from troposphere import Join, iam, logs

from .common import arn_prefix
from .template import template

container_log_group = logs.LogGroup(
    "ContainerLogs",
    template=template,
    RetentionInDays=365,
    DeletionPolicy="Retain",
)


logging_policy = iam.Policy(
    PolicyName="LoggingPolicy",
    PolicyDocument=dict(
        Statement=[dict(
            Effect="Allow",
            Action=[
                "logs:Create*",
                "logs:PutLogEvents",
            ],
            Resource=Join("", [
                arn_prefix,
                ":logs:*:*:*",  # allow logging to any log group
            ]),
        )],
    ),
)

from troposphere import Join, iam, logs

from .common import arn_prefix
from .template import template

container_log_group = logs.LogGroup(
    "ContainerLogs",
    template=template,
    RetentionInDays=365,
    DeletionPolicy="Retain",
)


logging_policy = iam.Policy(
    PolicyName="LoggingPolicy",
    PolicyDocument=dict(
        Statement=[dict(
            Effect="Allow",
            Action=[
                "logs:Create*",
                "logs:PutLogEvents",
                # Needed by aws-for-fluent-bit:
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
            ],
            Resource=Join("", [
                arn_prefix,
                ":logs:*:*:*",  # allow logging to any log group
            ]),
        )],
    ),
)

Add logging permissions needed by aws-for-fluent-bit
Add logging permissions needed by aws-for-fluent-bit
  from troposphere import Join, iam, logs
  
  from .common import arn_prefix
  from .template import template
  
  container_log_group = logs.LogGroup(
      "ContainerLogs",
      template=template,
      RetentionInDays=365,
      DeletionPolicy="Retain",
  )
  
  
  logging_policy = iam.Policy(
      PolicyName="LoggingPolicy",
      PolicyDocument=dict(
          Statement=[dict(
              Effect="Allow",
              Action=[
                  "logs:Create*",
                  "logs:PutLogEvents",
+                 # Needed by aws-for-fluent-bit:
+                 "logs:DescribeLogGroups",
+                 "logs:DescribeLogStreams",
              ],
              Resource=Join("", [
                  arn_prefix,
                  ":logs:*:*:*",  # allow logging to any log group
              ]),
          )],
      ),
  )
  
Add logging permissions needed by aws-for-fluent-bit
## Code Before:
from troposphere import Join, iam, logs

from .common import arn_prefix
from .template import template

container_log_group = logs.LogGroup(
    "ContainerLogs",
    template=template,
    RetentionInDays=365,
    DeletionPolicy="Retain",
)


logging_policy = iam.Policy(
    PolicyName="LoggingPolicy",
    PolicyDocument=dict(
        Statement=[dict(
            Effect="Allow",
            Action=[
                "logs:Create*",
                "logs:PutLogEvents",
            ],
            Resource=Join("", [
                arn_prefix,
                ":logs:*:*:*",  # allow logging to any log group
            ]),
        )],
    ),
)

## Instruction:
Add logging permissions needed by aws-for-fluent-bit
## Code After:
from troposphere import Join, iam, logs

from .common import arn_prefix
from .template import template

container_log_group = logs.LogGroup(
    "ContainerLogs",
    template=template,
    RetentionInDays=365,
    DeletionPolicy="Retain",
)


logging_policy = iam.Policy(
    PolicyName="LoggingPolicy",
    PolicyDocument=dict(
        Statement=[dict(
            Effect="Allow",
            Action=[
                "logs:Create*",
                "logs:PutLogEvents",
                # Needed by aws-for-fluent-bit:
                "logs:DescribeLogGroups",
                "logs:DescribeLogStreams",
            ],
            Resource=Join("", [
                arn_prefix,
                ":logs:*:*:*",  # allow logging to any log group
            ]),
        )],
    ),
)
