreateLogStream allowed implicitDeny logs:CreateLookupTable implicitDeny implicitDeny logs:CreateScheduledQuery implicitDeny implicitDeny logs:DeleteAccountPolicy implicitDeny implicitDeny logs:DeleteDataProtectionPolicy implicitDeny implicitDeny logs:DeleteDelivery implicitDeny implicitDeny logs:DeleteDeliveryDestination implicitDeny implicitDeny logs:DeleteDeliveryDestinationPolicy implicitDeny implicitDeny logs:DeleteDeliverySource implicitDeny implicitDeny logs:DeleteDestination implicitDeny implicitDeny logs:DeleteIndexPolicy implicitDeny implicitDeny logs:DeleteIntegration implicitDeny implicitDeny logs:DeleteLogAnomalyDetector implicitDeny implicitDeny logs:DeleteLogDelivery implicitDeny implicitDeny logs:DeleteLogGroup implicitDeny implicitDeny logs:DeleteLogStream implicitDeny implicitDeny logs:DeleteLookupTable implicitDeny implicitDeny logs:DeleteMetricFilter implicitDeny implicitDeny logs:DeletePipelineRule implicitDeny implicitDeny logs:DeleteQueryDefinition implicitDeny implicitDeny logs:DeleteResourcePolicy implicitDeny implicitDeny logs:DeleteRetentionPolicy implicitDeny implicitDeny logs:DeleteScheduledQuery implicitDeny implicitDeny logs:DeleteSubscriptionFilter implicitDeny implicitDeny logs:DeleteSyslogConfiguration implicitDeny implicitDeny logs:DeleteTransformer implicitDeny implicitDeny logs:DescribeAccountPolicies implicitDeny implicitDeny logs:DescribeConfigurationTemplates implicitDeny implicitDeny logs:DescribeDeliveries implicitDeny implicitDeny logs:DescribeDeliveryDestinations implicitDeny implicitDeny logs:DescribeDeliverySources implicitDeny implicitDeny logs:DescribeDestinations implicitDeny implicitDeny logs:DescribeExportTasks implicitDeny implicitDeny logs:DescribeFieldIndexes implicitDeny implicitDeny logs:DescribeImportTaskBatches implicitDeny implicitDeny logs:DescribeImportTasks implicitDeny implicitDeny logs:DescribeIndexPolicies implicitDeny implicitDeny logs:DescribeLogGroups implicitDeny implicitDeny logs:DescribeLogStreams allowed allowed logs:DescribeLookupTables implicitDeny implicitDeny logs:DescribeMetricFilters implicitDeny implicitDeny logs:DescribeQueries implicitDeny implicitDeny logs:DescribeQueryDefinitions implicitDeny implicitDeny logs:DescribeResourcePolicies implicitDeny implicitDeny logs:DescribeSubscriptionFilters implicitDeny implicitDeny logs:DisassociateKmsKey implicitDeny implicitDeny logs:DisassociateSourceFromS3TableIntegration implicitDeny implicitDeny logs:FilterLogEvents implicitDeny implicitDeny logs:GetDataProtectionPolicy implicitDeny implicitDeny logs:GetDelivery implicitDeny implicitDeny logs:GetDeliveryDestination implicitDeny implicitDeny logs:GetDeliveryDestinationPolicy implicitDeny implicitDeny logs:GetDeliverySource implicitDeny implicitDeny logs:GetIntegration implicitDeny implicitDeny logs:GetLogAnomalyDetector implicitDeny implicitDeny logs:GetLogDelivery implicitDeny implicitDeny logs:GetLogEvents implicitDeny implicitDeny logs:GetLogFields implicitDeny implicitDeny logs:GetLogGroupFields implicitDeny implicitDeny logs:GetLogRecord implicitDeny implicitDeny logs:GetLookupTable implicitDeny implicitDeny logs:GetQueryResults implicitDeny implicitDeny logs:GetScheduledQuery implicitDeny implicitDeny logs:GetScheduledQueryHistory implicitDeny implicitDeny logs:GetStorageTierPolicy implicitDeny implicitDeny logs:GetTransformer implicitDeny implicitDeny logs:IntegrateWithS3Table implicitDeny implicitDeny logs:Link implicitDeny implicitDeny logs:ListAggregateLogGroupSummaries implicitDeny implicitDeny logs:ListAnomalies implicitDeny implicitDeny logs:ListEntitiesForLogGroup implicitDeny implicitDeny logs:ListIntegrations implicitDeny implicitDeny logs:ListLogAnomalyDetectors implicitDeny implicitDeny logs:ListLogDeliveries implicitDeny implicitDeny logs:ListLogGroups implicitDeny implicitDeny logs:ListLogGroupsForEntity implicitDeny implicitDeny logs:ListLogGroupsForQuery implicitDeny implicitDeny logs:ListScheduledQueries implicitDeny implicitDeny logs:ListSourcesForS3TableIntegration implicitDeny implicitDeny logs:ListSyslogConfigurations implicitDeny implicitDeny logs:ListTagsForResource implicitDeny implicitDeny logs:ListTagsLogGroup implicitDeny implicitDeny logs:ProcessWithPipeline implicitDeny implicitDeny logs:PutAccountPolicy implicitDeny implicitDeny logs:PutBearerTokenAuthentication implicitDeny implicitDeny logs:PutDataProtectionPolicy implicitDeny implicitDeny logs:PutDeliveryDestination implicitDeny implicitDeny logs:PutDeliveryDestinationPolicy implicitDeny implicitDeny logs:PutDeliverySource implicitDeny implicitDeny logs:PutDestination implicitDeny implicitDeny logs:PutDestinationPolicy implicitDeny implicitDeny logs:PutIndexPolicy implicitDeny implicitDeny logs:PutIntegration implicitDeny implicitDeny logs:PutLogEvents allowed implicitDeny logs:PutLogGroupDeletionProtection implicitDeny implicitDeny logs:PutMetricFilter implicitDeny implicitDeny logs:PutPipelineRule implicitDeny implicitDeny logs:PutQueryDefinition implicitDeny implicitDeny logs:PutResourcePolicy implicitDeny implicitDeny logs:PutRetentionPolicy allowed allowed logs:PutStorageTierPolicy implicitDeny implicitDeny logs:PutSubscriptionFilter implicitDeny implicitDeny logs:PutSyslogConfiguration implicitDeny implicitDeny logs:PutTransformer implicitDeny implicitDeny logs:StartLiveTail implicitDeny implicitDeny logs:StartQuery implicitDeny implicitDeny logs:StopLiveTail implicitDeny implicitDeny logs:StopQuery implicitDeny implicitDeny logs:TagLogGroup implicitDeny implicitDeny logs:TagResource implicitDeny implicitDeny logs:TestMetricFilter implicitDeny implicitDeny logs:TestTransformer implicitDeny implicitDeny logs:Unmask implicitDeny implicitDeny logs:UntagLogGroup implicitDeny implicitDeny logs:UntagResource implicitDeny implicitDeny logs:UpdateAnomaly implicitDeny implicitDeny logs:UpdateDeliveryConfiguration implicitDeny implicitDeny logs:UpdateLogAnomalyDetector implicitDeny implicitDeny logs:UpdateLogDelivery implicitDeny implicitDeny logs:UpdateLookupTable implicitDeny implicitDeny logs:UpdateScheduledQuery implicitDeny implicitDeny
ポイントを抜粋すると，ロググループ形式の ARN を指定する必要がある logs:CreateLogGroup・logs:PutRetentionPolicy・logs:DescribeLogStreams の3つが allowed（許可） になった👌
Action LogStream LogGroup --------------------------------------------- ------------ ------------ logs:CreateLogGroup allowed allowed logs:CreateLogStream allowed implicitDeny logs:DescribeLogStreams allowed allowed logs:PutLogEvents allowed implicitDeny logs:PutRetentionPolicy allowed allowed
まとめ
AWS Health から「AWS CLOUDWATCH PLANNED LIFECYCLE EVENT」という AWS Health Event が来ていたので確認した．Amazon CloudWatch Logs の IAM ポリシーの評価方法が2027年4月26日から変わるので，CloudWatch Logs IAM Policy Validator を活用しつつ，ロググループ形式の ARN とログストリーム形式の ARN を適切に許可しよう💪
