EnterpriseLogAccessIamRole can not be altered, eventually throwing limit exceeded errors.

[Will-Bagley]

Are you certain it's a bug?

• Yes, it looks like a bug

Is the issue caused by a plugin?

• It is not a plugin issue

Are you using the latest version?

• Yes, I'm using the latest version

Is there an existing issue for this?

• I have searched existing issues, it hasn't been reported yet

Issue description

I'm running into a problem while trying to deploy my current project where the "EnterpriseLogAccessIamRole" policy is exceeding the maximum limit of 10240 bytes. Given the size of the project, there are simply too many functions to fit within a single policy.
I tried to use this plugin: https://github.com/AntonBazhal/serverless-plugin-custom-roles but it doesn't appear to deal with my particular issue.

I reached out to serverless support and was told that there is indeed no way of altering the output of the EnterpriseLogAccessIamRole policy and that this was a current limitation of serverless. I have been made aware of a workaround (splitting the service into multiple smaller parts), but was urged to log this as an issue in hopes of a less drastic solution being considered.

Service configuration (serverless.yml) content

N/A

Command name and used flags

N/A

Command output

N/A

Environment information

Framework Core: 2.59.0 (local)
Plugin: 5.4.4
SDK: 4.3.0
Components: 3.17.0

[medikoo]

I assume that problematic part of the configured policy is here:

dashboard-plugin/lib/injectLogsIamRole.js

Lines 63 to 66 in 012e2a4

	Resource: entries(ctx.sls.service.provider.compiledCloudFormationTemplate.Resources)
	.filter(([, { Type }]) => Type === 'AWS::Logs::LogGroup')
	.map(([logicalId]) => ({
	'Fn::GetAtt': [logicalId, 'Arn'],

A quick fix that comes to my mind is to allow to override this policy, and then user may come up with some general catch-all rule that will cover all log groups in a given service

[amel-harrath]

any updates regarding this issue? I'm facing the exact same problem and splitting the service is not an option.