Execution role

1. Now that we have learned how to write our first Go Lambda function, let's create a new IAM role from Identity and Access Management (https://console.aws.amazon.com/iam/home) to grant the function access to AWS CloudWatch Logs:

2. In the permissions page, you can either choose an existing AWS managed policy called CloudWatchFullAccessor (as shown in Step 3) create a least-privilege IAM role (the second option is recommended by AWS; a chapter dedicated to this will discuss security best practices for Lambda functions in depth):

3. Go ahead and click on the Create policy button, and create a policy by selecting the appropriate service (CloudWatch) from the visual editor:

4. For readers familiar with the JSON format, a JSON policy document can be used instead in the JSON tab. The document must have one statement that grants permissions to create log groups and log streams, and to upload log events to AWS CloudWatch:

{
 "Version": "2012-10-17",
 "Statement": [
    {
      "Sid": "VisualEditor0...