title: What permissions does codebuild need to write cloudwatch logs when inside a VPC?
body: <p>I have a codebuild project that I'm launching inside a VPC.  When outside of the VPC, the project runs and logs into Cloudwatch logs.  I need to move inside the VPC so that it can access the database.  When inside the VPC, the install stage fails and codebuild fails to write anything to Cloudwatch logs.  The console page for the build says: </p>
  
  <blockquote>
    <p>Error: The specified log stream does not exist.</p>
  </blockquote>
  
  <p>I expect that security groups are the problem, but <a href="https://docs.aws.amazon.com/vpc/latest/userguide/flow-logs.html" rel="nofollow noreferrer">flow logs</a> are on, and they aren't showing blocked traffic for the codebuild ENI.</p>
  
  <p>There is an internet gateway for the VPC, and the subnet has routes to the internet using the gateway.</p>
  
  <p>The codebuild project is built by cloudformation.  Logs are written when the <a href="https://github.com/awsdocs/aws-cloudformation-user-guide/blob/master/doc_source/aws-properties-codebuild-project-vpcconfig.md" rel="nofollow noreferrer">VpcConfig</a> of the codebuild project is commented out, but not when it is included.  I believe that demonstrates that IAM permissions are not the problem.</p>
  
  <p>Any suggestions are appreciated.</p>