(aws_logs): Incorrect Permissions on CrossAccount Logging

[newc-mitch]

Describe the bug

When creating a LogGroup in another account, then granting read/write permissions, it applies to the base log group but not all the log streams.

Regression Issue

• Select this option if this issue appears to be a regression.

Last Known Working CDK Library Version

No response

Expected Behavior

Permissions are granted to all log group streams as is with same account/imported LogGroups

Current Behavior

Permissions were restricted to the LogGroup level

Reproduction Steps

import * as cdk from 'aws-cdk-lib';

import { Construct } from 'constructs';
class LogStack extends cdk.Stack {
  public readonly logGroup: cdk.aws_logs.LogGroup;

  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    
    this.logGroup = new cdk.aws_logs.LogGroup(this, 'ExampleGroup', {
         logGroupName: 'examaple/group',
    }); 
  }
}

class RoleStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: cdk.StackProps, logs: cdk.aws_logs.LogGroup) {
    super(scope, id, props);
    
    const role = new cdk.aws_iam.Role(this, 'ExampleRole', {
	assumedBy: new cdk.aws_iam.AnyPrincipal()
    });
    logs.grantWrite(role); 
    logs.grantRead(role);

  }
}

const app = new cdk.App();
const logStack  = new LogStack (app,  'LogStack', { env: {account: '12345678901234', region: 'us-east-1'}});
const roleStack = new RoleStack(app, 'RoleStack', { env: {account: '98765432104321', region: 'us-east-1'}}, logStack.logGroup);

Relevant Template CFN from the RoleStack:

"ExampleRole576372CE": {
   "Type": "AWS::IAM::Role",
   "Properties": {
    "AssumeRolePolicyDocument": {
     "Statement": [
      {
       "Action": "sts:AssumeRole",
       "Effect": "Allow",
       "Principal": {
        "AWS": "*"
       }
      }
     ],
     "Version": "2012-10-17"
    }
   },
   "Metadata": {
    "aws:cdk:path": "RoleStack/ExampleRole/Resource"
   }
  },
  "ExampleRoleDefaultPolicy688DB891": {
   "Type": "AWS::IAM::Policy",
   "Properties": {
    "PolicyDocument": {
     "Statement": [
      {
       "Action": [
        "logs:CreateLogStream",
        "logs:DescribeLogGroups",
        "logs:DescribeLogStreams",
        "logs:FilterLogEvents",
        "logs:GetLogEvents",
        "logs:GetLogGroupFields",
        "logs:PutLogEvents"
       ],
       "Effect": "Allow",
       "Resource": "arn:aws:logs:us-east-1:12345678901234:log-group:examaple/group"
      }
     ],
     "Version": "2012-10-17"
    },
    "PolicyName": "ExampleRoleDefaultPolicy688DB891",
    "Roles": [
     {
      "Ref": "ExampleRole576372CE"
     }
    ]
   },
   "Metadata": {
    "aws:cdk:path": "RoleStack/ExampleRole/DefaultPolicy/Resource"
   }
  },

Expected Resource": "arn:aws:logs:us-east-1:12345678901234:log-group:examaple/group:*

Possible Solution

When setting the LogGroup.logGroupArn, many of the cases explicitly add the ':*' to match CloudFormation's behavior with !Ref LogGroup.Arn
Example in LogGroup.fromLogGroupName: https://github.com/aws/aws-cdk/blob/1418204c40cdea59ced042768ae7f57b1f47eeb6/packages/aws-cdk-lib/aws-logs/lib/log-group.ts#L604C9-L604C47
In the constructor however, it does not include that provision:

aws-cdk/packages/aws-cdk-lib/aws-logs/lib/log-group.ts

Line 675 in 1418204

resourceName: this.physicalName,

Normally, if same stack, it'll just use the !Ref. Additionally, if the same environment, it'll export it as a Stack Output, then import it into the second stack. However, in this case, as they are neither same stack or account, it appears that it manually formats the arn, which causes this edge case.

Additional Information/Context

No response

AWS CDK Library version (aws-cdk-lib)

2.195.0

AWS CDK CLI version

2.1016.0

Node.js Version

v18.20.8

OS

Amazon Linux 2023

Language

TypeScript

Language Version

No response

Other information

No response

[ykethan]

Hey @newc-mitch, thank you for reaching out. I was able to reproduce the issue using the reproduction code provided, the generated IAM policy uses an ARN without :* suffix in cross account scenarios.

import * as cdk from 'aws-cdk-lib';

import { Construct } from 'constructs';
class LogStack extends cdk.Stack {
  public readonly logGroup: cdk.aws_logs.LogGroup;

  constructor(scope: Construct, id: string, props?: cdk.StackProps) {
    super(scope, id, props);
    
    this.logGroup = new cdk.aws_logs.LogGroup(this, 'ExampleGroup', {
         logGroupName: 'examaple/group',
    }); 
  }
}

class RoleStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: cdk.StackProps, logs: cdk.aws_logs.LogGroup) {
    super(scope, id, props);
    
    const role = new cdk.aws_iam.Role(this, 'ExampleRole', {
	assumedBy: new cdk.aws_iam.AnyPrincipal()
    });
    logs.grantWrite(role); 
    logs.grantRead(role);

  }
}

As you have correctly pointed the issue occurs on packages/aws-cdk-lib/aws-logs/lib/log-group.ts

this.logGroupArn = this.getResourceArnAttribute(resource.attrArn, {
  service: 'logs',
  resource: 'log-group',
  resourceName: this.physicalName,
  arnFormat: ArnFormat.COLON_RESOURCE_NAME,
})

The getResourceArnAttribute() uses the CloudFormation !Ref when in the same stack/account, which automatically includes :, but when cross-account, it manually constructs the ARN without the : suffix.
This inconsistency contrasts with the fromLogGroupName() method which correctly adds :*:

public static fromLogGroupName(scope: Construct, id: string, logGroupName: string): ILogGroup {
  // ...
  public readonly logGroupArn = Stack.of(scope).formatArn({
    service: 'logs',
    resource: 'log-group',
    arnFormat: ArnFormat.COLON_RESOURCE_NAME,
    resourceName: baseLogGroupName + ':*', // ← Correctly adds :*
  });
}

According to AWS CloudWatch Logs IAM documentation and ARN format documentation, the ARN format with :* suffix is required "to refer to the ARN when specifying permissions in IAM policies for all other API actions."

Workaround

As a workaround, you should be able to import the LogGroup using LogGroup.fromLogGroupName() instead of passing the LogGroup object directly:

class RoleStack extends cdk.Stack {
  constructor(scope: Construct, id: string, props: cdk.StackProps, logGroupName: string) {
    super(scope, id, props);
    
    // Import the log group by name instead of using the object directly
    const importedLogGroup = cdk.aws_logs.LogGroup.fromLogGroupName(
      this, 
      'ImportedLogGroup', 
      logGroupName
    );
    
    const role = new cdk.aws_iam.Role(this, 'ExampleRole', {
      assumedBy: new cdk.aws_iam.AnyPrincipal()
    });
    
    importedLogGroup.grantWrite(role); 
    importedLogGroup.grantRead(role);
  }
}

// Usage:
const logStack = new LogStack(app, 'LogStack', { env: {account: '', region: 'us-east-1'}});
const roleStack = new RoleStack(app, 'RoleStack', { env: {account: '', region: 'us-east-1'}}, logStack.logGroup.logGroupName);

Suggested fix

The fix could ensure that logGroupArn always includes :* suffix when used for IAM permissions. The constructor could be be modified to append :* to the ARN similar to fromLogGroupName():

this.logGroupArn = this.getResourceArnAttribute(resource.attrArn, {
  service: 'logs',
  resource: 'log-group',
  resourceName: this.physicalName,
  arnFormat: ArnFormat.COLON_RESOURCE_NAME,
}) + ':*';

However, this would need careful consideration as it might affect other uses of logGroupArn where :* shouldn't be included (like in tagging APIs). But will let the team dive into this.

Marking as P2 bug. We greatly appreciate community contributions! If you are interested in implementing this on a Pull Request. Please review the contribution guidelines. Meanwhile, welcome to add 👍 to this issue to help us prioritize.