Role for VPC Flow Logs

CloudFormation template: yaml

AWSTemplateFormatVersion: 2010-09-09
Description: IAM Role for creating VPC Flow Logs

Parameters

Parameters:

Param	Value
DeploymentName	test

DeploymentName

  DeploymentName:
    Type: String
    Description: A name for this deployment

A deployment is a deployed application, potentially comprised of many CloudFormation stacks. This is sometimes called an "environment", but that is an overloaded and confusing term. Use the DeploymentName to indicate which logical deployment a stack belongs to.

If a deployment is completely specified by exactly one CloudFormation template, the DeploymentName and the AWS::StackName refer to the same things. In that case, consider not using a DeploymentName parameter.

Resources

Resources:

Role

  VpcFlowLogsRole:
    Type: AWS::IAM::Role
    Properties:
      RoleName: !Sub "${DeploymentName}-VpcFlowLogs"
      AssumeRolePolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Principal:
              Service: vpc-flow-logs.amazonaws.com
            Action:
              - sts:AssumeRole
      ManagedPolicyArns:
        - !Ref AllowVpcFlowLogs

Policy

  AllowVpcFlowLogs:
    Type: AWS::IAM::ManagedPolicy
    Properties:
      Description: Allow VPC Flow Logs to write logs
      ManagedPolicyName: VpcFlowLog
      PolicyDocument:
        Version: 2012-10-17
        Statement:
          - Effect: Allow
            Action:
              - logs:CreateLogGroup
              - logs:CreateLogStream
              - logs:PutLogEvents
              - logs:DescribeLogGroups
              - logs:DescribeLogStreams
            Resource: "*"