# AWS Lambda Function CloudWatch Logging and Permissions Documentation Restricting

**URL:** <https://discuss.hashicorp.com/t/aws-lambda-function-cloudwatch-logging-and-permissions-documentation-restricting/42180>\
**Category:** AWS\
**Created:** [July 19, 2022, 5:20pm UTC](https://discuss.hashicorp.com/t/aws-lambda-function-cloudwatch-logging-and-permissions-documentation-restricting/42180 "2022-07-19T17:20:42Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![fishcharlie](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/fishcharlie/32/29543_2.png) [@fishcharlie](https://discuss.hashicorp.com/u/fishcharlie)\
**Post date:** [July 19, 2022, 5:20pm UTC](https://discuss.hashicorp.com/t/aws-lambda-function-cloudwatch-logging-and-permissions-documentation-restricting/42180/1 "2022-07-19T17:20:42Z")

</div>

It seems like under the `aws_lambda_function` documentation for [CloudWatch Logging and Permissions](https://registry.terraform.io/providers/hashicorp/aws/latest/docs/resources/lambda_function#cloudwatch-logging-and-permissions) that the policy could be more restricting.

Couldn’t you utilize the aws\_cloudwatch\_log\_group ARN output to only allow it to log to that specific ARN?

Also, slightly confused about the purpose of the logs:CreateLogGroup action. We already created the log group in the example, so why do we need to give permissions to create log group?