I am trying to deploy a service to AWS govcloud and I am getting the following error -
I see that in the generated CFT the CreateLogStream and PutLogEvents actions policies are not considering the suggested Resource value from my serverless file (“arn:aws-us-gov:logs:::*”) and are instead generating the following which is incorrect for govcloud.
“Policies”:[
{
“PolicyName”:“logging”,
“PolicyDocument”:{
“Version”:“2012-10-17”,
“Statement”:[
{
“Effect”:“Allow”,
“Action”:[
“logs:CreateLogStream”
],
“Resource”:[
{
“Fn::Join”:[
“:”,
[
“arn:aws:logs”,
{
“Ref”:“AWS::Region”
},
{
“Ref”:“AWS::AccountId”
},
“log-group:/aws/lambda/<>:"
]
]
}
]
},
{
“Effect”:“Allow”,
“Action”:[
“logs:PutLogEvents”
],
“Resource”:[
{
“Fn::Join”:[
“:”,
[
“arn:aws:logs”,
{
“Ref”:“AWS::Region”
},
{
“Ref”:“AWS::AccountId”
},
"log-group:/aws/lambda/<>::*”
]
]
}
]
}
]
}
}
I see that a similar issue was reported #4102 and it was supposed to be fixed by this #6615 . But even with the latest version this issue seems to be present.