Closed jake-naughton closed 7 months ago
This issue has been automatically marked as stale because it has been open 30 days with no activity. Remove stale label or comment or this issue will be closed in 10 days
Any thoughts on this?
Hi @jake-naughton !
Please make a PR with the proposed change.
Hi @antonbabenko, I have raised the PR here: https://github.com/terraform-aws-modules/terraform-aws-lambda/pull/514
I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues. If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.
Is your request related to a new offering from AWS?
Is your request related to a problem? Please describe.
I have to manage IAM roles outside of this module because it enforces
logs:CreateLogGroup
permission when the module provisions the CloudWatch log group. However, there are many cases where you don't need or want this permission attached to your lambda and it is a nuisance when you are dealing with ephemeral environments. The problem is described in this issue: https://github.com/terraform-aws-modules/terraform-aws-lambda/issues/342Describe the solution you'd like.
To add a variable that allows for the
logs:CreateLogGroup
to be turned off even when the module is responsible for provisioning the CloudWatch logs. By default it would be on so no change in behaviour.Describe alternatives you've considered.
Creating my own IAM role outside of the module and passing it in. Could also create the CloudWatch log group outside of the module.
Additional context
Happy to put up a PR for this improvement if it is acceptable.