fix: Reduce CloudWatch permissions

infra/modules/alerting/telegram.tf

@@ -56,9 +56,24 @@ resource "aws_iam_role" "lambda_execution" {
   tags = var.tags
 }
 
-resource "aws_iam_role_policy_attachment" "lambda_basic_execution" {
-  role       = aws_iam_role.lambda_execution.name
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
+resource "aws_iam_role_policy" "lambda_exec_required_perm" {
+  name = "${var.name}-required"
+  role = aws_iam_role.lambda_execution.id
+
+  policy = jsonencode({
+    Version = "2012-10-17"
+    Statement = [
+      {
+        Sid    = "Logging",
+        Effect = "Allow"
+        Action = [
+          "logs:CreateLogStream",
+          "logs:PutLogEvents",
+        ]
+        Resource = "arn:aws:logs:*:*:log-group:/aws/lambda/${var.name}:log-stream:*"
+      }
+    ]
+  })
 }
 
 resource "aws_iam_role_policy" "fallback_to_sns" {

infra/modules/alerting/variables.tf

@@ -35,8 +35,8 @@ variable "role_policies" {
   default     = []
 
   validation {
-    condition     = length(var.role_policies) <= 8
-    error_message = "role_policies must be less than 9 policies"
+    condition     = length(var.role_policies) <= 9
+    error_message = "role_policies must be less than 10 policies"
   }
 }
 

infra/modules/api/data.tf

@@ -6,16 +6,48 @@ data "aws_iam_policy_document" "cloudwatch_permissions" {
   statement {
     effect = "Allow"
     actions = [
-      "logs:CreateLogGroup",
-      "logs:CreateLogStream",
       "logs:DescribeLogGroups",
+    ]
+    resources = [
+      "*",
+    ]
+  }
+
+  statement {
+    effect = "Allow"
+    actions = [
+      "logs:CreateLogGroup",
+      "logs:DeleteLogGroup",
+    ]
+    resources = [
+      "arn:aws:logs:*:*:log-group:/aws/apigateway/welcome:*"
+    ]
+  }
+
+  statement {
+    effect = "Allow"
+    actions = [
       "logs:DescribeLogStreams",
+      "logs:FilterLogEvents"
+    ]
+    resources = [
+      "arn:aws:logs:*:*:log-group:/aws/apigateway/welcome:*",
+      aws_cloudwatch_log_group.access_logs.arn,
+      aws_cloudwatch_log_group.stage_v1.arn,
+    ]
+  }
+
+  statement {
+    effect = "Allow"
+    actions = [
+      "logs:CreateLogStream",
       "logs:PutLogEvents",
       "logs:GetLogEvents",
-      "logs:FilterLogEvents"
     ]
     resources = [
-      "*",
+      "arn:aws:logs:*:*:log-group:/aws/apigateway/welcome:*",
+      aws_cloudwatch_log_group.access_logs.arn,
+      aws_cloudwatch_log_group.stage_v1.arn,
     ]
   }
 }

infra/modules/handler/roles.tf

@@ -15,19 +15,24 @@ resource "aws_iam_role" "lambda_execution" {
   })
 }
 
-resource "aws_iam_role_policy_attachment" "lambda_basic_execution" {
-  role       = aws_iam_role.lambda_execution.name
-  policy_arn = "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"
-}
-
-resource "aws_iam_role_policy" "sqs" {
-  name = "${var.function_name}-sqs-policy"
+resource "aws_iam_role_policy" "lambda_exec_required_perm" {
+  name = "${var.function_name}-required"
   role = aws_iam_role.lambda_execution.id
 
   policy = jsonencode({
     Version = "2012-10-17"
     Statement = [
       {
+        Sid    = "Logging",
+        Effect = "Allow"
+        Action = [
+          "logs:CreateLogStream",
+          "logs:PutLogEvents",
+        ]
+        Resource = "arn:aws:logs:*:*:log-group:/aws/lambda/${var.function_name}:log-stream:*"
+      },
+      {
+        Sid    = "SQS"
         Effect = "Allow"
         Action = [
           "sqs:ReceiveMessage",

infra/modules/handler/variables.tf

@@ -54,7 +54,7 @@ variable "role_policies" {
   default     = []
 
   validation {
-    condition     = length(var.role_policies) <= 8
-    error_message = "role_policies must be less than 9 policies"
+    condition     = length(var.role_policies) <= 10
+    error_message = "role_policies must be less than 11 policies"
   }
 }

infra/tests/01_unit.tftest.hcl

@@ -175,7 +175,7 @@ run "verify_module_handler_negative" {
     source_path                    = "../../apps/mux"
     sqs_queue_arn                  = "arn:aws:sqs:000000000000:us-east-1:${run.prepare.prefix}queue.fifo"
     sqs_batch_size                 = 10
-    role_policies                  = [["1"], ["2"], ["3"], ["4"], ["5"], ["6"], ["7"], ["8"], ["9"]]
+    role_policies                  = [["1"], ["2"], ["3"], ["4"], ["5"], ["6"], ["7"], ["8"], ["9"], ["10"], ["11"]]
   }
 
   expect_failures = [var.role_policies]
@@ -205,7 +205,7 @@ run "verify_module_alerting_negative" {
   variables {
     name                           = "${run.prepare.prefix}alerting-negative"
     reserved_concurrent_executions = 1
-    role_policies                  = [["1"], ["2"], ["3"], ["4"], ["5"], ["6"], ["7"], ["8"], ["9"]]
+    role_policies                  = [["1"], ["2"], ["3"], ["4"], ["5"], ["6"], ["7"], ["8"], ["9"], ["10"]]
   }
 
   expect_failures = [var.role_policies]