Why can't I see logs in my lambda function? - amazon-web-services

Question

I've been trying in vain to see logs for my lambda function. No matter what I see this:
To be clear, the lambda function runs properly. I just can't see the logs at all.
I've recreated the function multiple times to make sure it wasn't me accidentally mucking with a setting that disabled logging.
My steps:
From the AWS Lambda function page, create a new function. I'm using nodejs 8.10, but it seems to fail even if I use a 6.x version.
Upload a zip file with my function (including the node_modules directory, package.json and package-lock.json as well) to S3 into testbucket with the filename thumbnails.zip.
Use this command to publish my lambda function from S3: aws lambda update-function-code --function-name transcode-v2 --s3-bucket mytestbucket --s3-key thumbnails.zip.
I can test my function with sample data and the test button.
I can also invoke it from the CLI and it seems to "work" (in that it runs)
I always see this message when I go to cloud logs: There was an error loading Log Streams. Please try again by refreshing this page. I've tried recreating the function twice and this does not fix it.
Anyone know what is wrong here? The function seems to work under test (meaning, I see logs inside the test logging dialog), and when I invoke from the command line. But, nothing ever gets into the cloud logging page except for that error.
I can see that invocations are being triggered from AWS.

Answer 1

When an AWS role is created, you must provide an IAM Role that will be used by the Lambda function. The permissions associated with the role will grant access to AWS services and resources required by the Lambda function.
There is a default AWSLambdaBasicExecutionRole that provides:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "*"
}
]
}
These permissions allow the Lambda function to write log information to Amazon CloudWatch Logs.
There are other available Roles too, such as AWSLambdaExecute:
{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:*"
],
"Resource": "arn:aws:logs:*:*:*"
},
{
"Effect": "Allow",
"Action": [
"s3:GetObject",
"s3:PutObject"
],
"Resource": "arn:aws:s3:::*"
}
]
}
So, either use one of these pre-provided roles, or add similar permissions to the Role that your Lambda function is using.