title: Terraform - Error creating Cloudwatch log subscription filter: InvalidParameterException
body: <p>I am currently stuck with the following error -</p>
  <p>Error: Error creating Cloudwatch log subscription filter: InvalidParameterException: Could not execute the lambda function. Make sure you have given CloudWatch Logs permission to execute your function.</p>
  <pre><code>data &quot;aws_iam_role&quot; &quot;example&quot; {
      name = &quot;notification_lambda_role&quot;
  }
  
  module &quot;lambda_function_existing_package_s3&quot; {
          source = &quot;terraform-aws-modules/lambda/aws&quot;
  
          function_name = &quot;rr-snowplow-lambda-function-test&quot;
          description   = &quot;My awesome lambda function&quot;
          handler       = &quot;lambda_function.lambda_handler&quot;
          runtime       = &quot;python3.8&quot;
  
          create_role = false
          lambda_role = data.aws_iam_role.example.arn
  
          create_package      = false
          s3_existing_package = {
                  bucket = aws_s3_bucket.snowplow_error_log_lambda_source_bucket.id
                  key    = aws_s3_bucket_object.snowplow_error_log_processor_zip.id
          }
  }
  
  resource &quot;aws_cloudwatch_log_group&quot; &quot;test-app-loggroup&quot; {
    name              = &quot;test-app&quot;
    retention_in_days = 90
  }
  
  
  resource &quot;aws_lambda_permission&quot; &quot;allow_cloudwatch&quot; {
    action        = &quot;lambda:InvokeFunction&quot;
    function_name = module.lambda_function_existing_package_s3.lambda_function_name
    principal     = &quot;events.amazonaws.com&quot;
    source_arn    = format(&quot;%s:*&quot;,aws_cloudwatch_log_group.test-app-loggroup.arn)
  }
  
  resource &quot;aws_cloudwatch_log_subscription_filter&quot; &quot;test_lambdafunction_logfilter&quot; {
    name            = &quot;test_lambdafunction_logfilter&quot;
    log_group_name  = &quot;/rr/snowplow/e2-dev&quot;
    filter_pattern  = &quot;ERROR&quot;
    destination_arn = module.lambda_function_existing_package_s3.lambda_function_arn
    depends_on = [ aws_lambda_permission.allow_cloudwatch ]
  </code></pre>
  <p>Terraform version: 0.13.7</p>
  <p>Everything works fine when I create a subscription filter using a management console however it's not working when I try to do it via terraform. What could be wrong here?</p>