7

I am trying to allow aws to start my log service, and I have my log streams, and log groups added already.

When i got to my VPC dashboard, the status of the Flow Log I'm interested in says:

Access Error. The IAM role for your flow logs does not have sufficient permissions to send logs to the CloudWatch log group.

But, when I look at my IAM role associated with this Flow log, I see that my permissions are exactly the same as the custom policy indicated here (In that link, search for "In the Policy Document field" to find the policy I'm talking about).

What could be preventing my IAM Role from accessing the logs now? The log streams are completely blank. Thank you.

Improve this question

1 Answer 1

Reset to default
8

You may want to ensure that your IAM policy has "vpc-flow-logs.amazonaws.com" defined as a trust entity. You can check (and set) the trust entity using the AWS Management Console under the IAM/Roles section and searching for your IAM Role name.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .