Using identity-based policies (IAM policies) for CloudWatch Logs
This topic provides examples of identity-based policies in which an account administrator can attach permissions policies to IAM identities (that is, users, groups, and roles).
Important
We recommend that you first review the introductory topics that explain the basic concepts and options available for you to manage access to your CloudWatch Logs resources. For more information, see Overview of managing access permissions to your CloudWatch Logs resources.
This topic covers the following:
The following is an example of a permissions policy:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:CreateLogStream", "logs:PutLogEvents", "logs:DescribeLogStreams" ], "Resource": [ "arn:aws:logs:*:*:*" ] } ] }
This policy has one statement that grants permissions to create log groups and log streams, to upload log events to log streams, and to list details about log streams.
The wildcard character (*) at the end of the Resource value means that the
statement allows permission for the logs:CreateLogGroup,
logs:CreateLogStream, logs:PutLogEvents, and
logs:DescribeLogStreams actions on any log group. To limit this
permission to a specific log group, replace the wildcard character (*) in the resource
ARN with the specific log group ARN. For more information about the sections within an
IAM policy statement, see IAM Policy
Elements Reference in IAM User Guide. For a list
showing all of the CloudWatch Logs actions, see CloudWatch Logs permissions reference.
Permissions required to use the CloudWatch console
For a user to work with CloudWatch Logs in the CloudWatch console, that user must have a minimum set of permissions that allows the user to describe other AWS resources in their AWS account. In order to use CloudWatch Logs in the CloudWatch console, you must have permissions from the following services:
-
CloudWatch
-
CloudWatch Logs
-
OpenSearch Service
-
IAM
-
Kinesis
-
Lambda
-
Amazon S3
If you create an IAM policy that is more restrictive than the minimum required
permissions, the console won't function as intended for users with that IAM policy. To ensure
that those users can still use the CloudWatch console, also attach the
CloudWatchReadOnlyAccess managed policy to the user, as described in AWS managed (predefined) policies for CloudWatch Logs.
You don't need to allow minimum console permissions for users that are making calls only to the AWS CLI or the CloudWatch Logs API.
The full set of permissions required to work with the CloudWatch console for a user who is not using the console to manage log subscriptions are:
cloudwatch:GetMetricData
cloudwatch:ListMetrics
logs:CancelExportTask
logs:CreateExportTask
logs:CreateLogGroup
logs:CreateLogStream
logs:DeleteLogGroup
logs:DeleteLogStream
logs:DeleteMetricFilter
logs:DeleteQueryDefinition
logs:DeleteRetentionPolicy
logs:DeleteSubscriptionFilter
logs:DescribeExportTasks
logs:DescribeLogGroups
logs:DescribeLogStreams
logs:DescribeMetricFilters
logs:DescribeQueryDefinitions
logs:DescribeQueries
logs:DescribeSubscriptionFilters
logs:FilterLogEvents
logs:GetLogEvents
logs:GetLogGroupFields
logs:GetLogRecord
logs:GetQueryResults
logs:PutMetricFilter
logs:PutQueryDefinition
logs:PutRetentionPolicy
logs:StartQuery
logs:StopQuery
logs:PutSubscriptionFilter
logs:TestMetricFilter
For a user who will also be using the console to manage log subscriptions, the following permissions are also required:
es:DescribeElasticsearchDomain
es:ListDomainNames
iam:AttachRolePolicy
iam:CreateRole
iam:GetPolicy
iam:GetPolicyVersion
iam:GetRole
iam:ListAttachedRolePolicies
iam:ListRoles
kinesis:DescribeStreams
kinesis:ListStreams
lambda:AddPermission
lambda:CreateFunction
lambda:GetFunctionConfiguration
lambda:ListAliases
lambda:ListFunctions
lambda:ListVersionsByFunction
lambda:RemovePermission
s3:ListBuckets
AWS managed (predefined) policies for CloudWatch Logs
AWS addresses many common use cases by providing standalone IAM policies that are created and administered by AWS. Managed policies grant necessary permissions for common use cases so you can avoid having to investigate what permissions are needed. For more information, see AWS Managed Policies in the IAM User Guide.
The following AWS managed policies, which you can attach to users and roles in your account, are specific to CloudWatch Logs:
CloudWatchLogsFullAccess – Grants full access to CloudWatch Logs.
CloudWatchLogsReadOnlyAccess – Grants read-only access to CloudWatch Logs.
CloudWatchLogsFullAccess
The CloudWatchLogsFullAccess policy grants full access to CloudWatch Logs.
The policy includes the cloudwatch:GenerateQuery permission, so that users with this policy can generate a CloudWatch Logs Insights query string from a natural language prompt.
It includes permissions for Amazon OpenSearch Service and IAM to enable CloudWatch Logs integration with OpenSearch Service for some features. The full contents are as follows:
{ "Version": "2012-10-17", "Statement": [ { "Sid": "CloudWatchLogsFullAccess", "Effect": "Allow", "Action": [ "logs:*", "cloudwatch:GenerateQuery", "opensearch:ApplicationAccessAll", "iam:ListRoles", "iam:ListUsers", "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "es:ListApplications" ], "Resource": "*" }, { "Sid": "CloudWatchLogsOpenSearchCreateServiceLinkedAccess", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/opensearchservice.amazonaws.com/AWSServiceRoleForAmazonOpenSearchService", "Condition": { "StringEquals": { "iam:AWSServiceName": "opensearchservice.amazonaws.com" } } }, { "Sid": "CloudWatchLogsObservabilityCreateServiceLinkedAccess", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/*/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "iam:AWSServiceName": "observability.aoss.amazonaws.com" } } }, { "Sid": "CloudWatchLogsCollectionRequestAccess", "Effect": "Allow", "Action": [ "aoss:CreateCollection" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsApplicationRequestAccess", "Effect": "Allow", "Action": [ "es:CreateApplication" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/OpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "OpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsCollectionResourceAccess", "Effect": "Allow", "Action": [ "aoss:DeleteCollection" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsApplicationResourceAccess", "Effect": "Allow", "Action": [ "es:UpdateApplication", "es:GetApplication" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/OpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsCollectionPolicyAccess", "Effect": "Allow", "Action": [ "aoss:CreateSecurityPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:DeleteSecurityPolicy", "aoss:GetAccessPolicy", "aoss:GetSecurityPolicy", "aoss:APIAccessAll" ], "Resource": "*", "Condition": { "StringLike": { "aoss:collection": "logs-collection-*" } } }, { "Sid": "CloudWatchLogsIndexPolicyAccess", "Effect": "Allow", "Action": [ "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:GetAccessPolicy", "aoss:CreateLifecyclePolicy", "aoss:DeleteLifecyclePolicy" ], "Resource": "*", "Condition": { "StringLike": { "aoss:index": "logs-collection-*" } } }, { "Sid": "CloudWatchLogsStartDirectQueryAccess", "Effect": "Allow", "Action": [ "opensearch:StartDirectQuery" ], "Resource": "arn:aws:opensearch:*:*:datasource/logs_datasource_*" }, { "Sid": "CloudWatchLogsDQSRequestQueryAccess", "Effect": "Allow", "Action": [ "es:AddDirectQueryDataSource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:RequestTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsDQSResourceQueryAccess", "Effect": "Allow", "Action": [ "es:GetDirectQueryDataSource", "es:DeleteDirectQueryDataSource" ], "Resource": "*", "Condition": { "StringEquals": { "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "directquery.opensearchservice.amazonaws.com" } } }, { "Sid": "CloudWatchLogsAossTagsAccess", "Effect": "Allow", "Action": [ "aoss:TagResource", "es:AddTags" ], "Resource": "arn:aws:aoss:*:*:collection/*", "Condition": { "StringEquals": { "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsEsApplicationTagsAccess", "Effect": "Allow", "Action": [ "es:AddTags" ], "Resource": "arn:aws:opensearch:*:*:application/*", "Condition": { "StringEquals": { "aws:ResourceTag/OpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "OpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsEsDataSourceTagsAccess", "Effect": "Allow", "Action": [ "es:AddTags" ], "Resource": "arn:aws:opensearch:*:*:datasource/*", "Condition": { "StringEquals": { "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } } ] }
CloudWatchLogsReadOnlyAccess
The CloudWatchLogsReadOnlyAccess policy grants read-only access to CloudWatch Logs.
It includes the cloudwatch:GenerateQuery permission, so that users with this policy can generate a CloudWatch Logs Insights query string from a natural language prompt.
The contents are as follows:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents", "logs:StartLiveTail", "logs:StopLiveTail", "cloudwatch:GenerateQuery" ], "Resource": "*" } ] }
CloudWatchOpenSearchDashboardsFullAccess
The CloudWatchOpenSearchDashboardsFullAccess policy grants access to create, manage, and delete integrations with OpenSearch Service, and to create delete and manage vended log dashboards in those integrations. For more information, see Analyze with Amazon OpenSearch Service.
The contents are as follows:
{ "Version": "2012-10-17", "Statement": [{ "Sid": "CloudWatchOpenSearchDashboardsIntegration", "Effect": "Allow", "Action": [ "logs:ListIntegrations", "logs:GetIntegration", "logs:DeleteIntegration", "logs:PutIntegration", "logs:DescribeLogGroups", "opensearch:ApplicationAccessAll", "iam:ListRoles", "iam:ListUsers" ], "Resource": "*" }, { "Sid": "CloudWatchLogsOpensearchReadAPIs", "Effect": "Allow", "Action": [ "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "es:ListApplications" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsOpensearchCreateServiceLinkedAccess", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/opensearchservice.amazonaws.com/AWSServiceRoleForAmazonOpenSearchService", "Condition": { "StringEquals": { "iam:AWSServiceName": "opensearchservice.amazonaws.com", "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsObservabilityCreateServiceLinkedAccess", "Effect": "Allow", "Action": [ "iam:CreateServiceLinkedRole" ], "Resource": "arn:aws:iam::*:role/aws-service-role/observability.aoss.amazonaws.com/AWSServiceRoleForAmazonOpenSearchServerless", "Condition": { "StringEquals": { "iam:AWSServiceName": "observability.aoss.amazonaws.com", "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsCollectionRequestAccess", "Effect": "Allow", "Action": [ "aoss:CreateCollection" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:RequestTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsApplicationRequestAccess", "Effect": "Allow", "Action": [ "es:CreateApplication" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:RequestTag/OpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "OpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsCollectionResourceAccess", "Effect": "Allow", "Action": [ "aoss:DeleteCollection" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsApplicationResourceAccess", "Effect": "Allow", "Action": [ "es:UpdateApplication", "es:GetApplication" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/OpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsCollectionPolicyAccess", "Effect": "Allow", "Action": [ "aoss:CreateSecurityPolicy", "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:DeleteSecurityPolicy", "aoss:GetAccessPolicy", "aoss:GetSecurityPolicy" ], "Resource": "*", "Condition": { "StringLike": { "aoss:collection": "cloudwatch-logs-*", "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsAPIAccessAll", "Effect": "Allow", "Action": [ "aoss:APIAccessAll" ], "Resource": "*", "Condition": { "StringLike": { "aoss:collection": "cloudwatch-logs-*" } } }, { "Sid": "CloudWatchLogsIndexPolicyAccess", "Effect": "Allow", "Action": [ "aoss:CreateAccessPolicy", "aoss:DeleteAccessPolicy", "aoss:GetAccessPolicy", "aoss:CreateLifecyclePolicy", "aoss:DeleteLifecyclePolicy" ], "Resource": "*", "Condition": { "StringLike": { "aoss:index": "cloudwatch-logs-*", "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsDQSRequestQueryAccess", "Effect": "Allow", "Action": [ "es:AddDirectQueryDataSource" ], "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:RequestTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsStartDirectQueryAccess", "Effect": "Allow", "Action": [ "opensearch:StartDirectQuery", "opensearch:GetDirectQuery" ], "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*" }, { "Sid": "CloudWatchLogsDQSResourceQueryAccess", "Effect": "Allow", "Action": [ "es:GetDirectQueryDataSource", "es:DeleteDirectQueryDataSource" ], "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsPassRoleAccess", "Effect": "Allow", "Action": [ "iam:PassRole" ], "Resource": "*", "Condition": { "StringLike": { "iam:PassedToService": "directquery.opensearchservice.amazonaws.com", "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsAossTagsAccess", "Effect": "Allow", "Action": [ "aoss:TagResource", "es:AddTags" ], "Resource": "arn:aws:aoss:*:*:collection/*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsEsApplicationTagsAccess", "Effect": "Allow", "Action": [ "es:AddTags" ], "Resource": "arn:aws:opensearch:*:*:application/*", "Condition": { "StringEquals": { "aws:ResourceTag/OpenSearchIntegration": [ "Dashboards" ], "aws:CalledViaFirst": "logs.amazonaws.com" }, "ForAllValues:StringEquals": { "aws:TagKeys": "OpenSearchIntegration" } } }, { "Sid": "CloudWatchLogsEsDataSourceTagsAccess", "Effect": "Allow", "Action": [ "es:AddTags" ], "Resource": "arn:aws:opensearch:*:*:datasource/*", "Condition": { "StringEquals": { "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ], "aws:CalledViaFirst": "logs.amazonaws.com" }, "ForAllValues:StringEquals": { "aws:TagKeys": "CloudWatchOpenSearchIntegration" } } } ] }
CloudWatchOpenSearchDashboardAccess
The CloudWatchOpenSearchDashboardAccess policy grants access to view vended logs dashboards that are created with Amazon OpenSearch Service analytics. For more information, see Analyze with Amazon OpenSearch Service.
Important
In addition to granting this policy, to enable a role or user to be able to view vended log dashboards, you must also specify them when you create the integration with OpenSearch Service. For more information, see Step 1: Create the integration with OpenSearch Service.
The contents of CloudWatchOpenSearchDashboardAccess are as follows:
{ "Version": "2012-10-17", "Statement": [{ "Sid": "CloudWatchOpenSearchDashboardsIntegration", "Effect": "Allow", "Action": [ "logs:ListIntegrations", "logs:GetIntegration", "logs:DescribeLogGroups", "opensearch:ApplicationAccessAll", "iam:ListRoles", "iam:ListUsers" ], "Resource": "*" }, { "Sid": "CloudWatchLogsOpensearchReadAPIs", "Effect": "Allow", "Action": [ "aoss:BatchGetCollection", "aoss:BatchGetLifecyclePolicy", "es:ListApplications" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com" } } }, { "Sid": "CloudWatchLogsAPIAccessAll", "Effect": "Allow", "Action": [ "aoss:APIAccessAll" ], "Resource": "*", "Condition": { "StringLike": { "aoss:collection": "cloudwatch-logs-*" } } }, { "Sid": "CloudWatchLogsDQSCollectionPolicyAccess", "Effect": "Allow", "Action": [ "aoss:GetAccessPolicy", "aoss:GetSecurityPolicy" ], "Resource": "*", "Condition": { "StringLike": { "aws:CalledViaFirst": "logs.amazonaws.com", "aoss:collection": "cloudwatch-logs-*" } } }, { "Sid": "CloudWatchLogsApplicationResourceAccess", "Effect": "Allow", "Action": [ "es:GetApplication" ], "Resource": "*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/OpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsDQSResourceQueryAccess", "Effect": "Allow", "Action": [ "es:GetDirectQueryDataSource" ], "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*", "Condition": { "StringEquals": { "aws:CalledViaFirst": "logs.amazonaws.com", "aws:ResourceTag/CloudWatchOpenSearchIntegration": [ "Dashboards" ] } } }, { "Sid": "CloudWatchLogsDirectQueryStatusAccess", "Effect": "Allow", "Action": [ "opensearch:GetDirectQuery" ], "Resource": "arn:aws:opensearch:*:*:datasource/cloudwatch_logs_*" } ] }
CloudWatchLogsCrossAccountSharingConfiguration
The CloudWatchLogsCrossAccountSharingConfiguration policy grants access to create, manage, and view Observability Access Manager links for sharing CloudWatch Logs resources between accounts. For more information, see CloudWatch cross-account observability.
The contents are as follows:
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:Link", "oam:ListLinks" ], "Resource": "*" }, { "Effect": "Allow", "Action": [ "oam:DeleteLink", "oam:GetLink", "oam:TagResource" ], "Resource": "arn:aws:oam:*:*:link/*" }, { "Effect": "Allow", "Action": [ "oam:CreateLink", "oam:UpdateLink" ], "Resource": [ "arn:aws:oam:*:*:link/*", "arn:aws:oam:*:*:sink/*" ] } ] }
CloudWatch Logs updates to AWS managed policies
View details about updates to AWS managed policies for CloudWatch Logs since this service began tracking these changes. For automatic alerts about changes to this page, subscribe to the RSS feed on the CloudWatch Logs Document history page.
| Change | Description | Date |
|---|---|---|
|
CloudWatchLogsFullAccess – Update to an existing policy. |
CloudWatch Logs added permissions to CloudWatchLogsFullAccess. Permissions for Amazon OpenSearch Service and IAM were added, to enable CloudWatch Logs integration with OpenSearch Service for some features. |
December 1, 2024 |
|
CloudWatchOpenSearchDashboardsFullAccess – New IAM policy. |
CloudWatch Logs added a new IAM policy, CloudWatchOpenSearchDashboardsFullAccess.- This policy grants access to create, manage, and delete integrations with OpenSearch Service, and to create, manage, and delete vended log dashboards in those integrations. For more information, see Analyze with Amazon OpenSearch Service. |
December 1, 2024 |
|
CloudWatchOpenSearchDashboardAccess – New IAM policy. |
CloudWatch Logs added a new IAM policy, CloudWatchOpenSearchDashboardAccess.- This policy grants access to view vended logs dashboards powered by Amazon OpenSearch Service. For more information, see Analyze with Amazon OpenSearch Service. |
December 1, 2024 |
|
CloudWatchLogsFullAccess – Update to an existing policy. |
CloudWatch Logs added a permission to CloudWatchLogsFullAccess.
The |
November 27, 2023 |
|
CloudWatchLogsReadOnlyAccess – Update to an existing policy. |
CloudWatch added a permission to CloudWatchLogsReadOnlyAccess.
The |
November 27, 2023 |
|
CloudWatchLogsReadOnlyAccess – Update to an existing policy |
CloudWatch Logs added permissions to CloudWatchLogsReadOnlyAccess. The |
June 6, 2023 |
|
CloudWatchLogsCrossAccountSharingConfiguration – New policy |
CloudWatch Logs added a new policy to enable you to manage CloudWatch cross-account observability links that share CloudWatch Logs log groups. For more information, see CloudWatch cross-account observability |
November 27, 2022 |
|
CloudWatchLogsReadOnlyAccess – Update to an existing policy |
CloudWatch Logs added permissions to CloudWatchLogsReadOnlyAccess. The |
November 27, 2022 |
Customer managed policy examples
You can create your own custom IAM policies to allow permissions for CloudWatch Logs actions and resources. You can attach these custom policies to the users or groups that require those permissions.
In this section, you can find example user policies that grant permissions for various CloudWatch Logs actions. These policies work when you are using the CloudWatch Logs API, AWS SDKs, or the AWS CLI.
Examples
Example 1: Allow full access to CloudWatch Logs
The following policy allows a user to access all CloudWatch Logs actions.
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:*" ], "Effect": "Allow", "Resource": "*" } ] }
Example 2: Allow read-only access to CloudWatch Logs
AWS provides a CloudWatchLogsReadOnlyAccess policy that enables read-only access to CloudWatch Logs data. This policy includes the following permissions.
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:Describe*", "logs:Get*", "logs:List*", "logs:StartQuery", "logs:StopQuery", "logs:TestMetricFilter", "logs:FilterLogEvents", "logs:StartLiveTail", "logs:StopLiveTail", "cloudwatch:GenerateQuery" ], "Effect": "Allow", "Resource": "*" } ] }
Example 3: Allow access to one log group
The following policy allows a user to read and write log events in one specified log group.
Important
The :* at the end of the log group name in the Resource
line is required to indicate that the policy applies to all log streams in this log group. If you
omit :*, the policy will not be enforced.
{ "Version":"2012-10-17", "Statement":[ { "Action": [ "logs:CreateLogStream", "logs:DescribeLogStreams", "logs:PutLogEvents", "logs:GetLogEvents" ], "Effect": "Allow", "Resource": "arn:aws:logs:us-west-2:123456789012:log-group:SampleLogGroupName:*" } ] }
Use tagging and IAM policies for control at the log group level
You can grant users access to certain log groups while preventing them from accessing
other log groups. To do so, tag your log groups and use IAM policies that refer to those tags.
To apply tags to a log group, you need to have either the logs:TagResource or
logs:TagLogGroup permission. This applies both if you are assigning tags to the log group when
you create it. or assigning them later.
For more information about tagging log groups, see Tag log groups in Amazon CloudWatch Logs.
When you tag log groups, you can then grant an IAM policy to a user to
allow access to only the log groups with a particular tag. For example, the
following policy statement grants access to only log groups with the value of Green
for the tag key Team.
{ "Version": "2012-10-17", "Statement": [ { "Action": [ "logs:*" ], "Effect": "Allow", "Resource": "*", "Condition": { "StringLike": { "aws:ResourceTag/Team": "Green" } } } ] }
The StopQuery and StopLiveTail API operations don't interact with AWS resources in the traditional
sense. They don't return any data, put any data, or modify a resource in any way. Instead, they operate only
on a given live tail session or a given CloudWatch Logs Insights query, which are not categorized as resources. As a result,
when you specify the Resource field in IAM policies for these operations, you must set the
value of the Resource field as *, as in the following example.
{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:StopQuery", "logs:StopLiveTail" ], "Resource": "*" } ] }
For more information about using IAM policy statements, see Controlling Access Using Policies in the IAM User Guide.
