(logs): LogGroup.grant() and grantRead() do not include the log group ARN #39561

Activity

1. github-actions

   added

   needs-triageThis issue or PR still needs to be triaged.This issue or PR still needs to be triaged.

   @aws-cdk/aws-logsRelated to Amazon CloudWatch LogsRelated to Amazon CloudWatch Logs

   on Oct 29, 2026
2. pahud commented on Oct 30, 2026

   

   pahud

   on Oct 30, 2026

   Contributor

   More actions

   Hi @1992chenlu,

   Issue at a Glance:

   ┌──────────────────────────────┐     ┌──────────────────────────────┐
   │ LogGroup.grant(role,         │ ──> │ IAM statement gets only the  │
   │   'logs:DescribeLogStreams') │     │ ':*' log group ARN           │
   └──────────────────────────────┘     └──────────────────────────────┘
                                                     │
                                                     v
                                        ┌──────────────────────────────┐
                                        │ Plain log group ARN missing. │
                                        │ DescribeLogStreams is a      │
                                        │ group-level action.          │
                                        └──────────────────────────────┘
   

   I reproduced this with cdk synth on 2.1.0 (the oldest tag I checked) and 2.275.0 (latest). I did not deploy. In both, the logs:DescribeLogStreams statement has one resource: the Fn::GetAtt ... Arn of the log group, with no plain log group ARN. grants.read() shows the same.

   The :* suffix is intentional for stream actions, per the comment in the code:

   aws-cdk/packages/aws-cdk-lib/aws-logs/lib/log-group.ts

   Lines 270 to 279 in b7a057a

   	public grant(grantee: iam.IGrantable, ...actions: string[]) {
   	return iam.Grant.addToPrincipalOrResource({
   	grantee,
   	actions,
   	// A LogGroup ARN out of CloudFormation already includes a ':*' at the end to include the log streams under the group.
   	// See https://docs.aws.amazon.com/AWSCloudFormation/latest/UserGuide/aws-resource-logs-loggroup.html#w2ab1c21c10c63c43c11
   	resourceArns: [this.logGroupArn],
   	resource: this,
   	});
   	}

   Draft PR #39559 targets this. It changes grant() and a helper getter in log-group.ts. I did not run synth after that change, so I cannot say whether grants.read() is also fixed.

   Passing both ARNs to every action would grant more than needed, since stream actions such as PutLogEvents would then apply to the whole log group. The fix should map each action to the right resource type.
3. pahud

   added

   effort/mediumMedium work item – several days of effortMedium work item – several days of effort

   p2

   feature-requestA feature should be added or improved.A feature should be added or improved.

   and removed

   needs-triageThis issue or PR still needs to be triaged.This issue or PR still needs to be triaged.

   on Oct 30, 2026
4. 1992chenlu

   changed the title [-](logs): LogGroup.grant() does not include the log group ARN[/-] [+](logs): LogGroup.grant() and grantRead() do not include the log group ARN[/+] on Oct 30, 2026