(CloudWatch LogGroup): (its missing a grantRead)

[alisade]

Describe the feature

CloudWatch LogGroup CDK construct does have a grantWrite but not a grantRead, it would be great if it was added, there are too many actions to add to grant(IGrantable, actions) LogGroup

Use Case

trying to restrict read access to a specific CloudWatch LogGroup

Proposed Solution

No response

Other Information

No response

Acknowledgements

• I may be able to implement this feature request
• This feature might incur a breaking change

CDK version used

2.35.0

Environment details (OS name and version, etc.)

Linux AL2

[peterwoodworth]

Thanks for submitting this, we accept contributions! Check out our contributing guide if you're interested - there's a low chance the team will be able to address this soon but we'd be happy to review a PR 🙂

[markmansur]

I can submit a PR for this.

What IAM actions should this add? I was thinking logs:FilterLogEvents, logs:GetLogEvents , logs:GetLogRecord, logs:StartQuery, logs:StopQuery and logs:GetQueryResults. Any thoughts?

[kornicameister]

Pretty sure you can use https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/iam-identity-based-access-control-cwl.html#console-permissions-cwl as reference ;-). Anyway, I would argue if logs:*Query* permissions are relevant to a single log group.