Policy: AWS > VPC > VPC > Flow Logging > Cloud Watch > Role

The name of an IAM role that Flow Logging will assume to write logs to CloudWatch logs. If CloudWatch Log forwarding is enabled, you must also specify a role that CloudTrail can assume to write the logs. This role must have the correct access for the CloudWatch Log Group, and must allow the CloudTrail Service (cloudtrail.amazonaws.com) the ability to assume the role The role must already exist - the stack wont create it

Targets

This policy targets the following resource types:

AWS > VPC > VPC

Primary Policy

This policy is used with the following primary policy:

AWS > VPC > VPC > Flow Logging > Cloud Watch

Policy Packs

This policy setting is used by the following policy packs:

Enforce Flow Logging to CloudWatch Log Groups Is Enabled for AWS VPCs

Policy Specification

Schema Type	`string`
Default template	`{{ $.roleName }}`
Default template input	`- \| { account { turbot { id } } } - \| { roleName: policy(uri:"aws#/policy/types/serviceRolesFlowLoggingName", resourceId: "{{ $.account.turbot.id }}") }`

In Your Workspace

Policy Settings by Type report

Developers

Category URI

tmod:@turbot/turbot#/control/categories/turbot

Policy Type URI

tmod:@turbot/aws-vpc-core#/policy/types/vpcFlowLoggingCloudWatchRole

GraphQL

query policyType(id: "tmod:@turbot/aws-vpc-core#/policy/types/vpcFlowLoggingCloudWatchRole") { … }

query policySettings(filter: "policyTypeId:'tmod:@turbot/aws-vpc-core#/policy/types/vpcFlowLoggingCloudWatchRole'") { … }

query policyValues(filter: "policyTypeId:'tmod:@turbot/aws-vpc-core#/policy/types/vpcFlowLoggingCloudWatchRole'") { … }

CLI

Get Policy Type

turbot graphql policy-type --id "tmod:@turbot/aws-vpc-core#/policy/types/vpcFlowLoggingCloudWatchRole"

Get Policy Settings

turbot graphql policy-settings --filter "policyTypeId:tmod:@turbot/aws-vpc-core#/policy/types/vpcFlowLoggingCloudWatchRole"