The IAM permission logs:* provides access to AWS CloudWatch Logs. This permission is currently granted to a few services, however it is never used as:
To further increase the principle of least privilege, we can immediately remove this permission from the EC2 applications. We can also remove the permission from a GuCDK defined Lambda, as it'll use the AWSLambdaBasicExecutionRole (see also #1616).
The IAM permission
logs:*provides access to AWS CloudWatch Logs. This permission is currently granted to a few services, however it is never used as:devx-logs#1631 logs from EC2 are shipped to Central ELK using devx-logsaws-java-sdk-logs(from Java SDK v1) orcloudwatchlogs(from Java SDK v2). It doesn't appear transitively either.To further increase the principle of least privilege, we can immediately remove this permission from the EC2 applications. We can also remove the permission from a GuCDK defined Lambda, as it'll use the AWSLambdaBasicExecutionRole (see also #1616).