<p>AWS Chatbot uses CloudWatch Logs Insights, so the IAM policy for Chatbot must include these two statements:</p>
<pre><code>{
    &quot;Sid&quot;: &quot;QueryLogs&quot;,
    &quot;Effect&quot;: &quot;Allow&quot;,
    &quot;Action&quot;: [
        &quot;logs:StopQuery&quot;,
        &quot;logs:StartQuery&quot;,
        &quot;logs:DescribeQueries&quot;
    ],
    &quot;Resource&quot;: &quot;arn:aws:logs:::log-group:/aws/lambda/*&quot;
},
{
    &quot;Sid&quot;: &quot;GetQueryResults&quot;,
    &quot;Effect&quot;: &quot;Allow&quot;,
    &quot;Action&quot;: &quot;logs:GetQueryResults&quot;,
    &quot;Resource&quot;: &quot;*&quot;
}
</code></pre>
<p>With these statements in place, pressing the logs button will yield an initial message from Chatbot like this:</p>
<blockquote>
<p>I ran this CloudWatch Logs Insights query to fetch logs from <strong>2020-11-18T09:02 UTC</strong> to <strong>2020-11-18T09:07 UTC</strong>.</p>
</blockquote>
<p>... as well as several follow-up messages containing a plaintext dump of the logs.</p>

CC BY-SA 4.0
2020-11-20T18:07:35.770Z
2020-11-20T18:07:35.770Z
Nic
<p>Just add the managed policy <strong>CloudWatchReadOnlyAccess</strong> as proposed in the <a href="https://docs.aws.amazon.com/de_de/chatbot/latest/adminguide/chatbot-iam-policies.html#CloudwatchReadOnlyAccess-policy-for-chatbot" rel="nofollow noreferrer">documentation</a>.</p>

CC BY-SA 4.0
2021-03-22T16:57:27.747Z
2021-03-22T16:57:27.747Z
totev
<p>I solved this issue with these IAM permissions,</p>
<pre><code>{
    &quot;Sid&quot;: &quot;query&quot;,
    &quot;Effect&quot;: &quot;Allow&quot;,
    &quot;Action&quot;: [
        &quot;logs:StopQuery&quot;,
        &quot;logs:StartQuery&quot;
    ],
    &quot;Resource&quot;: &quot;arn:aws:logs:us-east-1:*:log-group:/aws/lambda/my-lambda-function-name*:*&quot;
},
{
    &quot;Sid&quot;: &quot;logstream&quot;,
    &quot;Effect&quot;: &quot;Allow&quot;,
    &quot;Action&quot;: [
        &quot;logs:GetQueryResults&quot;,
        &quot;logs:DescribeLogGroups&quot;
    ],
    &quot;Resource&quot;: &quot;arn:aws:logs:us-east-1:*:log-group::log-stream:*&quot;
}
</code></pre>
<p>(you need to change the region <code>us-east-1</code> and <code>my-lambda-function-name</code> to your lambda function name)</p>

CC BY-SA 4.0
2021-01-05T04:59:49.120Z
2021-01-05T04:59:49.120Z
evalphobia
<p>The AWS service called <a href="https://aws.amazon.com/chatbot/" rel="nofollow noreferrer">Chatbot</a> allows CloudWatch Alarms to be relayed into a Slack channel. The message includes two buttons: <strong>Show logs</strong> and <strong>Show error logs</strong>.</p>
<p><a href="https://i.sstatic.net/GsLSI.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/GsLSI.png" alt="Slack message with attached buttons for Show logs and Show error logs" /></a></p>
<p>However, when I press either of these buttons, I receive an error message like this:</p>
<blockquote>
<p>❗️ I can't get the logs for you because the role <strong>arn:aws:iam::123412341234:role/my-chatbot</strong> in account <strong>123412341234</strong> is missing necessary permissions related to commands.</p>
<p>If you want to get logs, go to the AWS Chatbot console and choose or create a role that includes <strong>Read-only command permission</strong> for this channel.</p>
</blockquote>
<p>However, the recommended way of accomplishing this (the way automatically set up by AWS Console) grants Chatbot the <code>ReadOnlyAccess</code> policy which is <strong>way too permissive</strong> for my tastes. I don't want Chatbot to be able to read any object from any of our S3 buckets!</p>
<p>What is the minimal IAM policy that enables Chatbot to read CloudWatch Logs for Lambda functions?</p>

CC BY-SA 4.0
2020-11-25T07:43:16.573Z
You can check AWS Website for this
pioupiou
CC BY-SA 4.0
2020-11-25T20:29:07.930Z
@pioupiou I did not find the answer to my question on the AWS website. Could you provide a link?
Nic
<amazon-web-services><chatops>
What minimal IAM permissions are needed by AWS Chatbot so that it can show logs?
Nic
# What minimal IAM permissions are needed by AWS Chatbot so that it can show logs?

(Asked by: username_0 on 2020-11-20)

The AWS service called [Chatbot](https://aws.amazon.com/chatbot/) allows CloudWatch Alarms to be relayed into a Slack channel. The message includes two buttons: **Show logs** and **Show error logs**.

[![Slack message with attached buttons for Show logs and Show error logs](https://i.sstatic.net/GsLSI.png)](https://i.sstatic.net/GsLSI.png)

However, when I press either of these buttons, I receive an error message like this:

> ❗️ I can't get the logs for you because the role **arn:aws:iam::123412341234:role/my-chatbot** in account **123412341234** is missing necessary permissions related to commands.
>
> If you want to get logs, go to the AWS Chatbot console and choose or create a role that includes **Read-only command permission** for this channel.

However, the recommended way of accomplishing this (the way automatically set up by AWS Console) grants Chatbot the `ReadOnlyAccess` policy which is **way too permissive** for my tastes. I don't want Chatbot to be able to read any object from any of our S3 buckets!

What is the minimal IAM policy that enables Chatbot to read CloudWatch Logs for Lambda functions?

**Tags:** amazon-web-services, chatops

> **Comments:**
> **username_1**: You can check AWS Website for this  
> **username_0**: @username_1 I did not find the answer to my question on the AWS website. Could you provide a link?  

---

## 3 answers

### Answer by username_0 on 2020-11-20. Score: 2 | Accepted answer

AWS Chatbot uses CloudWatch Logs Insights, so the IAM policy for Chatbot must include these two statements:
{
    "Sid": "QueryLogs",
    "Effect": "Allow",
    "Action": [
        "logs:StopQuery",
        "logs:StartQuery",
        "logs:DescribeQueries"
    ],
    "Resource": "arn:aws:logs:::log-group:/aws/lambda/*"
},
{
    "Sid": "GetQueryResults",
    "Effect": "Allow",
    "Action": "logs:GetQueryResults",
    "Resource": "*"
}

With these statements in place, pressing the logs button will yield an initial message from Chatbot like this:

I ran this CloudWatch Logs Insights query to fetch logs from 2020-11-18T09:02 UTC to 2020-11-18T09:07 UTC.

... as well as several follow-up messages containing a plaintext dump of the logs.


---

### Answer by username_2 on 2021-03-22. Score: 0

Just add the managed policy **CloudWatchReadOnlyAccess** as proposed in the [documentation](https://docs.aws.amazon.com/de_de/chatbot/latest/adminguide/chatbot-iam-policies.html#CloudwatchReadOnlyAccess-policy-for-chatbot).


---

### Answer by username_3 on 2021-01-05. Score: 0

I solved this issue with these IAM permissions,
{
    "Sid": "query",
    "Effect": "Allow",
    "Action": [
        "logs:StopQuery",
        "logs:StartQuery"
    ],
    "Resource": "arn:aws:logs:us-east-1:*:log-group:/aws/lambda/my-lambda-function-name*:*"
},
{
    "Sid": "logstream",
    "Effect": "Allow",
    "Action": [
        "logs:GetQueryResults",
        "logs:DescribeLogGroups"
    ],
    "Resource": "arn:aws:logs:us-east-1:*:log-group::log-stream:*"
}

(you need to change the region us-east-1 and my-lambda-function-name to your lambda function name)


---

