AWS CodeBuild now fails with not authorized to perform: logs:ListTagsForResource error

[shawncrawley]

I had never seen this before, but when CodeBuild now attempts to deploy the newly built Docker image to Lambda, it fails with the following:

[Container] 2025/01/13 17:45:04.761232 Running command sls deploy

Deploying hv-vpp-uat-viz-hand-fim-processing to stage dev (us-east-1)

× Stack hv-vpp-uat-viz-hand-fim-processing-dev failed to deploy (11s)
Environment: linux, node 16.20.2, framework 3.38.0, plugin 7.2.3, SDK 4.5.1
Docs:        docs.serverless.com
Support:     forum.serverless.com
Bugs:        github.com/serverless/serverless/issues

Error:
UPDATE_FAILED: LambdaLogGroup (AWS::Logs::LogGroup)
Resource handler returned message: "Encountered a permissions error performing a tagging operation, please add required tag permissions. See https://repost.aws/knowledge-center/cloudformation-tagging-permission-error for how to resolve. Resource handler returned message: "User: arn:aws:sts::799732994462:assumed-role/hv-vpp-uat-us-east-1-viz-pipeline/AWSCodeBuild-7a8e477b-113f-42d2-8d8c-07902764ee6a is not authorized to perform: logs:ListTagsForResource on resource: arn:aws:logs:us-east-1:799732994462:log-group:/aws/lambda/hv-vpp-uat-viz-hand-fim-processing because no identity-based policy allows the logs:ListTagsForResource action (Service: CloudWatchLogs, Status Code: 400, Request ID: 4800607d-548e-44dc-bf81-13179b1b19e3)"" (RequestToken: 043b3afb-0b43-6461-e9ed-2e41d9a6373d, HandlerErrorCode: UnauthorizedTaggingOperation)

View the full error: https://us-east-1.console.aws.amazon.com/cloudformation/home?region=us-east-1#/stack/detail?stackId=arn%3Aaws%3Acloudformation%3Aus-east-1%3A799732994462%3Astack%2Fhv-vpp-uat-viz-hand-fim-processing-dev%2F344b7c70-36ef-11ee-9381-1253896600f7

[Container] 2025/01/13 17:45:21.420345 Command did not exit successfully sls deploy exit status 1
[Container] 2025/01/13 17:45:21.424806 Phase complete: POST_BUILD State: FAILED
[Container] 2025/01/13 17:45:21.424835 Phase context status code: COMMAND_EXECUTION_ERROR Message: Error while executing command: sls deploy. Reason: exit status 1

I'm not sure what recently changed, but apparently the hv-vpp-uat-viz-hand-fim-processing role now needs the logs:ListTagsForResource permission.