Lambda CreateFunctionCommand ignores LoggingConfig LogGroup #7524
Description
Checkboxes for prior research
- I've gone through Developer Guide and API reference
- I've checked AWS Forums and StackOverflow.
- I've searched for previous similar issues and didn't find any solution.
Describe the bug
Lambda create function and update function configuration commands appear to ignore a logging config defined with custom log group name.
SDK CreateFunctionCommand input:
{
"FunctionName": "chartlab-api-fn-exhibit-data-stg-65f2020",
"Architectures": [
"x86_64"
],
"Code": {
"ZipFile": "<binary-data>"
},
"Handler": "index.handler",
"MemorySize": 10240,
"PackageType": "Zip",
"Runtime": "nodejs22.x",
"Timeout": 15,
"LoggingConfig": {
"ApplicationLogLevel": "INFO",
"LogFormat": "Text",
"LogGroup": "chartlab-staging",
"SystemLogLevel": "WARN"
},
"Role": "arn:aws:iam::<account-id>:role/chartlab-api-fn-exhibit-data-stg-65f2020"
}
Lambda IAM execution role, relevant statements:
{
"Action": [
"logs:CreateLogGroup"
],
"Effect": "Allow",
"Resource": "arn:aws:logs::<account-id>"
},
{
"Action": [
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Effect": "Allow",
"Resource": "arn:aws:logs:*:<account-id>:log-group:chartlab-staging:*"
}
Note that I have also tried including us-east-1 in the ARN for the log group.
Resulting function configuration:
Regression Issue
- Select this option if this issue appears to be a regression.
SDK version number
"@aws-sdk/client-lambda": "^3.421.0"
Which JavaScript Runtime is this issue in?
Node.js
Details of the browser/Node.js/ReactNative version
Node 22
Reproduction Steps
Send a CreateFunctionCommand or UpdateFunctionConfigurationCommand with LoggingConfig and LogGroup defined as the name of an existing CloudWatch log group.
Observed Behavior
The Lambda is created with the default log group for the function, not the specified custom log group. An existing Lambda is not updated to use the specified custom log group.
Expected Behavior
The Lambda function should be created/updated with configuration pointing to the specified custom log group.
Possible Solution
No response
Additional Information/Context
Based on recommendations in this thread (https://repost.aws/questions/QUlT1sVDquRimFlJl_tlg1iA/lambda-custom-log-group) I have updated the IAM role for my function to include grants for creating log streams and putting log events for the specific named log group. I have also tried removing the AWS basic lambda execution role so that there is only a single set of logging permissions pointing to my custom log group.
I encounter no problems changing the function log group in the AWS console after the resource is created.