fix: combine resource policy for service quota limit (#895)

NASA-IMPACT · Sep 16, 2024 · 0683e88 · 0683e88
1 parent 60224f1
commit 0683e88
Showing 1 changed file with 13 additions and 0 deletions.
diff --git a/stack/app.py b/stack/app.py
@@ -262,6 +262,19 @@ def __init__(
             tls_security_policy=opensearch.TLSSecurityPolicy.TLS_1_2,  # [Opensearch.8]
         )
 
+        apt_opensearch_policy_statement = iam.PolicyStatement(
+            effect=iam.Effect.ALLOW,
+            principals=[iam.ServicePrincipal("es.amazonaws.com")],
+            actions=["logs:PutLogEvents", "logs:CreateLogStream"],
+            resources=[
+                app_log.log_group_arn,
+                audit_log.log_group_arn,
+            ],
+        )
+
+        app_log.add_to_resource_policy(apt_opensearch_policy_statement)
+        audit_log.add_to_resource_policy(apt_opensearch_policy_statement)
+
         ses_access = iam.PolicyStatement(actions=["ses:SendEmail"], resources=["*"])
         sqs_access = iam.PolicyStatement(actions=["sqs:SendMessage"], resources=["*"])