title: How to stop AWS Lambda function to log on CloudWatch
body: <p>AWS Lambda logging on CloudWatch may become an huge hidden cost if you have a lot of them, because there are no way to tell AWS to stop logging on CloudWatch platform.
  The only way I have found to do that is to manage a custom IAM policy (associated with every lambda) and explicitally deny access to the <strong>logs:...</strong> actions:</p>
  
  <pre><code>{
          "Sid": "DisableAllLogs",
          "Resource": "*",
          "Action": [
              "logs:CreateLogGroup",
              "logs:CreateLogStream",
              "logs:PutLogEvents"
          ],
          "Effect": "Deny"
  }
  </code></pre>
  
  <p>Now I'm trying to fine graining the policy to let only some lambda to log. To do that I'm using the <strong>Condition</strong> parameters of the policy:</p>
  
  <pre><code>{
          "Sid": "EnableLogsForWantedLambdaTriggers",
          "Resource": "*",
          "Condition": {
              "ArnEquals": {
                  "aws:SourceArn": "arn:aws:lambda:REGION:ACCOUNT-ID:function:FUNCTION-NAME"
              }
          },
          "Action": [
              "logs:CreateLogGroup",
              "logs:CreateLogStream",
              "logs:PutLogEvents"
          ],
          "Effect": "Allow"
  }
  </code></pre>
  
  <p>but in this way no log is sent to CloudWatch. I think that the source ARN is wrong but I can't figure out to find the correct one.</p>
  
  <p>Any clues?</p>