Custom grant actions

A Custom grant allows exactly the actions you list. Nothing is added by default. Each action is named service:Action, such as cloudwatch:GetAlert. When you choose Custom in the add-grants form, the Select actions drawer groups the actions of each service into Read, Write, and Permissions management, the same way the IAM console does. Use this page to decide which actions a member needs for a task, and to see what each action allows. For the add-grants procedure, see Manage space members and permissions.

A member who holds a Custom grant and a Viewer, Editor, or Space Admin grant gets the combination of both. To keep a member's access narrow, give them only the Custom grant.

Limits on Custom grants

• Resource and tag scoping applies only to CloudWatch actions. You can limit a cloudwatch: action to named resources, to resources with a tag, or to a data scope only when the action acts on a resource type: telemetry query actions (a DataSet data scope), alerts, dashboards, access profiles, and integrations. Other cloudwatch: actions, such as cloudwatch:GetSpace, apply to the whole space and accept no scope. Actions from every other service, such as bedrock-agentcore: or logs:, accept no resource or tag scope. They apply to everything the Omni Space Access role can reach.

• One service per action group. An action group in the drawer holds actions from one service. To grant actions from two services, add two groups.

• Actions from other services also need the Space Access role. A member can use a bedrock-agentcore: or logs: action only when the Omni Space Access role for the space also allows it. See Control access to your space. Model inference is separate. The base policy lets a space set up and view evaluations, but invoking a model also requires the optional AWS managed policy CloudWatchOmniModelInferencePolicy on the role.

• DevOps Agent actions are not part of the Space Access role. To use the DevOps Agent from a space, attach the AWS managed policy AIDevOpsAgentFullAccess to the role.

Actions by service

Service	Actions	What the actions are used for	Grant it to
CloudWatch	cloudwatch:StartTelemetryQuerySession, cloudwatch:ListTelemetryQuerySessions, cloudwatch:StopTelemetryQuerySession, cloudwatch:StopTelemetryQuery, cloudwatch:GetTelemetryQueryResults	Run queries in the explorer, in dashboards, and in the alert query preview: open and close query sessions, cancel a query, and read its results. Each is checked under its own name. The data a query reads is checked separately, as the next two rows describe.	Members who read telemetry. Included in Viewer.
CloudWatch	cloudwatch:GetRecords	Read logs and traces. GetRecords is the permission behind StartTelemetryQuery and ListTelemetryFields: Omni checks it for every logs or traces dataset a query references, and for the dataset that ListTelemetryFields names. A dataset named without a logs. or traces. prefix, including default, counts as both and is checked once.	Members who read logs and traces. Included in Viewer.
CloudWatch	cloudwatch:GetMetricData, cloudwatch:ListMetrics	Read metrics. When StartTelemetryQuery references a metrics. dataset, that part is checked as both actions. ListTelemetryFields on a metrics dataset is checked as cloudwatch:ListMetrics alone. A query that spans logs or traces and metrics needs this row and the cloudwatch:GetRecords row.	Members who read metrics. Included in Viewer.
CloudWatch	cloudwatch:GetContextGraph	See the application map.	Members who read telemetry. Included in Viewer.
CloudWatch	cloudwatch:CreateOmniThread, cloudwatch:GetOmniThread, cloudwatch:UpdateOmniThread, cloudwatch:ListOmniThreads, cloudwatch:DeleteOmniThread, cloudwatch:StartOmniThreadSession	Ask the Omni agent questions and manage conversations. The agent reads with the member's own access, so grant the query actions too.	Members who use the Omni agent. Included in Viewer.
CloudWatch	cloudwatch:SubmitFeedback	Rate an answer or send feedback.	Members who use the Omni agent. Included in Editor.
CloudWatch	cloudwatch:ListAlerts, cloudwatch:GetAlert, cloudwatch:CreateAlert, cloudwatch:UpdateAlert, cloudwatch:DeleteAlert	See alerts and their state, and create, change, or delete them. Creating an alert also needs cloudwatch:ListAccessProfiles and cloudwatch:AssumeAccessProfile on the profile the alert uses. Can be limited to named alerts or tagged alerts.	Members who work with alerts. Viewer includes the List and Get actions. Editor includes all five.
CloudWatch	cloudwatch:ListOmniDashboards, cloudwatch:GetOmniDashboard, cloudwatch:CreateOmniDashboard, cloudwatch:UpdateOmniDashboard, cloudwatch:DeleteOmniDashboard	See dashboards, and create, change, or delete them. Viewing a dashboard also needs the query actions. Can be limited to named or tagged dashboards.	Members who work with dashboards. Viewer includes the List and Get actions. Editor includes all five.
CloudWatch	cloudwatch:ListViews, cloudwatch:GetView, cloudwatch:CreateView, cloudwatch:UpdateView, cloudwatch:DeleteView	See saved views, and create, change, or delete them.	Members who work with saved views. Viewer includes the List and Get actions. Editor includes all five.
CloudWatch	cloudwatch:GetSpace, cloudwatch:ListSpaces, cloudwatch:UpdateSpace	Read the space's details, list the spaces the member can open, and change the space's name and configuration.	Viewer includes cloudwatch:GetSpace and cloudwatch:ListSpaces. Space Admin includes cloudwatch:UpdateSpace.
CloudWatch	cloudwatch:GetPreferences, cloudwatch:UpdatePreferences	Read and save the member's own preferences.	Any member. Included in Viewer.
CloudWatch	cloudwatch:ListAccessGrants, cloudwatch:GetAccessGrant, cloudwatch:CreateAccessGrant, cloudwatch:DeleteAccessGrant	Read the grants in the space, and add or remove them.	Viewer includes the List and Get actions. Space Admin includes cloudwatch:CreateAccessGrant and cloudwatch:DeleteAccessGrant.
CloudWatch	cloudwatch:ListAccessProfiles, cloudwatch:GetAccessProfile, cloudwatch:CreateAccessProfile, cloudwatch:UpdateAccessProfile, cloudwatch:DeleteAccessProfile, cloudwatch:AssumeAccessProfile	See access profiles, manage them, and act as one. cloudwatch:AssumeAccessProfile is what a member needs to set a profile on an alert, and what an alert needs to run. Can be limited to named or tagged profiles.	Viewer includes the List and Get actions. Editor adds cloudwatch:AssumeAccessProfile. Space Admin includes all six.
CloudWatch	cloudwatch:ListIntegrations, cloudwatch:GetIntegration, cloudwatch:CreateIntegration, cloudwatch:UpdateIntegration, cloudwatch:DeleteIntegration	See integrations such as Slack, and connect, change, or remove them. Can be limited to named or tagged integrations.	Viewer includes the List and Get actions. Editor includes all five.
CloudWatch	cloudwatch:InvokeIntegration	Send a message through an integration. Can be limited to named integrations and, for Slack, to channels.	Access profiles that alerts use to notify. No permission level includes it.
CloudWatch	cloudwatch:GetIntelligenceConfiguration, cloudwatch:PutIntelligenceConfiguration	Read the account's intelligence configuration, and turn intelligence features on or off.	Viewer includes cloudwatch:GetIntelligenceConfiguration. Editor includes cloudwatch:PutIntelligenceConfiguration.
CloudWatch	cloudwatch:TagResource, cloudwatch:UntagResource, cloudwatch:ListTagsForResource	Read, add, and remove tags on Omni resources. Only these resource types accept tags: spaces, domains, organization domains, access grants, organization access grants, access profiles, dashboards, alerts, views, integrations, and datasets. The Space Access role denies tagging of any other CloudWatch resource. These are the tags that a tag-scoped grant matches on.	Members who organize resources by tag, and Space Admins who set up tag-scoped grants.
Bedrock AgentCore	bedrock-agentcore:ListEvaluators, bedrock-agentcore:GetEvaluator, bedrock-agentcore:CreateEvaluator, bedrock-agentcore:UpdateEvaluator, bedrock-agentcore:DeleteEvaluator, bedrock-agentcore:Evaluate	See, author, and run evaluators for agent evaluations.	Members who run or author agent evaluations.
Bedrock AgentCore	bedrock-agentcore:ListDatasets, bedrock-agentcore:GetDataset, bedrock-agentcore:ListDatasetVersions, bedrock-agentcore:ListDatasetExamples, bedrock-agentcore:CreateDataset, bedrock-agentcore:UpdateDataset, bedrock-agentcore:CreateDatasetVersion, bedrock-agentcore:AddDatasetExamples, bedrock-agentcore:UpdateDatasetExamples, bedrock-agentcore:DeleteDatasetExamples, bedrock-agentcore:DeleteDataset, bedrock-agentcore:TagResource, bedrock-agentcore:UntagResource, bedrock-agentcore:ListTagsForResource	See and manage the datasets that evaluations run against. The tag actions also read or change tags on evaluators and online evaluation configs.	Members who author agent evaluations.
Bedrock AgentCore	bedrock-agentcore:ListOnlineEvaluationConfigs, bedrock-agentcore:GetOnlineEvaluationConfig, bedrock-agentcore:CreateOnlineEvaluationConfig, bedrock-agentcore:UpdateOnlineEvaluationConfig, bedrock-agentcore:DeleteOnlineEvaluationConfig	Set up online evaluations that run on live traffic without a user.	Members who set up online evaluations.
Bedrock	bedrock:ListFoundationModels, bedrock:ListInferenceProfiles	Choose a model when creating an evaluator.	Members who author agent evaluations.
Bedrock	bedrock:InvokeModel, bedrock:InvokeModelWithResponseStream, bedrock-mantle:CreateInference, bedrock-mantle:CallWithBearerToken	Invoke the model when an evaluation or the playground runs. The bedrock-mantle actions cover models served through the bedrock-mantle endpoint in Amazon Bedrock. The Space Access role must also carry the optional CloudWatchOmniModelInferencePolicy.	Members who run evaluations or use the playground.
IAM	iam:PassRole	Pass a service role in your account to CloudWatch or to Bedrock AgentCore, for example the role that online evaluations run as.	Members who set up the space or online evaluations.
IAM	iam:ListRoles, iam:GetRole, iam:ListAttachedRolePolicies, iam:ListUsers, iam:ListUserTags, iam:ListServiceSpecificCredentials	Fill the role picker, inspect an existing role during Azure VM ingestion setup, and list the ingestion users and their OTLP bearer tokens.	Members who set up telemetry sources or choose service roles.
IAM	iam:CreateServiceLinkedRole	Create the AWS Config service-linked role that Azure topology needs.	Members who set up Azure topology.
CloudWatch Logs	logs:CreateLogGroup, logs:CreateLogStream, logs:PutLogEvents	Write evaluation results to log groups.	Members who run evaluations.
CloudWatch Logs	logs:DescribeLogGroups	List log groups for the online evaluation log-group picker.	Members who set up online evaluations.
CloudWatch Logs	logs:DescribeIndexPolicies, logs:PutIndexPolicy	Index the service name on the spans log group so online evaluations can sample by service.	Members who set up online evaluations.
KMS	kms:DescribeKey, kms:GenerateDataKey, kms:Decrypt	Validate and use a customer managed key for space encryption and for stored provider keys.	Members who configure encryption or store provider keys.
Lambda	lambda:InvokeFunction, lambda:GetFunction	Run code-based custom evaluators.	Members who use code evaluators.
Secrets Manager	secretsmanager:ListSecrets, secretsmanager:CreateSecret, secretsmanager:TagResource, secretsmanager:PutSecretValue, secretsmanager:GetSecretValue, secretsmanager:DeleteSecret	Store, read, rotate, and delete model provider API keys used by evaluators.	Members who add provider keys.
Config	config:PutServiceLinkedConfigurationRecorder, config:DeleteServiceLinkedConfigurationRecorder, config:DescribeConfigurationRecorderStatus	Turn the AWS Config recorder on or off, and read its status, to build the Azure topology map.	Members who set up Azure topology.