IAM user policy in README.md requires too many permissions

[eryi]

Problem

IAM user in readme.md requires too many permissions

Steps to replicate

Currently, README.md recommends creating a IAM user with the following policy

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "logs:*",
        "s3:GetObject"
      ],
      "Resource": [
        "arn:aws:logs:us-east-1:*:*",
        "arn:aws:s3:::*"
      ]
    }
  ]
}

Expected Behavior or What you need to ask

I am not sure why s3:GetObject is required. Also, the user should not be allowed to delete logs. A more appropriate policy might be

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Action": [
        "logs:CreateLogStream",
        "logs:PutLogEvents"
      ],
      "Effect": "Allow",
      "Resource": "*"
    }
  ]
}

Source: https://docs.docker.com/config/containers/logging/awslogs/#credentials

[TBBle]

The correct permissions can probably be derived from the source. For example, _out_cloudwatchlogs.rb makes the following calls to the @log object:

• put_log_events
• create_log_group
• put_retention_policy
• create_log_stream
• describe_log_groups
• describe_log_streams

So it probably needs only the following permissions, per the CloudWatch Permissions Reference:

• logs:PutLogEvents
• logs:CreateLogGroup
• logs:PutRetentionPolicy
• logs:CreateLogStream
• logs:DescribeLogGroups
• logs:DescribeLogStreams

I've tested with the above set using the incubator/fluentd-cloudwatch Helm chart which uses an older version of this plugin, and it seems to be working so far. I haven't tried restricting the Resource or trimming the permissions.

_in_cloudwatchlogs.rb makes the following calls to @logs:

• get_log_events
• describe_log_streams

so presumably needs these permissions:

• logs:GetLogEvents
• logs:DescribeLogStreams

I don't know what the resource limitations need to be (I guess it depends on your chosen log group?) so it'd be nice to have this all well-documented and clear, and synced with the code.