Lambda IAM Policy for CloudWatch Logs: Missing CreateLogGroup Permission

Exhibit

Refer to the exhibit.

```json
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "logs:PutLogEvents",
      "Resource": "arn:aws:logs:us-east-1:123456789012:log-group:/aws/lambda/my-function:*"
    }
  ]
}
```

A Lambda function is unable to write logs to CloudWatch Logs. The IAM policy attached to the function's execution role is shown above. What is the issue?

Quick Answer

The answer is that the Lambda IAM policy for CloudWatch Logs is missing the `logs:CreateLogGroup` and `logs:CreateLogStream` permissions. This is the issue because while the policy includes `logs:PutLogEvents` to write log data, it fails to grant the prerequisite actions needed to initialize the log stream and log group in CloudWatch Logs. Without these create permissions, the Lambda function cannot establish the destination for its logs, even though it has the write action. On the AWS Certified DevOps Engineer Professional DOP-C02 exam, this is a classic trap where candidates see `PutLogEvents` and assume all logging permissions are covered, but AWS requires explicit create permissions for the initial setup. A reliable memory tip is "Create before you Put" — think of it as needing to build the bucket before you can fill it with water.

⚠ Common exam trap

The trap is focusing on the logs:PutLogEvents action and its resource ARN, while overlooking the prerequisite actions needed to create the log group and stream.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

The policy is missing the 'logs:CreateLogGroup' and 'logs:CreateLogStream' actions.

The IAM policy attached to the Lambda execution role is missing the logs:CreateLogGroup and logs:CreateLogStream actions. Without these, Lambda cannot create the log group or log stream, and thus cannot write logs to CloudWatch Logs. The logs:PutLogEvents action alone is insufficient because the log group and stream must exist first.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✗
The resource ARN is incorrect; it should include the log stream name.
Why it's wrong here
CloudWatch Logs authorises CreateLogGroup and CreateLogStream against the log-group ARN, while PutLogEvents targets log streams; the shown policy omits the stream-level resource. It is tempting because stream names do appear in ARNs, and would be correct if the failure were on PutLogEvents alone rather than group or stream creation.
✗
The region in the ARN does not match the Lambda function's region.
Why it's wrong here
The ARN region is not the fault; IAM evaluates the resource against the log group in the function's own region, and a mismatched region would simply deny access rather than reflect the policy's structural gap. It is tempting because ARNs are region-scoped, and would be correct if the function wrote cross-region.
✗
The action should be 'logs:PutLogEvents' but the resource is too restrictive.
Why it's wrong here
The resource ARN restricts writes to a single log group, but Lambda needs logs:CreateLogStream and logs:PutLogEvents on the stream ARN, so the action list itself is incomplete. It is tempting because PutLogEvents is genuinely required, yet scoping resources alone cannot fix missing actions.
✓
The policy is missing the 'logs:CreateLogGroup' and 'logs:CreateLogStream' actions.
Why this is correct
Lambda's execution role needs `logs:CreateLogGroup` and `logs:CreateLogStream` before `logs:PutLogEvents` can succeed, since the log group and stream must exist first. Without these actions, the function cannot create its destination, so writes fail regardless of the PutLogEvents permission. This satisfies the stem's requirement for the missing write-enabling actions.

Quick reference

Cloud Service Model Comparison

Model	You Manage	Provider Manages	Examples
IaaS	OS, runtime, apps, data	Hardware, hypervisor, networking	EC2, Azure VMs, GCP Compute Engine
PaaS	Apps and data	OS, runtime, middleware, hardware	Elastic Beanstalk, Azure App Service
SaaS	Data and settings only	Everything else	Microsoft 365, Salesforce, Workday
FaaS / Serverless	Function code only	Infra, scaling, runtime	Lambda, Azure Functions, Cloud Run
CaaS	Containers and apps	Kubernetes, OS, hardware	EKS, AKS, GKE

Go deeper

1 more way this is tested on DOP-C02

These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.

Variation 1. A DevOps engineer is troubleshooting why an AWS Lambda function is not writing logs to the CloudWatch Logs log group 'MyAppLogs'. The Lambda function's execution role includes the IAM policy shown in the exhibit. What is the MOST likely reason the logs are not being written?

hard

A.The log group is in a different AWS Region.
✓ B.The policy does not grant permission to create the log group or put log events to the log group itself.
C.The policy has an incorrect action name.
D.The policy is missing the 'logs:CreateLogGroup' action.

Why B: The most likely reason is that the execution role's policy does not include the permissions needed to create the log group or write log events to it — specifically logs:CreateLogGroup, logs:CreateLogStream, and logs:PutLogEvents scoped to the correct log group ARN. Without these, Lambda cannot emit logs even though the function runs. The exhibit's policy evidently omits or mis-scopes these actions.

Written and reviewed by Johnson Ajibi, MSc IT Security

Senior Network & Security Engineer · founder of Courseiva

Last reviewed September 2026 · checked against the official Amazon Web Services exam blueprint

This DOP-C02 practice question is part of Courseiva's free Amazon Web Services certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the DOP-C02 exam.