Answers: <p>AWS Chatbot uses CloudWatch Logs Insights, so the IAM policy for Chatbot must include these two statements:</p>
  <pre><code>{
      &quot;Sid&quot;: &quot;QueryLogs&quot;,
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Action&quot;: [
          &quot;logs:StopQuery&quot;,
          &quot;logs:StartQuery&quot;,
          &quot;logs:DescribeQueries&quot;
      ],
      &quot;Resource&quot;: &quot;arn:aws:logs:::log-group:/aws/lambda/*&quot;
  },
  {
      &quot;Sid&quot;: &quot;GetQueryResults&quot;,
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Action&quot;: &quot;logs:GetQueryResults&quot;,
      &quot;Resource&quot;: &quot;*&quot;
  }
  </code></pre>
  <p>With these statements in place, pressing the logs button will yield an initial message from Chatbot like this:</p>
  <blockquote>
  <p>I ran this CloudWatch Logs Insights query to fetch logs from <strong>2020-11-18T09:02 UTC</strong> to <strong>2020-11-18T09:07 UTC</strong>.</p>
  </blockquote>
  <p>... as well as several follow-up messages containing a plaintext dump of the logs.</p>
  
Answers: CC BY-SA 4.0
Answers: 2020-11-20T18:07:35.770Z
Answers: 2020-11-20T18:07:35.770Z
Answers: Nic
Answers: <p>Just add the managed policy <strong>CloudWatchReadOnlyAccess</strong> as proposed in the <a href="https://docs.aws.amazon.com/de_de/chatbot/latest/adminguide/chatbot-iam-policies.html#CloudwatchReadOnlyAccess-policy-for-chatbot" rel="nofollow noreferrer">documentation</a>.</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-03-22T16:57:27.747Z
Answers: 2021-03-22T16:57:27.747Z
Answers: totev
Answers: <p>I solved this issue with these IAM permissions,</p>
  <pre><code>{
      &quot;Sid&quot;: &quot;query&quot;,
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Action&quot;: [
          &quot;logs:StopQuery&quot;,
          &quot;logs:StartQuery&quot;
      ],
      &quot;Resource&quot;: &quot;arn:aws:logs:us-east-1:*:log-group:/aws/lambda/my-lambda-function-name*:*&quot;
  },
  {
      &quot;Sid&quot;: &quot;logstream&quot;,
      &quot;Effect&quot;: &quot;Allow&quot;,
      &quot;Action&quot;: [
          &quot;logs:GetQueryResults&quot;,
          &quot;logs:DescribeLogGroups&quot;
      ],
      &quot;Resource&quot;: &quot;arn:aws:logs:us-east-1:*:log-group::log-stream:*&quot;
  }
  </code></pre>
  <p>(you need to change the region <code>us-east-1</code> and <code>my-lambda-function-name</code> to your lambda function name)</p>
  
Answers: CC BY-SA 4.0
Answers: 2021-01-05T04:59:49.120Z
Answers: 2021-01-05T04:59:49.120Z
Answers: evalphobia
Body: <p>The AWS service called <a href="https://aws.amazon.com/chatbot/" rel="nofollow noreferrer">Chatbot</a> allows CloudWatch Alarms to be relayed into a Slack channel. The message includes two buttons: <strong>Show logs</strong> and <strong>Show error logs</strong>.</p>
  <p><a href="https://i.sstatic.net/GsLSI.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/GsLSI.png" alt="Slack message with attached buttons for Show logs and Show error logs" /></a></p>
  <p>However, when I press either of these buttons, I receive an error message like this:</p>
  <blockquote>
  <p>❗️ I can't get the logs for you because the role <strong>arn:aws:iam::123412341234:role/my-chatbot</strong> in account <strong>123412341234</strong> is missing necessary permissions related to commands.</p>
  <p>If you want to get logs, go to the AWS Chatbot console and choose or create a role that includes <strong>Read-only command permission</strong> for this channel.</p>
  </blockquote>
  <p>However, the recommended way of accomplishing this (the way automatically set up by AWS Console) grants Chatbot the <code>ReadOnlyAccess</code> policy which is <strong>way too permissive</strong> for my tastes. I don't want Chatbot to be able to read any object from any of our S3 buckets!</p>
  <p>What is the minimal IAM policy that enables Chatbot to read CloudWatch Logs for Lambda functions?</p>
  
Comments: CC BY-SA 4.0
Comments: 2020-11-25T07:43:16.573Z
Comments: You can check AWS Website for this
Comments: pioupiou
Comments: CC BY-SA 4.0
Comments: 2020-11-25T20:29:07.930Z
Comments: @pioupiou I did not find the answer to my question on the AWS website. Could you provide a link?
Comments: Nic
Tags: <amazon-web-services><chatops>
Title: What minimal IAM permissions are needed by AWS Chatbot so that it can show logs?
UserDisplayName: Nic
ThreadText: # What minimal IAM permissions are needed by AWS Chatbot so that it can show logs?
  
  (Asked by: username_0 on 2020-11-20)
  
  The AWS service called [Chatbot](https://aws.amazon.com/chatbot/) allows CloudWatch Alarms to be relayed into a Slack channel. The message includes two buttons: **Show logs** and **Show error logs**.
  
  [![Slack message with attached buttons for Show logs and Show error logs](https://i.sstatic.net/GsLSI.png)](https://i.sstatic.net/GsLSI.png)
  
  However, when I press either of these buttons, I receive an error message like this:
  
  > ❗️ I can't get the logs for you because the role **arn:aws:iam::123412341234:role/my-chatbot** in account **123412341234** is missing necessary permissions related to commands.
  >
  > If you want to get logs, go to the AWS Chatbot console and choose or create a role that includes **Read-only command permission** for this channel.
  
  However, the recommended way of accomplishing this (the way automatically set up by AWS Console) grants Chatbot the `ReadOnlyAccess` policy which is **way too permissive** for my tastes. I don't want Chatbot to be able to read any object from any of our S3 buckets!
  
  What is the minimal IAM policy that enables Chatbot to read CloudWatch Logs for Lambda functions?
  
  **Tags:** amazon-web-services, chatops
  
  > **Comments:**
  > **username_1**: You can check AWS Website for this  
  > **username_0**: @username_1 I did not find the answer to my question on the AWS website. Could you provide a link?  
  
  ---
  
  ## 3 answers
  
  ### Answer by username_0 on 2020-11-20. Score: 2 | Accepted answer
  
  AWS Chatbot uses CloudWatch Logs Insights, so the IAM policy for Chatbot must include these two statements:
  
  ```
  {
      "Sid": "QueryLogs",
      "Effect": "Allow",
      "Action": [
          "logs:StopQuery",
          "logs:StartQuery",
          "logs:DescribeQueries"
      ],
      "Resource": "arn:aws:logs:::log-group:/aws/lambda/*"
  },
  {
      "Sid": "GetQueryResults",
      "Effect": "Allow",
      "Action": "logs:GetQueryResults",
      "Resource": "*"
  }
  
  ```
  
  With these statements in place, pressing the logs button will yield an initial message from Chatbot like this:
  
  > I ran this CloudWatch Logs Insights query to fetch logs from **2020-11-18T09:02 UTC** to **2020-11-18T09:07 UTC**.
  
  ... as well as several follow-up messages containing a plaintext dump of the logs.
  
  
  ---
  
  ### Answer by username_2 on 2021-03-22. Score: 0
  
  Just add the managed policy **CloudWatchReadOnlyAccess** as proposed in the [documentation](https://docs.aws.amazon.com/de_de/chatbot/latest/adminguide/chatbot-iam-policies.html#CloudwatchReadOnlyAccess-policy-for-chatbot).
  
  
  ---
  
  ### Answer by username_3 on 2021-01-05. Score: 0
  
  I solved this issue with these IAM permissions,
  
  ```
  {
      "Sid": "query",
      "Effect": "Allow",
      "Action": [
          "logs:StopQuery",
          "logs:StartQuery"
      ],
      "Resource": "arn:aws:logs:us-east-1:*:log-group:/aws/lambda/my-lambda-function-name*:*"
  },
  {
      "Sid": "logstream",
      "Effect": "Allow",
      "Action": [
          "logs:GetQueryResults",
          "logs:DescribeLogGroups"
      ],
      "Resource": "arn:aws:logs:us-east-1:*:log-group::log-stream:*"
  }
  
  ```
  
  (you need to change the region `us-east-1` and `my-lambda-function-name` to your lambda function name)
  
  
  ---
  
  