What minimal IAM permissions are needed by AWS Chatbot so that it can show logs?
AWS Chatbot uses CloudWatch Logs Insights, so the IAM policy for Chatbot must include these two statements:
{
    &quot;Sid&quot;: &quot;QueryLogs&quot;,
    &quot;Effect&quot;: &quot;Allow&quot;,
    &quot;Action&quot;: [
        &quot;logs:StopQuery&quot;,
        &quot;logs:StartQuery&quot;,
        &quot;logs:DescribeQueries&quot;
    ],
    &quot;Resource&quot;: &quot;arn:aws:logs:::log-group:/aws/lambda/*&quot;
},
{
    &quot;Sid&quot;: &quot;GetQueryResults&quot;,
    &quot;Effect&quot;: &quot;Allow&quot;,
    &quot;Action&quot;: &quot;logs:GetQueryResults&quot;,
    &quot;Resource&quot;: &quot;*&quot;
}

With these statements in place, pressing the logs button will yield an initial message from Chatbot like this:

I ran this CloudWatch Logs Insights query to fetch logs from 2020-11-18T09:02 UTC to 2020-11-18T09:07 UTC.

... as well as several follow-up messages containing a plaintext dump of the logs.