Add source arn field to cloudwatch lambda permission

DataDog · Oct 4, 2024 · 8f62181 · 8f62181
1 parent 2ac7c3d
commit 8f62181
Showing 1 changed file with 3 additions and 2 deletions.
diff --git a/aws/logs_monitoring/template.yaml b/aws/logs_monitoring/template.yaml
@@ -658,9 +658,10 @@ Resources:
       Action: lambda:InvokeFunction
       Principal: !If
         - IsAWSChina
-        - !Sub "logs.${AWS::Region}.amazonaws.com.cn"
-        - !Sub "logs.${AWS::Region}.amazonaws.com"
+        - "logs.amazonaws.com.cn"
+        - "logs.amazonaws.com"
       SourceAccount: !Ref "AWS::AccountId"
+      SourceArn: !Sub "arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:*:*"
   S3Permission:
     Type: AWS::Lambda::Permission
     Properties: