ResourcePolicy

Source: src/AWS/Logs/ResourcePolicy.ts

An account-scoped CloudWatch Logs resource policy — grants AWS service principals (Route 53 query logging, API Gateway execution logs, OpenSearch slow logs, …) permission to deliver logs into your account.

AWS allows at most 10 resource policies per region per account and the quota cannot be raised. Always use a deterministic policyName and destroy policies you no longer need.

Granting Log Delivery

const policy = yield* ResourcePolicy("Route53QueryLogging", {
  policyName: "route53-query-logging",
  policyDocument: {
    Version: "2012-10-17",
    Statement: [
      {
        Effect: "Allow",
        Principal: { Service: "route53.amazonaws.com" },
        Action: ["logs:CreateLogStream", "logs:PutLogEvents"],
        Resource: `arn:aws:logs:us-east-1:${accountId}:log-group:/aws/route53/*`,
      },
    ],
  },
});