CloudWatchReadOnlyAccess

Summary

Provides read only access to CloudWatch. The Amazon CloudWatch User Guide says it grants read-only access to CloudWatch and related observability features.

Permissions imported from the AWS Managed Policy Reference Guide; other sections reviewed against the listed AWS sources.

Identity

ARN

arn:aws:iam::aws:policy/CloudWatchReadOnlyAccessCopy ARN

Default version

v27

Created

2015-02-06

Last edited

2026-11-11

Services

application-autoscaling, application-signals, autoscaling, cloudtrail, cloudwatch, iam, logs, oam, observabilityadmin, resource-explorer-2, rum, servicequotas, sns, synthetics, xray

Control-plane actions (243)

By access level: 108 List, 134 Read, 1 Write.

Data-plane actions (15)

By access level: 4 List, 11 Read.

Excluded and conditional actions

No patterns are excluded by NotAction or Deny statements.

Resource scope and attachment

Resource scope across granted actions: mixed.

Can be attached: Yes, to users, groups and roles.

Why this tier

• Grants 1 write, tagging or permissions-management action, short of full control of any service.

Guidance

Related policies

Same service

• AlexaForBusinessGatewayExecution
• AmazonAPIGatewayPushToCloudWatchLogs
• AmazonApplicationRecoveryControllerRegionSwitchPlanExecutionPolicy
• AmazonAthenaServiceRolePolicy
• AmazonAuroraDSQLReadOnlyAccess
• AmazonBraketFullAccess
• AmazonBraketJobsExecutionPolicy
• AmazonBraketServiceRolePolicy

Same domain

• AmazonCloudWatchEvidentlyFullAccess
• AmazonCloudWatchRUMFullAccess
• AmazonCloudWatchRUMReadOnlyAccess
• AmazonCloudWatchRUMServiceRolePolicy
• AmazonCognitoUnauthenticatedIdentities
• AmazonDevOpsGuruConsoleFullAccess
• AmazonDevOpsGuruFullAccess
• AmazonDevOpsGuruReadOnlyAccess

Frequently asked questions

When should I attach CloudWatchReadOnlyAccess?

The reference page says you can attach CloudWatchReadOnlyAccess to your users, groups and roles, and describes it as: provides read only access to CloudWatch. Attach it where viewing CloudWatch and related observability features is the intended scope.

What does CloudWatchReadOnlyAccess grant?

It allows 40 action entries on all resources across CloudWatch, Logs, Application Signals, RUM, Synthetics, X-Ray, SNS, observabilityadmin and others, plus narrower reads on oam, iam, cloudtrail, Service Quotas and Resource Explorer resources.

What are the security risks of CloudWatchReadOnlyAccess?

It includes actions that run or control things, such as logs:StartQuery, logs:StartLiveTail, observabilityadmin:TestTelemetryPipeline and xray:StartTraceRetrieval, and its log read actions apply to all resources. AWS managed policies don't grant least privilege permissions, and you must consider the security risk of granting principals more permissions than they need. AWS updates to the policy affect every identity it is attached to.

Policy JSON

Download policy.json

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "CloudWatchReadOnlyAccessPermissions",
      "Effect": "Allow",
      "Action": [
        "application-autoscaling:DescribeScalingPolicies",
        "application-signals:BatchGet*",
        "application-signals:Get*",
        "application-signals:List*",
        "autoscaling:Describe*",
        "cloudtrail:ListChannels",
        "cloudwatch:BatchGet*",
        "cloudwatch:Describe*",
        "cloudwatch:GenerateQuery",
        "cloudwatch:Get*",
        "cloudwatch:List*",
        "cloudwatch:CreateOneTimeDeepLinkCode",
        "cloudwatch:DetectGroupOutliers",
        "logs:Get*",
        "logs:List*",
        "logs:StartQuery",
        "logs:StopQuery",
        "logs:Describe*",
        "logs:TestMetricFilter",
        "logs:FilterLogEvents",
        "logs:StartLiveTail",
        "logs:StopLiveTail",
        "oam:ListSinks",
        "observabilityadmin:Get*",
        "observabilityadmin:List*",
        "observabilityadmin:TestTelemetryPipeline",
        "observabilityadmin:ValidateTelemetryPipelineConfiguration",
        "sns:Get*",
        "sns:List*",
        "rum:BatchGet*",
        "rum:Get*",
        "rum:List*",
        "synthetics:Describe*",
        "synthetics:Get*",
        "synthetics:List*",
        "xray:BatchGet*",
        "xray:Get*",
        "xray:List*",
        "xray:StartTraceRetrieval",
        "xray:CancelTraceRetrieval"
      ],
      "Resource": "*"
    },
    {
      "Sid": "OAMReadPermissions",
      "Effect": "Allow",
      "Action": [
        "oam:ListAttachedLinks"
      ],
      "Resource": "arn:aws:oam:*:*:sink/*"
    },
    {
      "Sid": "CloudWatchReadOnlyGetRolePermissions",
      "Effect": "Allow",
      "Action": "iam:GetRole",
      "Resource": "arn:aws:iam::*:role/aws-service-role/application-signals.cloudwatch.amazonaws.com/AWSServiceRoleForCloudWatchApplicationSignals"
    },
    {
      "Sid": "CloudWatchCloudTrailPermissions",
      "Effect": "Allow",
      "Action": [
        "cloudtrail:GetChannel"
      ],
      "Resource": "arn:aws:cloudtrail:*:*:channel/aws-service-channel/application-signals/*"
    },
    {
      "Sid": "CloudWatchServiceQuotaPermissions",
      "Effect": "Allow",
      "Action": [
        "servicequotas:GetServiceQuota"
      ],
      "Resource": [
        "arn:aws:servicequotas:*:*:s3/*",
        "arn:aws:servicequotas:*:*:dynamodb/*",
        "arn:aws:servicequotas:*:*:kinesis/*",
        "arn:aws:servicequotas:*:*:sns/*",
        "arn:aws:servicequotas:*:*:bedrock/*",
        "arn:aws:servicequotas:*:*:lambda/*",
        "arn:aws:servicequotas:*:*:fargate/*",
        "arn:aws:servicequotas:*:*:elasticloadbalancing/*",
        "arn:aws:servicequotas:*:*:ec2/*"
      ]
    },
    {
      "Sid": "CloudWatchResourceExplorerPermissions",
      "Effect": "Allow",
      "Action": [
        "resource-explorer-2:ListIndexes",
        "resource-explorer-2:Search"
      ],
      "Resource": [
        "arn:aws:resource-explorer-2:*::view/AWSServiceViewForApplicationSignals/service-view",
        "arn:aws:resource-explorer-2:*::view/AWSServiceViewForApplicationSignalsOrgScopeProd/service-view"
      ]
    }
  ]
}

Version history

Current version v27, edited by AWS on 2026-11-11.

Attach snippets

aws iam attach-role-policy --role-name ROLE_NAME --policy-arn arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess
aws iam attach-user-policy --user-name USER_NAME --policy-arn arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess
aws iam attach-group-policy --group-name GROUP_NAME --policy-arn arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess

Resources:
  ExampleRole:
    Type: AWS::IAM::Role
    Properties:
      AssumeRolePolicyDocument: {}  # replace with your trust policy
      ManagedPolicyArns:
        - arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess

resource "aws_iam_role_policy_attachment" "cloudwatchreadonlyaccess" {
  role       = aws_iam_role.example.name
  policy_arn = "arn:aws:iam::aws:policy/CloudWatchReadOnlyAccess"
}

role.addManagedPolicy(
  iam.ManagedPolicy.fromAwsManagedPolicyName("CloudWatchReadOnlyAccess"),
);

Sources

• CloudWatchReadOnlyAccess (AWS Managed Policy Reference Guide) (retrieved 2026-11-13; supports summary, practicalScope, useCases, securityConsiderations, assignmentGuidance, faqs)
• AWS managed policies for CloudWatch (Amazon CloudWatch User Guide) (retrieved 2026-11-13; supports summary, useCases, securityConsiderations, assignmentGuidance, faqs)
• Managed policies and inline policies (IAM User Guide) (retrieved 2026-11-12; supports securityConsiderations, faqs)
• AWS managed policies for job functions (IAM User Guide) (retrieved 2026-11-12; supports bestPractices, faqs)

• Official AWS reference for CloudWatchReadOnlyAccess
• AWS service guide
• Report a data issue