AWS transform documentation change

Service: transform · 2026-05-07 · Documentation low

File: transform/latest/userguide/using-service-linked-roles.md

Summary

Added CloudWatch Logs permissions to service-linked role for publishing transformation logs

Security assessment

The change adds logging capabilities to the service role, improving security visibility by documenting how transformation issues are logged. This enhances security monitoring but doesn't address a specific vulnerability.

Diff

diff --git a/transform/latest/userguide/using-service-linked-roles.md b/transform/latest/userguide/using-service-linked-roles.md
index 78fb61537..80f4b8b76 100644
--- a//transform/latest/userguide/using-service-linked-roles.md
+++ b//transform/latest/userguide/using-service-linked-roles.md
@@ -122 +122 @@ Europe (Frankfurt) | eu-central-1 | Yes
-AWS Transform Custom uses the service-linked role named **AWSServiceRoleForAWSTransformCustom** to publish metrics to your account on your behalf. These metrics let you monitor transformation counts, latencies, and status codes directly in your dashboards.
+AWS Transform Custom uses the service-linked role named **AWSServiceRoleForAWSTransformCustom** to publish metrics and logs to your account on your behalf. These metrics let you monitor transformation counts, latencies, and status codes directly in your dashboards. Logs provide visibility into issues encountered during transformations.
@@ -144,0 +145,14 @@ The role permissions policy named AWSServiceRoleForAWSTransformCustom allows AWS
+  * `logs:CreateLogGroup` and `logs:PutRetentionPolicy` on the `/aws/TransformCustom` log group
+
+    * Create the CloudWatch Logs log group for publishing transformation logs
+
+    * Set log retention policies on the log group
+
+    * Scoped to `arn:aws:logs:*:*:log-group:/aws/TransformCustom` with an `aws:ResourceAccount` condition ensuring access only within your account
+
+  * `logs:CreateLogStream` and `logs:PutLogEvents` on log streams within the `/aws/TransformCustom` log group
+
+    * Create log streams and publish log events for transformation operations
+
+    * Scoped to `arn:aws:logs:*:*:log-group:/aws/TransformCustom:log-stream:*` with an `aws:ResourceAccount` condition ensuring access only within your account
+