fix(cloudwatch-role): allow log group creation for firehose role

Enterprise-CMCS · Jan 22, 2025 · 11c7ad4 · 11c7ad4
1 parent c2a364e
commit 11c7ad4
Showing 1 changed file with 1 addition and 1 deletion.
diff --git a/lib/local-constructs/cloudwatch-to-s3/index.ts b/lib/local-constructs/cloudwatch-to-s3/index.ts
@@ -35,7 +35,7 @@ export class CloudWatchToS3 extends Construct {
 
     firehoseRole.addToPolicy(
       new PolicyStatement({
-        actions: ["logs:PutLogEvents"],
+        actions: ["logs:PutLogEvents", "logs:CreateLogGroup"],
         resources: [
           `arn:aws:logs:${cdk.Stack.of(this).region}:${
             cdk.Stack.of(this).account