3

I have to add retention policy to API Gateway Cloudwatch logs, hence I cannot use the aws provided policy to do so i.e. arn:aws:iam::aws:policy/service-role/AmazonAPIGatewayPushToCloudWatchLogs

So instead I created my own role with custom policy :

ApiGatewayCloudWatchLogsRole:
Type: 'AWS::IAM::Role'
DependsOn: APIGFunctionLogGroup
Properties:
  AssumeRolePolicyDocument:
    Version: 2012-10-17
    Statement:
      - Effect: Allow
        Principal:
          Service:
            - apigateway.amazonaws.com
        Action: 'sts:AssumeRole'
  Path: / 
  Policies:
    - PolicyName: APIGatewayPushLogsPolicy
      PolicyDocument:
        Version: 2012-10-17
        Statement:
            Effect: Allow
            Action:
              - 'logs:CreateLogStream'
              - 'logs:PutLogEvents'
              - 'logs:DescribeLogGroups'
              - 'logs:DescribeLogStreams'
              - 'logs:GetLogEvents'
              - 'logs:FilterLogEvents'
            Resource: '*'

And then created LogGroup with retention as :

APIGFunctionLogGroup:
Type: 'AWS::Logs::LogGroup'
Properties:
  RetentionInDays: 30
  LogGroupName: !Join 
    - ''
    - - API-Gateway-Execution-Logs_
      - !Ref MyRestApi

And passed the above created role to AWS::ApiGateway::Account

ApiGatewayAccount:
Type: 'AWS::ApiGateway::Account'
DependsOn: APIGFunctionLogGroup
Properties:
  CloudWatchRoleArn: !GetAtt 
    - ApiGatewayCloudWatchLogsRole
    - Arn

But while deploying my API Gateway I am getting error as :

ERROR

I have the trust policy as well but API Gateway Account is not getting created.

1 Answer 1

1

If you create the log group yourself, before APIgateway does you should be able to use the existing policy/service role.

3
  • what is the problem with the way I am trying to do ? I cannot understand a reason for it not to work Mar 21, 2019 at 17:29
  • It's possible that CloudFormation is checking the permissions that role has and is not allowing it. Confirm by manually creating the role and configuring apigateway to use it via the console. Mar 21, 2019 at 19:40
  • This answer is correct, just make sure to add the LogGroup resource in the DependsOn section of the API GW or Deployment resources.
    – Federico
    Jun 22, 2022 at 4:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.