How does EventBridge Pipes have permissions to log to CloudWatch?

Question

I've configured my EventBridge Pipe with a source of a DynamoDB stream and a target of an Event Bus.  I let the service create the execution role for me and also checked the box for CloudWatch logging and set it to TRACE level.  The IAM role it created does not show permissions to be able to write log events, but the logs are flowing in just fine.  How does the EventBridge Pipe have permissions to log to the configured log group?

Makendran G · Answer

When CloudWatch Logs is the target of a rule, EventBridge creates log streams, and CloudWatch Logs stores the text from the events as log entries. To allow EventBridge to create the log stream and log the events, CloudWatch Logs must include a resource-based policy that enables EventBridge to write to CloudWatch Logs.

If you use the AWS Management Console to add CloudWatch Logs as the target of a rule, the resource-based policy is created automatically. If you use the AWS CLI to add the target, and the policy doesn't already exist, you must create it.

[+] https://docs.aws.amazon.com/eventbridge/latest/userguide/eb-use-resource-based.html#eb-cloudwatchlogs-permissions

[+] https://repost.aws/knowledge-center/cloudwatch-log-group-eventbridge

Resource based policy is not visible on console. Run the below CLI command to view the resource based policy on terminal.

```
aws logs describe-resource-policies --region 
```

[+] https://docs.aws.amazon.com/cli/latest/reference/logs/describe-resource-policies.html

To update your resource policy, please use put-resource-policy in the AWS CLI as you will not be able to edit a resource policy in the console.

How does EventBridge Pipes have permissions to log to CloudWatch?

Relevant content