AuroraDsqlServiceLinkedRolePolicy version history

Version history is recorded from 2026-11-11. Earlier versions are in the IAM console under Policy versions. 1 change is recorded.Back to AuroraDsqlServiceLinkedRolePolicy.

v6 to v7

Detected 2026-11-13; AWS edit time of v7 2026-11-12T00:37:00Z. 4 added, 0 removed.

Actions added (4)

logs:CreateLogGroup
logs:CreateLogStream
logs:PutLogEvents
logs:PutRetentionPolicy

Document diff

--- v6
+++ v7
@@ -2,6 +2,7 @@
   "Version": "2012-10-17",
   "Statement": [
     {
+      "Sid": "AllowCloudwatchMetricsAccess",
       "Effect": "Allow",
       "Action": [
         "cloudwatch:PutMetricData"
@@ -13,6 +14,25 @@
             "AWS/AuroraDSQL",
             "AWS/Usage"
           ],
+          "aws:ResourceAccount": "${aws:PrincipalAccount}"
+        }
+      }
+    },
+    {
+      "Sid": "AllowCloudwatchLogsAccess",
+      "Effect": "Allow",
+      "Action": [
+        "logs:CreateLogGroup",
+        "logs:CreateLogStream",
+        "logs:PutLogEvents",
+        "logs:PutRetentionPolicy"
+      ],
+      "Resource": [
+        "arn:aws:logs:*:*:log-group:/aws/dsql/normalized-sql-text",
+        "arn:aws:logs:*:*:log-group:/aws/dsql/normalized-sql-text:*"
+      ],
+      "Condition": {
+        "StringEquals": {
           "aws:ResourceAccount": "${aws:PrincipalAccount}"
         }
       }