diff --git a/CHANGELOG.md b/CHANGELOG.md
index d091dca..6c588e6 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -2,6 +2,13 @@
All notable changes to this project will be documented in this file.
+## [3.1.0](https://github.com/terraform-aws-modules/terraform-aws-appsync/compare/v3.0.0...v3.1.0) (2025-02-02)
+
+
+### Features
+
+* Add support for configurable logs role description ([#71](https://github.com/terraform-aws-modules/terraform-aws-appsync/issues/71)) ([f05674b](https://github.com/terraform-aws-modules/terraform-aws-appsync/commit/f05674b00e37bb98641598f8ca2eb635acc2920a))
+
## [3.0.0](https://github.com/terraform-aws-modules/terraform-aws-appsync/compare/v2.6.0...v3.0.0) (2025-01-09)
diff --git a/README.md b/README.md
index f1deb47..5ef9ca0 100644
--- a/README.md
+++ b/README.md
@@ -202,6 +202,7 @@ No modules.
| [log\_exclude\_verbose\_content](#input\_log\_exclude\_verbose\_content) | Set to TRUE to exclude sections that contain information such as headers, context, and evaluated mapping templates, regardless of logging level. | `bool` | `false` | no |
| [log\_field\_log\_level](#input\_log\_field\_log\_level) | Field logging level. Valid values: ALL, ERROR, NONE. | `string` | `null` | no |
| [logging\_enabled](#input\_logging\_enabled) | Whether to enable Cloudwatch logging on GraphQL API | `bool` | `false` | no |
+| [logs\_role\_description](#input\_logs\_role\_description) | Description for the IAM role to create for Cloudwatch logs | `string` | `null` | no |
| [logs\_role\_name](#input\_logs\_role\_name) | Name of IAM role to create for Cloudwatch logs | `string` | `null` | no |
| [logs\_role\_tags](#input\_logs\_role\_tags) | Map of tags to add to Cloudwatch logs IAM role | `map(string)` | `{}` | no |
| [name](#input\_name) | Name of GraphQL API | `string` | `""` | no |
diff --git a/iam.tf b/iam.tf
index f53bd86..cd50704 100644
--- a/iam.tf
+++ b/iam.tf
@@ -109,6 +109,7 @@ resource "aws_iam_role" "logs" {
count = var.logging_enabled && var.create_logs_role ? 1 : 0
name = coalesce(var.logs_role_name, "${var.name}-logs")
+ description = var.logs_role_description
assume_role_policy = data.aws_iam_policy_document.assume_role.json
permissions_boundary = var.iam_permissions_boundary
diff --git a/variables.tf b/variables.tf
index d06cd72..42b1715 100644
--- a/variables.tf
+++ b/variables.tf
@@ -64,6 +64,12 @@ variable "logs_role_name" {
default = null
}
+variable "logs_role_description" {
+ description = "Description for the IAM role to create for Cloudwatch logs"
+ type = string
+ default = null
+}
+
variable "log_cloudwatch_logs_role_arn" {
description = "Amazon Resource Name of the service role that AWS AppSync will assume to publish to Amazon CloudWatch logs in your account."
type = string