AWSTemplateFormatVersion: '2010-09-09'
Description: Vectra Cloudwatch Logs User version 1.2
Resources:
  user:
    Properties:
      Policies:
        - PolicyDocument:
            Statement:
              - Action:
                  - logs:CreateLogStream
                  - logs:DeleteLogStream
                  - logs:DescribeLogStreams
                  - logs:GetLogEvents
                  - logs:PutLogEvents
                  - logs:DeleteLogGroup
                  - logs:GetLogEvents
                  - logs:PutRetentionPolicy
                Effect: Allow
                Resource:
                  - !Join
                    - ''
                    - - 'arn:'
                      - !Ref 'AWS::Partition'
                      - :logs:*:*:log-group:/vectra/cognito/*
                Sid: CreateDeleteAndRetrieveVectraCloudwatchGroupLogEvents
              - Action:
                  - iam:SimulatePrincipalPolicy
                  - logs:DeleteLogGroup
                  - logs:CreateLogGroup
                  - sts:GetCallerIdentity
                Effect: Allow
                Resource:
                  - '*'
                Sid: CreateVectraLogs
            Version: '2012-10-17'
          PolicyName: vectra_cloudwatch_log_permissions
      UserName: VectraCognitoCloudwatchLogsv1
    Type: AWS::IAM::User
