diff --git a/lib/plugins/aws/package/compile/events/cloudWatchLog/index.js b/lib/plugins/aws/package/compile/events/cloudWatchLog/index.js
index 304bf19ba..697d9736d 100644
--- a/lib/plugins/aws/package/compile/events/cloudWatchLog/index.js
+++ b/lib/plugins/aws/package/compile/events/cloudWatchLog/index.js
@@ -78,6 +78,13 @@ class AwsCompileCloudWatchLogEvents {
               .getLambdaCloudWatchLogPermissionLogicalId(functionName,
                 cloudWatchLogNumberInFunction);
 
+            // unescape quotes once when the first quote is detected escaped
+            const idxFirstSlash = FilterPattern.indexOf('\\');
+            const idxFirstQuote = FilterPattern.indexOf('"');
+            if (idxFirstSlash >= 0 && idxFirstQuote >= 0 && idxFirstQuote > idxFirstSlash) {
+              FilterPattern = FilterPattern.replace(/\\("|\\|')/g, (match, g) => g);
+            }
+
             const cloudWatchLogRuleTemplate = `
               {
                 "Type": "AWS::Logs::SubscriptionFilter",