logs:CreateLogDelivery and logs:DeleteLogDelivery missing

[danygielow]

Hi,

thank you for this tool. But I have found some undetected actions.

When creating VPC flow logs and probably other logs, the action logs:CreateLogDelivery is needed. To delete it, logs:DeleteLogDelivery is needed:

https://docs.aws.amazon.com/AmazonCloudWatch/latest/logs/AWS-logs-and-resource-policy.html

[iann0036]

Hey @danygielow,

Thanks for raising!

This is a pretty interesting find. I played around with a bunch of the services in the table you linked with an explicit deny on logs:CreateLogDelivery and was able to ignore the documented requirements, except for VPC flow logs. I was also able to create and delete log groups with an explicit deny on logs:DeleteLogDelivery.

I've added the requirement for logs:CreateLogDelivery on EC2.CreateFlowLogs for now, but this probably needs a little more research. It'll propagate to permissions.cloud within 24 hours, and I'll have it in iamlive in a few days.

[FullyImmersed]

Hi @iann0036 ,

Encountered this issue again - the AWS Network Firewall requires the logging permissions (iam actions) such as logs:CreateLogDelivery. The full list of permissions required can be found here.

After checking it in AWS those permissions are indeed required.
Couldn't find any place that summarizes what more APIs require this permission(s) and this case leads to believe that there are more permissions missing, even though can't point to anything specific currently.

[iann0036]

Hi @FullyImmersed,

Happy holidays and apologies for the delayed response.

I've added the permissions you mentioned to Network Firewall's CreateFirewall and UpdateLoggingConfiguration APIs. Feel free to request any additional APIs that might be missing, as FAS request permissions are sometimes lacking from the dataset.

Thanks for raising!