Create or update an IAM role for Amazon VPC Transit Gateways Flow Logs - Amazon VPC
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Create or update an IAM role for Amazon VPC Transit Gateways Flow Logs

You can update an existing role or use the following procedure to create a new role for use with flow logs using the Amazon Identity and Access Management console.

To create an IAM role for flow logs

  1. Open the IAM console at https://console.amazonaws.cn/iam/.

  2. In the navigation pane, choose Roles, Create role.

  3. For Select type of trusted entity, choose Amazon service. For Use case, choose EC2. Choose Next.

  4. On the Add permissions page, choose Next: Tags and optionally add tags. Choose Next.

  5. On the Name, revew, and create page enter a name for your role and optionally provide a Description. Choose Create role.

  6. Choose the name of your role. For Add permissions, choose Create inline policy, and then choose the JSON tab.

  7. Copy the first policy from IAM roles for publishing flow logs to CloudWatch Logs and paste it in the window. Choose Review policy.

  8. Enter a name for your policy, and choose Create policy.

  9. Select the name of your role. For Trust relationships, choose Edit trust relationship. In the existing policy document, change the service from ec2.amazonaws.com to vpc-flow-logs.amazonaws.com. Choose Update Trust Policy.

  10. On the Summary page, note the ARN for your role. You need this ARN when you create your flow log.