@incdevco/framework/aws/cloud-formation/templates/cloudwatch-firehose/stack.json

node.js lambda framework

{
  "AWSTemplateFormatVersion": "2010-09-09",
  "Description": "cloudwatch logs to firehose",
  "Outputs": {
    "SubscriptionRoleArn": {
      "Value": {"Fn::GetAtt": ["SubscriptionRole", "Arn"]}
    }
  },
  "Parameters": {},
  "Conditions": {},
  "Mappings": {},
  "Resources": {
    "SubscriptionRole": {
      "Type": "AWS::IAM::Role",
      "Properties": {
        "AssumeRolePolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect": "Allow",
              "Principal": {
                "Service": {"Fn::Join": ["", [
                  "logs.",
                  {"Ref": "AWS::Region"},
                  ".amazonaws.com"
                ]]}
              },
              "Action": "sts:AssumeRole"
            }
          ]
        },
        "ManagedPolicyArns": [],
        "Path": "/",
        "Policies": []
      }
    },
    "SubscriptionPolicy": {
      "Type": "AWS::IAM::Policy",
      "DependsOn": [
        "SubscriptionRole"
      ],
      "Properties": {
        "PolicyDocument": {
          "Version": "2012-10-17",
          "Statement": [
            {
              "Effect":"Allow",
              "Action":[
                "firehose:*"
              ],
              "Resource":[
                {"Fn::Join": ["", [
                  "arn:aws:firehose:",
                  {"Ref": "AWS::Region"},
                  ":",
                  {"Ref": "AWS::AccountId"},
                  ":*"
                ]]}
              ]
            },
            {
              "Effect":"Allow",
              "Action":[
                "iam:*"
              ],
              "Resource":[
                {"Fn::GetAtt": ["SubscriptionRole", "Arn"]}
              ]
            }
          ]
        },
        "PolicyName": "FirehosePermissions",
        "Roles": [
          {"Ref": "SubscriptionRole"}
        ]
      }
    }
  }
}