The datadog-ci lambda cloudwatch disable command attaches an IAM deny policy to the execution role of each specified Lambda function, blocking CloudWatch log delivery.

First, perform a dry run to preview which functions are affected:

datadog-ci lambda cloudwatch disable --dry-run -f <ARN>

After you confirm the output, run the command without the --dry-run flag:

datadog-ci lambda cloudwatch disable -f <ARN>

To disable CloudWatch logs for multiple functions at once, use --functions-regex:

datadog-ci lambda cloudwatch disable --region <region> --functions-regex <REGEX>

Note: This command requires valid AWS credentials configured in your environment. See the Datadog CLI documentation for setup details.

Add a deny statement to provider.iam.role.statements in your serverless.yml:

provider:
  iam:
    role:
      statements:
        - Effect: Deny
          Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
          Resource: !Sub "arn:aws:logs:*:*:log-group:/aws/lambda/${self:service}-${sls:stage}-<FUNCTION_NAME>:*"

Replace <FUNCTION_NAME> with the name of your function as defined in the functions block. By default, Serverless Framework names Lambda functions <service>-<stage>-<functionName>.

Note: This adds the deny statement to the shared execution role policy rather than creating a separately named DenyCloudWatchLogs policy, but the effect is equivalent. To disable CloudWatch logs for all functions in the service, use a wildcard:

Resource: !Sub "arn:aws:logs:*:*:log-group:/aws/lambda/${self:service}-${sls:stage}-*:*"

Add an AWS::IAM::Policy resource that denies CloudWatch Logs actions for the function’s log group:

DenyCloudWatchLogsPolicy:
  Type: AWS::IAM::Policy
  Properties:
    PolicyName: DenyCloudWatchLogs
    Roles:
      - !Ref ExampleFunctionRole
    PolicyDocument:
      Version: "2012-10-17"
      Statement:
        - Effect: Deny
          Action:
            - logs:CreateLogGroup
            - logs:CreateLogStream
            - logs:PutLogEvents
          Resource: !Sub "arn:aws:logs:*:*:log-group:/aws/lambda/${ExampleFunction}:*"

Replace ExampleFunctionRole and ExampleFunction with references to your own resources.

Add a deny policy statement to the Policies property of your AWS::Serverless::Function resource:

Resources:
  ExampleFunction:
    Type: AWS::Serverless::Function
    Properties:
      # ... other configuration ...
      Policies:
        - Statement:
            - Effect: Deny
              Action:
                - logs:CreateLogGroup
                - logs:CreateLogStream
                - logs:PutLogEvents
              Resource: !Sub "arn:aws:logs:*:*:log-group:/aws/lambda/${ExampleFunction}:*"

Note: SAM’s Policies property creates an unnamed inline policy. To create a named DenyCloudWatchLogs policy, add an AWS::IAM::Policy resource as shown in the AWS CloudFormation tab.

Create a named DenyCloudWatchLogs inline policy and attach it to the function’s execution role:

import * as iam from "aws-cdk-lib/aws-iam";

const denyCloudWatchLogsPolicy = new iam.Policy(this, "DenyCloudWatchLogsPolicy", {
  policyName: "DenyCloudWatchLogs",
  statements: [
    new iam.PolicyStatement({
      effect: iam.Effect.DENY,
      actions: ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"],
      resources: [`${myFunction.logGroup.logGroupArn}:*`],
    }),
  ],
});

denyCloudWatchLogsPolicy.attachToRole(myFunction.role!);

Add an aws_iam_role_policy resource that denies CloudWatch Logs actions for the function’s log group:

resource "aws_iam_role_policy" "deny_cloudwatch_logs" {
  name = "DenyCloudWatchLogs"
  role = aws_iam_role.lambda_execution.name

  policy = jsonencode({
    Version = "2012-10-17"
    Statement = [{
      Effect   = "Deny"
      Action   = ["logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents"]
      Resource = "arn:aws:logs:*:*:log-group:/aws/lambda/${aws_lambda_function.example.function_name}:*"
    }]
  })
}

Replace aws_iam_role.lambda_execution and aws_lambda_function.example with references to your own resources.

1. Open the IAM console and navigate to Roles.
2. Find and select the execution role for your Lambda function.
3. Under Permissions, choose Add permissions > Create inline policy.
4. Switch to the JSON editor and paste the following policy:

   {
     "Version": "2012-10-17",
     "Statement": [
       {
         "Effect": "Deny",
         "Action": [
           "logs:CreateLogGroup",
           "logs:CreateLogStream",
           "logs:PutLogEvents"
         ],
         "Resource": "arn:aws:logs:*:*:log-group:/aws/lambda/<FUNCTION_NAME>:*"
       }
     ]
   }
   

   Replace <FUNCTION_NAME> with the name of your Lambda function.
5. Click Next, name the policy DenyCloudWatchLogs, and click Create policy.