Document minimum required IAM permissions

[rdsedmundo]

This is a Feature Proposal

Description

Document the minimum required IAM permissions for the plugin to work, so it's easier to follow the Principle of Least Privilege.

Additional Data

• Serverless Framework Version: Latest
• Stack Trace: N/A
• Provider Error messages: N/A

[yorjaggy]

Not sure if this question is still open, but I used these Inline Policy, and only those 2 actions are required. For sure using * on the Resource is not recommended, but by using this plugin I'm not able to get the Alarm name before its creation.

Anyways feel free to add any feedback :D

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "VisualEditor0",
            "Effect": "Allow",
            "Action": [
                "cloudwatch:PutMetricAlarm",
                "cloudwatch:DeleteAlarms"
            ],
            "Resource": "arn:aws:cloudwatch:<AWS_REGION>:<AWS_ACCOUNT_ID>:alarm:*"
        }
    ]
}

[rdsedmundo]

I noticed those are required too if metric filters are being used:

        "logs:PutMetricFilter",
        "logs:DeleteMetricFilter",
        "logs:DescribeMetricFilters"