more specific resources in iam policies

infrastructure/cdk/lib/image-processor-lambda-stack.ts

@@ -113,7 +113,7 @@ export class ImageProcessorLambdaStack extends cdk.Stack {
       description: "Execution role for Image Processor Lambda",
     });
 
-    // CloudWatch Logs permissions
+    // CloudWatch Logs permissions - scoped to this Lambda's log group
     lambdaRole.addToPolicy(
       new iam.PolicyStatement({
         effect: iam.Effect.ALLOW,
@@ -122,7 +122,10 @@ export class ImageProcessorLambdaStack extends cdk.Stack {
           "logs:CreateLogStream",
           "logs:PutLogEvents",
         ],
-        resources: ["*"],
+        resources: [
+          `arn:aws:logs:${this.region}:${this.account}:log-group:/aws/lambda/image-processor-${environment}`,
+          `arn:aws:logs:${this.region}:${this.account}:log-group:/aws/lambda/image-processor-${environment}:*`,
+        ],
       })
     );