Minimal permissions needed for an end user when using the event bus?

[JeroenSfdc]

(i) Considering we only use Nebula Logging through the event bus.

The standard Logger: End User permission set is too permissive. It includes access to objects and tabs, and FLS which we deem not required. End users do no (should not) see log, even that this only pertains their own privately logs.

Am I right that only providing access to:

<objectPermissions>
        <allowCreate>true</allowCreate>
        <allowDelete>false</allowDelete>
        <allowEdit>false</allowEdit>
        <allowRead>true</allowRead>
        <modifyAllRecords>false</modifyAllRecords>
        <object>LogEntryEvent__e</object>
        <viewAllRecords>false</viewAllRecords>
    </objectPermissions>

Plus ClassAccessses for the the Apex classes should be enough?

Thanks

[jongpie]

Hi @JeroenSfdc - if you just want to ensure that users can log data, then you shouldn't need any additional permission sets or access:

• I've tried to design the code to work regardless of what permissions the current user has. This is true even if you're using other save methods besides the event bus.
• There is already another permission set, Logger: Log Creator, that grants explicit access to the LogEntryEvent__e platform event as well as all Apex classes used to generate logs. But as you pointed out in issue Logger: Log Creator permission set no longer needed after Summer '23 #441, Salesforce will not be requiring explicit access to invocable classes, so this permission set isn't really needed.

Hope this helps, but let me know if you have any follow up questions!

[kevinwcrump]

Thank you! This is what I have been looking for and seems to answer my discussion question 611.