# Aws Cloudwatch log and lambda permissions

**URL:** <https://discuss.hashicorp.com/t/aws-cloudwatch-log-and-lambda-permissions/12753>\
**Category:** AWS\
**Created:** [August 13, 2020, 2:30am UTC](https://discuss.hashicorp.com/t/aws-cloudwatch-log-and-lambda-permissions/12753 "2020-08-13T02:30:49Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![jpdentone](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/jpdentone/32/2780_2.png) [@jpdentone](https://discuss.hashicorp.com/u/jpdentone)\
**Post date:** [August 13, 2020, 2:30am UTC](https://discuss.hashicorp.com/t/aws-cloudwatch-log-and-lambda-permissions/12753/1 "2020-08-13T02:30:49Z")

</div>

I’m upgrading to v13 and I’m having this issue, so this is the code I was running on v12

"data “aws\_lambda\_function” “logdna” {  
function\_name = “logdna\_${var.environment}\_cloudwatch”  
}

resource “aws\_cloudwatch\_log\_group” “default” {  
name = “/ecs/${var.service\_id}”  
retention\_in\_days = “14”  
}

resource “aws\_cloudwatch\_log\_subscription\_filter” “default” {  
name = “${var.service\_id}\_logfilter”  
log\_group\_name = aws\_cloudwatch\_log\_group.default.name  
filter\_pattern = “”  
destination\_arn = data.aws\_lambda\_function.logdna.arn  
}

resource “aws\_lambda\_permission” “default” {  
statement\_id = “AllowExecutionFrom-service”  
action = “lambda:InvokeFunction”  
function\_name = “logdna\_${var.environment}\_cloudwatch”  
principal = “[logs.ca-central-1.amazonaws.com](http://logs.ca-central-1.amazonaws.com)”  
source\_arn = aws\_cloudwatch\_log\_group.default.arn  
}"

now on v13 I get this errror

“Error: Error creating Cloudwatch log subscription filter: InvalidParameterException: Could not execute the lambda function. Make sure you have given CloudWatch Logs permission to execute your function.”

I tried setting up the principal to “[logs.amazonaws.com](http://logs.amazonaws.com)” but I got the same

any idea what could be wrong?

Thanks in advance