Execution role

1. Now that we have learned how to write our first Go Lambda function, let's create a new IAM role from Identity and Access Management (https://console.aws.amazon.com/iam/home) to grant the function access to AWS CloudWatch Logs:

2. In the permissions page, you can either choose an existing AWS managed policy called CloudWatchFullAccess or (as shown in Step 3) create a least-privilege IAM role (the second option is recommended by AWS; a chapter dedicated to this will discuss security best practices for Lambda functions in depth):

3. Go ahead and click on the Create policy button, and create a policy by selecting the appropriate service (CloudWatch) from the visual editor:

4. For readers familiar with the JSON format, a JSON policy document can be used instead in the JSON tab. The document must have one statement that grants permissions to create log groups and...