Which permission is required to see Fargate container logs

Question

We are using AWS ECS Fargate to host our application. I have this "Reader" IAM user who can't change anything but only can see stuff.

I've managed to configure the permissions for this Reader user so the user can see the service cluster, the services in it, and the tasks in those services. But this user can't see the logs for those tasks. In fact, the user can't even see the "Logs" tab in the screenshot below:

The interesting thing is: The user already has permission for Cloudwatch logs so can see these task logs if accessed via Cloudwatch LogGroups page, but not through ECS task detais page.

Which permission do I need to set to let the user see the task logs?

Answer 1

Try with:

• describe-log*
• get-log*
• filter-log-events
• list-tags-log-group