title: How to create CloudWatch logs trigger for AWS Lambda function using aws SDK?
body: <p>I according to <a href="https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/CloudWatchLogs.html#putSubscriptionFilter-property" rel="nofollow noreferrer">https://docs.aws.amazon.com/AWSJavaScriptSDK/latest/AWS/CloudWatchLogs.html#putSubscriptionFilter-property</a></p>
  
  <p>nodejs</p>
  
  <pre><code>const AWS = require('aws-sdk');
  AWS.config = new AWS.Config
      ({
          accessKeyId: "AKIA******",
          secretAccessKey: "6RJf******vy",
      });
  const cloudwatchlogs = new AWS.CloudWatchLogs({ region: 'a******1' });
  
  var params = {
      destinationArn: 'arn:aws:lambda:******:function:******', 
      filterName: 'LambdaStream_******', 
      filterPattern: '?Error ?Waring ?error ?"node(1)" ?info ?INFO', 
      logGroupName: '/aws/lambda/******', 
      distribution: 'ByLogStream',
  };
  cloudwatchlogs.putSubscriptionFilter(params, function (err, data) {
      if (err) console.log( err, err.stack);
      else console.log(data);
  });
  </code></pre>
  
  <p>I will get the following error:</p>
  
  <pre><code> { InvalidParameterException: Could not execute the lambda function. Make sure you have given CloudWatch Logs permission to ex ecute your function.
      at Request.extractError 
  
  ......
  
  (/mnt/******/node_modules/aws-sdk/lib/sequential_executor.js:116:18) message: 'Could not execute the lambda function. Make sure you have given CloudWatch Logs permission to execute your function.',   code: 'InvalidParameterException',   time: 2019-03-21T03:05:47.966Z,   requestId: '39c9******3',   statusCode: 400,  retryable: false,   retryDelay: ******86 } InvalidParameterException: Could not execute the lambda function. Make sure you have given CloudWatch Logs permission to execute your function.
  </code></pre>
  
  <p>supplement：
  <a href="https://i.stack.imgur.com/f0Iv7.jpg" rel="nofollow noreferrer">enter image description here</a></p>
  
  <p>I gave these executive roles：</p>
  
  <pre><code>  AWSLambdaFullAccess
    CloudWatchFullAccess
    CloudWatchLogsFullAccess
    AmazonVPCFullAccess
    AWSLambdaVPCAccessExecutionRole
    AWSLambdaRole
  
  
  
  
  {
      "Version": "2012-10-17",
      "Statement": [
          {
              "Effect": "Allow",
              "Action": [
                  "logs:CreateLogGroup",
                  "logs:CreateLogStream",
                  "logs:PutSubscriptionFilter",
                  "logs:PutLogEvents"
              ],
              "Resource": "arn:aws:logs:*:*:*"
          }
      ]
  }
  </code></pre>