mirror of
https://github.com/ghndrx/prowler.git
synced 2026-02-10 14:55:00 +00:00
c20f8878da
According to the AWS documentation for the CloudWatch Logs permissions reference [1], the IAM policy to permit or deny CloudWatch Logs actions uses the `logs:` prefix rather than `cloudwatchlogs:`. This commit updates the policy additions JSON file as well as the README to reflect this change. I confirmed this having assumed an appropriate role in an AWS account, then executing the AWS CLI command `aws logs describe-log-groups`; with the `cloudwatchlogs:` prefix an AccessDeniedException was returned to the client. [1] https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/permissions-reference-cwl.html
20 lines
448 B
JSON
20 lines
448 B
JSON
{
|
|
"Version": "2012-10-17",
|
|
"Statement": [
|
|
{
|
|
"Action": [
|
|
"acm:describecertificate",
|
|
"acm:listcertificates",
|
|
"es:describeelasticsearchdomainconfig",
|
|
"logs:DescribeLogGroups",
|
|
"logs:DescribeMetricFilters",
|
|
"ses:getidentityverificationattributes",
|
|
"sns:listsubscriptionsbytopic",
|
|
"guardduty:ListDetectors"
|
|
],
|
|
"Effect": "Allow",
|
|
"Resource": "*"
|
|
}
|
|
]
|
|
}
|