Nsryjdtyk

I'm with some problems trying to write my Lambda function logs to CloudWatch Logs. It seems it is not a problem of authorization as you can see below:

PolicyDocument:

    Version: 2012-10-17

    Statement:

        -

          Effect: Allow

          Action:

            - logs:CreateLogGroup

          Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:*

        - Effect: Allow

          Action:

            - logs:CreateLogStream

            - logs:PutLogEvent

          Resource: !Sub arn:aws:logs:${AWS::Region}:${AWS::AccountId}:log-group:/aws/lambda/${FunctionName}:*

I've tried a broader policy as well with arn:aws:logs:*:*:* as resource like some examples I found.

The template works fine on CloudFormation and the resources are created as appropriate, when I execute the lambda function as test everything works fine, but the logs are not written. It creates the log group and the log stream, but nothing is inside the log stream.

This is not a problem with the Lambda function as well. I deployed the function manually before creating the template and the CloudWatch Logs works fine in this case. I copied the role and policy exactly as it is written in the manual approach to create the template.

Is it some kind of known bug in CloudFormation/SAM/Lambda? Or am I doing something wrong I didn't notice?

Please tell me if you need more information to understand the context. Thanks!

In the end I was able to solve the problem but removing the CloudWatch Logs permissions from the policy I wrote and using the Manage Policy from AWS:

ManagedPolicyArns:
- "arn:aws:iam::aws:policy/service-role/AWSLambdaBasicExecutionRole"

With that the logs were wrote to the LogGroup normally.