Same comment as above, this does not seem to move the needle much in terms of actual permission scopes. However here we could be more specific, since we know the exact log group we're interested into, which is tower/nextflow-run
Originally posted by @stefanoboriero in #839 (comment)