Reduce Cloudwatch log permissions (#35)

unionai · Aug 14, 2024 · 57f94c1 · 57f94c1
1 parent d99e686
commit 57f94c1
Showing 1 changed file with 0 additions and 2 deletions.
diff --git a/union-ai-admin/aws/union-ai-admin-role.template.yaml b/union-ai-admin/aws/union-ai-admin-role.template.yaml
@@ -367,9 +367,7 @@ Resources:
             Resource: '*'
           - Effect: Allow
             Action:
-              - logs:GetLogRecord
               - logs:GetLogEvents
-              - logs:FilterLogEvents
             Resource:
               - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/eks/opta-*:log-stream:kube-*'
               - !Sub 'arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/containerinsights/opta-*/dataplane:log-stream:*'