CloudWatch
Prefix cloudwatch, 165 actions · Domain Monitoring & Observability
114 AWS managed policies. 14 have reviewed guidance; the rest have authoritative permission data pending editorial review. 66 are service-linked role policies, shown with permission data only.
User access (22)
- AmazonAuroraDSQLReadOnlyAccessReader
- AmazonCloudWatchRUMReadOnlyAccessReader
- AmazonDocDBElasticReadOnlyAccessReader
- AmazonEC2FullAccessAdmin
- AmazonElasticMapReduceFullAccessHigh privilegeAdmin
- AmazonKeyspacesFullAccessAdmin
- AmazonKeyspacesReadOnlyAccessReader
- AmazonKeyspacesReadOnlyAccess_v2Reader
- AmazonKinesisAnalyticsReadOnlyReader
- AmazonLaunchWizardFullAccessV2Admin
- AmazonLookoutVisionConsoleReadOnlyAccessReader
- AmazonMCSReadOnlyAccessReader
- AmazonRedshiftFullAccessAdmin
- AmazonRedshiftReadOnlyAccessReader
- AutoScalingConsoleReadOnlyAccessReader
- AWSLambdaFullAccessHigh privilegeAdmin
- CloudWatchFullAccessAdmin
- CloudWatchFullAccessV2Admin
- DataScientistHigh privilegeAdmin
- NeptuneGraphReadOnlyAccessReader
- ServiceQuotasFullAccessAdmin
- TranslateReadOnlyReader
Operator and limited (12)
- AmazonApplicationRecoveryControllerRegionSwitchPlanExecutionPolicyOperator
- AmazonCloudWatchEvidentlyFullAccessOperator
- AmazonRDSPerformanceInsightsFullAccessOperator
- AmazonSageMakerClusterInstanceRolePolicyOperator
- BedrockAgentCoreFullAccessOperator
- CloudWatchAgentAdminPolicyOperator
- CloudWatchAgentServerPolicyOperator
- CloudWatchAPIKeyAccessOperator
- CloudWatchCrossAccountSharingConfigurationOperator
- CloudWatchOmniDomainAccessPolicyOperator
- CloudWatchOmniSpaceAccessPolicyOperator
- CloudWatchReadOnlyAccessOperator
Service roles (14)
- AmazonEC2ContainerServiceAutoscaleRoleOperator
- AmazonEC2RoleforDataPipelineRoleHigh privilegeAdmin
- AmazonEC2SpotFleetAutoscaleRoleOperator
- AmazonElasticMapReduceforAutoScalingRoleOperator
- AmazonElasticMapReduceforEC2RoleHigh privilegeAdmin
- AmazonGrafanaCloudWatchAccessAnalyst
- AmazonSageMakerCanvasDirectDeployAccessOperator
- ApplicationAutoScalingForAmazonAppStreamAccessOperator
- AWSCodeDeployRoleForLambdaOperator
- AWSCodeDeployRoleForLambdaLimitedOperator
- AWSIoTFleetHubFederationAccessOperator
- AWSIoTRuleActionsHigh privilegeOperator
- AWSPanoramaApplianceServiceRolePolicyOperator
- AWSShieldDRTAccessPolicyAdmin
Service-linked roles (66)
- AmazonAthenaServiceRolePolicyOperator
- AmazonChimeSDKMediaPipelinesServiceLinkedRolePolicyOperator
- AmazonCloudWatchRUMServiceRolePolicyOperator
- AmazonDocDB-ElasticServiceRolePolicyOperator
- AmazonODBServiceRolePolicyOperator
- AmazonOpenSearchDashboardsServiceRolePolicyOperator
- AmazonOpenSearchIngestionServiceRolePolicyOperator
- AmazonOpenSearchServerlessServiceRolePolicyOperator
- AmazonSageMakerCapacityReservationServiceRolePolicyOperator
- AmazonSESServiceRolePolicyOperator
- AmazonWorkSpacesThinClientMonitoringServiceRolePolicyOperator
- AuroraDsqlServiceLinkedRolePolicyOperator
- AWSAppConfigServiceRolePolicyOperator
- AWSAppFabricServiceRolePolicyOperator
- AWSApplicationAutoscalingAppStreamFleetPolicyOperator
- AWSApplicationAutoscalingCassandraTablePolicyOperator
- AWSApplicationAutoscalingComprehendEndpointPolicyOperator
- AWSApplicationAutoScalingCustomResourcePolicyOperator
- AWSApplicationAutoscalingDynamoDBTablePolicyOperator
- AWSApplicationAutoscalingEC2SpotFleetRequestPolicyOperator
- AWSApplicationAutoscalingECSServicePolicyOperator
- AWSApplicationAutoscalingElastiCacheRGPolicyOperator
- AWSApplicationAutoscalingEMRInstanceGroupPolicyOperator
- AWSApplicationAutoscalingKafkaClusterPolicyOperator
- AWSApplicationAutoscalingLambdaConcurrencyPolicyOperator
- AWSApplicationAutoscalingNeptuneClusterPolicyOperator
- AWSApplicationAutoscalingRDSClusterPolicyOperator
- AWSApplicationAutoscalingSageMakerEndpointPolicyOperator
- AWSApplicationAutoscalingWorkSpacesPoolPolicyOperator
- AWSAutoScalingPlansEC2AutoScalingPolicyOperator
- AWSCleanRoomsServiceRolePolicyOperator
- AWSCloudWatchOmniServiceRolePolicyOperator
- AWSConfigThirdPartyServiceRolePolicyOperator
- AWSDMSFleetAdvisorServiceRolePolicyOperator
- AWSFinSpaceServiceRolePolicyOperator
- AWSHealthImagingServiceRolePolicyOperator
- AWSIncidentManagerServiceRolePolicyOperator
- AWSIoTFleetwiseServiceRolePolicyOperator
- AWSIoTManagedIntegrationsRolePolicyOperator
- AWSIotRoboRunnerServiceRolePolicyOperator
- AWSMediaLiveAnywhereServiceRolePolicyOperator
- AWSPrivateNetworksServiceRolePolicyOperator
- AWSrePostPrivateCloudWatchAccessOperator
- AWSRolesAnywhereServicePolicyOperator
- AWSServiceRoleForAIDevOpsPolicyOperator
- AWSServiceRoleForAmazonQDeveloperOperator
- AWSServiceRoleForAWSTransformCustomOperator
- AWSServiceRoleForNeptuneGraphPolicyOperator
- AWSSocialMessagingServiceRolePolicyOperator
- AWSZonalAutoshiftPracticeRunSLRPolicyOperator
- CloudWatchApplicationSignalsServiceRolePolicyOperator
- CloudWatchEventsServiceRolePolicyOperator
- CloudWatchInternetMonitorServiceRolePolicyOperator
- CloudWatchNetworkFlowMonitorServiceRolePolicyOperator
- CustomerProfilesServiceLinkedRolePolicyOperator
- DynamoDBCloudWatchContributorInsightsServiceRolePolicyOperator
- EC2ApplicationStatusChecksServiceRolePolicyOperator
- EndUserMessagingServiceRolePolicyOperator
- KeyspacesCDCServiceRolePolicyOperator
- KeyspacesReplicationServiceRolePolicyOperator
- MemoryDBServiceRolePolicyOperator
- NovaActServiceRolePolicyOperator
- OpensearchIngestionSelfManagedVpcePolicyOperator
- QAppsServiceRolePolicyOperator
- QBusinessServiceRolePolicyOperator
- SMSVoiceServiceRolePolicyOperator
Also grants CloudWatch actions (200)
- AdministratorAccess
- AdministratorAccess-AWSElasticBeanstalk
- AIDevOpsAgentAccessPolicy
- AIDevOpsAgentActionsPolicy
- AIOpsAssistantPolicy
- AmazonAppStreamFullAccess
- AmazonAthenaFullAccess
- AmazonAuroraDSQLConsoleFullAccess
- AmazonAuroraDSQLFullAccess
- AmazonBraketFullAccess
- AmazonBraketJobsExecutionPolicy
- AmazonCloudWatchRUMFullAccess
- AmazonConnectServiceLinkedRolePolicy
- AmazonConnectSynchronizationServiceRolePolicy
- AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary
- AmazonDevOpsGuruConsoleFullAccess
- AmazonDevOpsGuruFullAccess
- AmazonDevOpsGuruReadOnlyAccess
- AmazonDevOpsGuruServiceRolePolicy
- AmazonDocDBConsoleFullAccess
- AmazonDocDBElasticFullAccess
- AmazonDocDBFullAccess
- AmazonDocDBReadOnlyAccess
- AmazonDynamoDBFullAccess
- AmazonDynamoDBFullAccess_v2
- AmazonDynamoDBFullAccesswithDataPipeline
- AmazonDynamoDBReadOnlyAccess
- AmazonEC2ReadOnlyAccess
- AmazonEC2RoleforSSM
- AmazonEC2RolePolicyForLaunchWizard
- AmazonECS_FullAccess
- AmazonECSInfrastructureRoleforExpressGatewayServices
- AmazonECSServiceRolePolicy
- AmazonEKSMCPReadOnlyAccess
- AmazonEKSServiceRolePolicy
- AmazonElastiCacheFullAccess
- AmazonElasticFileSystemFullAccess
- AmazonElasticFileSystemReadOnlyAccess
- AmazonElasticFileSystemsUtils
- AmazonElasticMapReduceReadOnlyAccess
- AmazonElasticMapReduceRole
- AmazonElasticsearchServiceRolePolicy
- AmazonEMRContainersServiceRolePolicy
- AmazonEMRFullAccessPolicy_v2
- AmazonEMRReadOnlyAccessPolicy_v2
- AmazonEMRServerlessServiceRolePolicy
- AmazonEMRServicePolicy_v2
- AmazonEVSServiceRolePolicy
- AmazonFISServiceRolePolicy
- AmazonFSxConsoleFullAccess
- AmazonFSxConsoleReadOnlyAccess
- AmazonFSxServiceRolePolicy
- AmazonInspector2ServiceRolePolicy
- AmazonInspector2ThirdPartyServiceRolePolicy
- AmazonKendraFullAccess
- AmazonKinesisAnalyticsFullAccess
- AmazonLaunchWizard_Fullaccess
- AmazonLexFullAccess
- AmazonLookoutVisionConsoleFullAccess
- AmazonMCSFullAccess
- AmazonMWAAServiceRolePolicy
- AmazonOpenSearchServiceRolePolicy
- AmazonPersonalizeFullAccess
- AmazonPrometheusScraperServiceRolePolicy
- AmazonRDSBetaServiceRolePolicy
- AmazonRDSCustomInstanceProfileRolePolicy
- AmazonRDSCustomPreviewServiceRolePolicy
- AmazonRDSCustomServiceRolePolicy
- AmazonRDSFullAccess
- AmazonRDSPreviewServiceRolePolicy
- AmazonRDSReadOnlyAccess
- AmazonRDSServiceRolePolicy
- AmazonRedshiftAllCommandsFullAccess
- AmazonRedshiftServiceLinkedRolePolicy
- AmazonRoute53FullAccess
- AmazonSageMakerCanvasFullAccess
- AmazonSageMakerFullAccess
- AmazonSageMakerGroundTruthExecution
- AmazonSageMakerHyperPodInferenceAccess
- AmazonSageMakerReadOnly
- AmazonSSMFullAccess
- AmazonSSMServiceRolePolicy
- AmazonTimestreamInfluxDBServiceRolePolicy
- AmazonWorkMailFullAccess
- AmazonWorkMailReadOnlyAccess
- AmazonWorkSpacesWebServiceRolePolicy
- AppIntegrationsServiceLinkedRolePolicy
- AssuranceServiceRolePolicy
- AutoScalingConsoleFullAccess
- AutoScalingFullAccess
- AutoScalingServiceRolePolicy
- AWS_ConfigRole
- AWSAgentRegistryServiceRolePolicy
- AWSApplicationMigrationFullAccess
- AWSAuditManagerServiceRolePolicy
- AWSBackupFullAccess
- AWSBackupOperatorAccess
- AWSBackupServiceRolePolicyForS3Backup
- AWSBatchFullAccess
- AWSCODAPermissionsBoundary
- AWSCodeBuildAdminAccess
- AWSCodeBuildDeveloperAccess
- AWSCodeBuildReadOnlyAccess
- AWSCodeDeployRole
- AWSCodeDeployRoleForECS
- AWSCodeDeployRoleForECSLimited
- AWSCodeStarServiceRole
- AWSConfigServiceRolePolicy
- AWSDeepRacerRoboMakerAccessPolicy
- AWSDeepRacerServiceRolePolicy
- AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy
- AWSElasticBeanstalkReadOnly
- AWSElasticBeanstalkRoleCore
- AWSElasticBeanstalkService
- AWSElasticBeanstalkServiceRolePolicy
- AWSElasticBeanstalkWorkerTier
- AWSElasticDisasterRecoveryServiceRolePolicy
- AWSFinOpsAgentServiceRolePolicy
- AWSGlueConsoleFullAccess
- AWSGlueConsoleSageMakerNotebookFullAccess
- AWSGlueServiceRole
- AWSIPAMServiceRolePolicy
- AWSLambda_FullAccess
- AWSLambda_ReadOnlyAccess
- AWSM2ServicePolicy
- AWSMcpServiceActionsFullAccess
- AWSObservabilityAdminTelemetryEnablementServiceRolePolicy
- AWSPanoramaFullAccess
- AWSPanoramaGreengrassGroupRolePolicy
- AWSPartnerLedSupportReadOnlyAccess
- AWSPCSServiceRolePolicy
- AWSResilienceHubAsssessmentExecutionPolicy
- AWSResilienceHubResilienceTestingPolicy
- AWSResilienceHubV2AssessmentExecutionPolicy
- AWSResourceExplorerServiceRolePolicy
- AWSSecurityHubServiceRolePolicy
- AWSSecurityHubV2ServiceRolePolicy
- AWSServiceRoleForAWSTransform
- AWSServiceRoleForCodeWhispererPolicy
- AWSSSMForSAPServiceLinkedRolePolicy
- AWSSupportServiceRolePolicy
- AWSSystemsManagerChangeManagementServicePolicy
- AWSSystemsManagerJustInTimeAccessServicePolicy
- AWSTransformInfrastructureExecutorAccessBatch
- AWSTransformServerMigrationAgentPolicy
- AWSTrustedAdvisorServiceRolePolicy
- AWSUserNotificationsServiceLinkedRolePolicy
- AWSVpcLatticeServiceRolePolicy
- AWSWAFConsoleFullAccess
- AWSWAFConsoleReadOnlyAccess
- AWSWellArchitectedAgentResourceScanningServiceRolePolicy
- CloudFrontFullAccess
- CloudWatchActionsEC2Access
- CloudwatchApplicationInsightsServiceLinkedRolePolicy
- CloudWatchApplicationSignalsFullAccess
- CloudWatchApplicationSignalsReadOnlyAccess
- CloudWatchInternetMonitorFullAccess
- CloudWatchInternetMonitorReadOnlyAccess
- CloudWatchLogsFullAccess
- CloudWatchLogsReadOnlyAccess
- CloudWatchNetworkMonitorServiceRolePolicy
- CloudWatchSyntheticsFullAccess
- ComputeOptimizerReadOnlyAccess
- ComputeOptimizerServiceRolePolicy
- ConfigConformsServiceRolePolicy
- ConsoleFullAccessFromVercel
- ConsoleViewOnlyAccessFromVercel
- DatabaseAdministrator
- EC2FastLaunchServiceRolePolicy
- ElastiCacheServiceRolePolicy
- FinOpsAgentAgentPolicy
- GameLiftGameServerGroupPolicy
- NeptuneConsoleFullAccess
- NeptuneFullAccess
- NeptuneReadOnlyAccess
- NetworkAdministrator
- NetworkSecurityDirectorServiceLinkedRolePolicy
- PowerUserAccess
- PricingPlanManagerFullAccess
- ReadOnlyAccess
- ResourceGroupsTaggingAPITagUntagSupportedResources
- ROSASRESupportPolicy
- Route53RecoveryReadinessServiceRolePolicy
- RTBFabricServiceRolePolicy
- SageMakerStudioAdminIAMDefaultExecutionPolicy
- SageMakerStudioAdminIAMPermissiveExecutionPolicy
- SageMakerStudioProjectRoleMachineLearningPolicy
- SageMakerStudioProjectUserRolePermissionsBoundary
- SageMakerStudioProjectUserRolePolicy
- SageMakerStudioUserIAMDefaultExecutionPolicy
- SageMakerStudioUserIAMPermissiveExecutionPolicy
- SecurityAudit
- ServiceQuotasReadOnlyAccess
- SupportUser
- SystemAdministrator
- TranslateFullAccess
- ViewOnlyAccess
- VPCLatticeFullAccess
- VPCLatticeReadOnlyAccess
- WellArchitectedAgentResourceScanning
assumeaccessprofile batchgetservicelevelindicatorreport batchgetservicelevelobjectivebudgetreport callwithbearertoken createaccessgrant createaccessprofile createalert createdomain createdomainaccessgrantfororganization createdomainfororganization createingestionendpoint createintegration createomnidashboard createomnithread createonetimedeeplinkcode createresourcemetricsconfiguration createservicelevelobjective createspace createview deleteaccessgrant deleteaccessprofile deletealarmmuterule deletealarms deletealert deleteanomalydetector deletedashboards deletedomain deletedomainaccessgrantfororganization deletedomainfororganization deleteingestionendpoint deleteinsightrules deleteintegration deletemetricdataquerydefinition deletemetricstream deleteomnidashboard deleteomnithread deletepipelinerule deleteresourcemetricsconfiguration deleteservicelevelobjective deletespace deleteview describealarmhistory describealarms describealarmsformetric describeanomalydetectors describeinsightrules detectgroupoutliers disablealarmactions disableinsightrules enablealarmactions enableinsightrules enabletopologydiscovery generatequery generatequeryresultssummary getaccessgrant getaccessprofile getagentgraph getalarmmuterule getalert getcontextgraph getdashboard getdataset getdomain getdomainaccessgrantfororganization getdomainfororganization getingestionendpoint getinsightrulereport getintegration getintelligenceconfiguration getmetricdata getmetricdataquerydefinition getmetricstatistics getmetricstream getmetricwidgetimage getotelenrichment getomnidashboard getomnithread getpreferences getprofilerecords getrecords getresourcemetricsconfiguration getservice getservicedata getservicelevelobjective getspace getspacecredentials getspacecredentialsfororganization getspacedataaccess gettelemetryqueryresults gettopologydiscoverystatus gettopologymap getview invokeintegration link listaccessgrants listaccessprofiles listalarmmuterules listalertcontributors listalerts listdashboards listdomainaccessgrantsfororganization listdomains listentitiesformetric listingestionendpoints listintegrations listmanagedinsightrules listmetricdataquerydefinitions listmetricstreams listmetrics listomnidashboards listomnithreads listservicelevelobjectives listservices listspaceaccess listspaces listspacesfororganization listtagsforresource listtelemetryfields listtelemetryquerysessions listviews putalarmmuterule putanomalydetector putcompositealarm putdashboard putinsightrule putintelligenceconfiguration putlogalarm putmanagedinsightrules putmetricalarm putmetricdata putmetricdataquerydefinition putmetricstream putpipelinerule putprofilerecords putrecords querytraces searchprincipals setalarmstate startmetricstreams startotelenrichment startomnithreadsession starttelemetryquery starttelemetryquerysession stopmetricstreams stopotelenrichment stoptelemetryquery stoptelemetryquerysession submitalarmfeedback submitfeedback tagresource untagresource updateaccessprofile updatealert updatedomain updatedomainfororganization updateingestionendpoint updateintegration updateotelenrichment updateomnidashboard updateomnithread updatepreferences updateresourcemetricsconfiguration updateservicelevelobjective updatespace updateview
Actions (165)
| Action | Access level | Policies granting without limits | Policies granting with resource or condition limits |
|---|---|---|---|
| cloudwatch:AssumeAccessProfile | Permissions management | 15 | 2 |
| cloudwatch:BatchGetServiceLevelIndicatorReport | Read | 17 | 1 |
| cloudwatch:BatchGetServiceLevelObjectiveBudgetReport | Read | 17 | 1 |
| cloudwatch:CallWithBearerToken | Write | 16 | 1 |
| cloudwatch:CreateAccessGrant | Permissions management | 15 | 2 |
| cloudwatch:CreateAccessProfile | Permissions management | 15 | 2 |
| cloudwatch:CreateAlert | Write | 15 | 2 |
| cloudwatch:CreateDomain | Write | 15 | 1 |
| cloudwatch:CreateDomainAccessGrantForOrganization | Permissions management | 15 | 2 |
| cloudwatch:CreateDomainForOrganization | Write | 15 | 1 |
| cloudwatch:CreateIngestionEndpoint | Write | 15 | 1 |
| cloudwatch:CreateIntegration | Write | 15 | 3 |
| cloudwatch:CreateOmniDashboard | Write | 15 | 2 |
| cloudwatch:CreateOmniThread | Write | 15 | 2 |
| cloudwatch:CreateOneTimeDeepLinkCode | Write | 16 | 1 |
| cloudwatch:CreateResourceMetricsConfiguration | Write | 15 | 1 |
| cloudwatch:CreateServiceLevelObjective | Write | 15 | 1 |
| cloudwatch:CreateSpace | Write | 15 | 1 |
| cloudwatch:CreateView | Write | 15 | 2 |
| cloudwatch:DeleteAccessGrant | Permissions management | 15 | 2 |
| cloudwatch:DeleteAccessProfile | Permissions management | 15 | 2 |
| cloudwatch:DeleteAlarmMuteRule | Write | 15 | 1 |
| cloudwatch:DeleteAlarms | Write | 46 | 20 |
| cloudwatch:DeleteAlert | Write | 15 | 2 |
| cloudwatch:DeleteAnomalyDetector | Write | 16 | 1 |
| cloudwatch:DeleteDashboards | Write | 15 | 1 |
| cloudwatch:DeleteDomain | Write | 15 | 1 |
| cloudwatch:DeleteDomainAccessGrantForOrganization | Permissions management | 15 | 2 |
| cloudwatch:DeleteDomainForOrganization | Write | 15 | 1 |
| cloudwatch:DeleteIngestionEndpoint | Write | 15 | 1 |
| cloudwatch:DeleteInsightRules | Write | 15 | 2 |
| cloudwatch:DeleteIntegration | Write | 15 | 3 |
| cloudwatch:DeleteMetricDataQueryDefinition | Write | 15 | 1 |
| cloudwatch:DeleteMetricStream | Write | 15 | 1 |
| cloudwatch:DeleteOmniDashboard | Write | 15 | 2 |
| cloudwatch:DeleteOmniThread | Write | 15 | 2 |
| cloudwatch:DeletePipelineRule | Write | 15 | 1 |
| cloudwatch:DeleteResourceMetricsConfiguration | Write | 15 | 1 |
| cloudwatch:DeleteServiceLevelObjective | Write | 15 | 1 |
| cloudwatch:DeleteSpace | Write | 15 | 1 |
| cloudwatch:DeleteView | Write | 15 | 2 |
| cloudwatch:DescribeAlarmHistory | Read | 44 | 2 |
| cloudwatch:DescribeAlarms | Read | 111 | 16 |
| cloudwatch:DescribeAlarmsForMetric | Read | 50 | 1 |
| cloudwatch:DescribeAnomalyDetectors | Read | 40 | 1 |
| cloudwatch:DescribeInsightRules | Read | 39 | 1 |
| cloudwatch:DetectGroupOutliers | Read | 16 | 1 |
| cloudwatch:DisableAlarmActions | Write | 17 | 1 |
| cloudwatch:DisableInsightRules | Write | 15 | 1 |
| cloudwatch:EnableAlarmActions | Write | 17 | 3 |
| cloudwatch:EnableInsightRules | Write | 15 | 1 |
| cloudwatch:EnableTopologyDiscovery | Write | 15 | 1 |
| cloudwatch:GenerateQuery | Read | 22 | 1 |
| cloudwatch:GenerateQueryResultsSummary | Read | 18 | 1 |
| cloudwatch:GetAccessGrant | Read | 27 | 2 |
| cloudwatch:GetAccessProfile | Read | 27 | 2 |
| cloudwatch:GetAgentGraph | Read | 27 | 1 |
| cloudwatch:GetAlarmMuteRule | Read | 31 | 2 |
| cloudwatch:GetAlert | Read | 28 | 2 |
| cloudwatch:GetContextGraph | Read | 28 | 2 |
| cloudwatch:GetDashboard | Read | 36 | 3 |
| cloudwatch:GetDataset | Read | 28 | 1 |
| cloudwatch:GetDomain | Read | 27 | 2 |
| cloudwatch:GetDomainAccessGrantForOrganization | Read | 27 | 2 |
| cloudwatch:GetDomainForOrganization | Read | 27 | 1 |
| cloudwatch:GetIngestionEndpoint | Read | 27 | 1 |
| cloudwatch:GetInsightRuleReport | Read | 32 | 4 |
| cloudwatch:GetIntegration | Read | 27 | 2 |
| cloudwatch:GetIntelligenceConfiguration | Read | 28 | 2 |
| cloudwatch:GetMetricData | Read | 123 | 6 |
| cloudwatch:GetMetricDataQueryDefinition | Read | 27 | 1 |
| cloudwatch:GetMetricStatistics | Read | 97 | 2 |
| cloudwatch:GetMetricStream | Read | 34 | 3 |
| cloudwatch:GetMetricWidgetImage | Read | 28 | 2 |
| cloudwatch:GetOTelEnrichment | Read | 28 | 3 |
| cloudwatch:GetOmniDashboard | Read | 27 | 2 |
| cloudwatch:GetOmniThread | Read | 27 | 2 |
| cloudwatch:GetPreferences | Read | 27 | 2 |
| cloudwatch:GetProfileRecords | Read | 28 | 1 |
| cloudwatch:GetRecords | Read | 28 | 2 |
| cloudwatch:GetResourceMetricsConfiguration | Read | 27 | 1 |
| cloudwatch:GetService | Read | 29 | 1 |
| cloudwatch:GetServiceData | Read | 27 | 1 |
| cloudwatch:GetServiceLevelObjective | Read | 29 | 1 |
| cloudwatch:GetSpace | Read | 28 | 2 |
| cloudwatch:GetSpaceCredentials | Read | 27 | 1 |
| cloudwatch:GetSpaceCredentialsForOrganization | Read | 27 | 1 |
| cloudwatch:GetSpaceDataAccess | Read | 27 | 2 |
| cloudwatch:GetTelemetryQueryResults | Read | 28 | 2 |
| cloudwatch:GetTopologyDiscoveryStatus | Read | 27 | 1 |
| cloudwatch:GetTopologyMap | Read | 27 | 1 |
| cloudwatch:GetView | Read | 27 | 2 |
| cloudwatch:InvokeIntegration | Write | 15 | 2 |
| cloudwatch:Link | Write | 16 | 1 |
| cloudwatch:ListAccessGrants | List | 29 | 2 |
| cloudwatch:ListAccessProfiles | List | 29 | 2 |
| cloudwatch:ListAlarmMuteRules | List | 33 | 2 |
| cloudwatch:ListAlertContributors | List | 29 | 1 |
| cloudwatch:ListAlerts | List | 29 | 2 |
| cloudwatch:ListDashboards | List | 38 | 4 |
| cloudwatch:ListDomainAccessGrantsForOrganization | List | 29 | 2 |
| cloudwatch:ListDomains | List | 29 | 1 |
| cloudwatch:ListEntitiesForMetric | List | 29 | 1 |
| cloudwatch:ListIngestionEndpoints | List | 29 | 1 |
| cloudwatch:ListIntegrations | List | 29 | 3 |
| cloudwatch:ListManagedInsightRules | Read | 34 | 3 |
| cloudwatch:ListMetricDataQueryDefinitions | List | 29 | 1 |
| cloudwatch:ListMetricStreams | List | 34 | 3 |
| cloudwatch:ListMetrics | List | 82 | 5 |
| cloudwatch:ListOmniDashboards | List | 29 | 2 |
| cloudwatch:ListOmniThreads | List | 29 | 2 |
| cloudwatch:ListServiceLevelObjectives | List | 29 | 1 |
| cloudwatch:ListServices | List | 29 | 1 |
| cloudwatch:ListSpaceAccess | List | 29 | 1 |
| cloudwatch:ListSpaces | List | 29 | 2 |
| cloudwatch:ListSpacesForOrganization | List | 29 | 2 |
| cloudwatch:ListTagsForResource | List | 34 | 4 |
| cloudwatch:ListTelemetryFields | List | 29 | 1 |
| cloudwatch:ListTelemetryQuerySessions | List | 29 | 2 |
| cloudwatch:ListViews | List | 29 | 2 |
| cloudwatch:PutAlarmMuteRule | Write | 16 | 1 |
| cloudwatch:PutAnomalyDetector | Write | 17 | 1 |
| cloudwatch:PutCompositeAlarm | Write | 16 | 1 |
| cloudwatch:PutDashboard | Write | 16 | 3 |
| cloudwatch:PutInsightRule | Write | 16 | 2 |
| cloudwatch:PutIntelligenceConfiguration | Write | 16 | 2 |
| cloudwatch:PutLogAlarm | Write | 16 | 1 |
| cloudwatch:PutManagedInsightRules | Write | 16 | 1 |
| cloudwatch:PutMetricAlarm | Write | 54 | 22 |
| cloudwatch:PutMetricData | Write | 35 | 90 |
| cloudwatch:PutMetricDataQueryDefinition | Write | 16 | 1 |
| cloudwatch:PutMetricStream | Write | 16 | 1 |
| cloudwatch:PutPipelineRule | Write | 16 | 1 |
| cloudwatch:PutProfileRecords | Write | 18 | 3 |
| cloudwatch:PutRecords | Write | 16 | 1 |
| cloudwatch:QueryTraces | Write | 15 | 1 |
| cloudwatch:SearchPrincipals | Write | 15 | 2 |
| cloudwatch:SetAlarmState | Write | 16 | 1 |
| cloudwatch:StartMetricStreams | Write | 15 | 1 |
| cloudwatch:StartOTelEnrichment | Write | 15 | 2 |
| cloudwatch:StartOmniThreadSession | Write | 15 | 2 |
| cloudwatch:StartTelemetryQuery | Write | 16 | 1 |
| cloudwatch:StartTelemetryQuerySession | Write | 16 | 2 |
| cloudwatch:StopMetricStreams | Write | 15 | 1 |
| cloudwatch:StopOTelEnrichment | Write | 15 | 1 |
| cloudwatch:StopTelemetryQuery | Write | 16 | 2 |
| cloudwatch:StopTelemetryQuerySession | Write | 16 | 2 |
| cloudwatch:SubmitAlarmFeedback | Write | 15 | 1 |
| cloudwatch:SubmitFeedback | Write | 15 | 2 |
| cloudwatch:TagResource | Tagging | 16 | 7 |
| cloudwatch:UntagResource | Tagging | 16 | 3 |
| cloudwatch:UpdateAccessProfile | Permissions management | 15 | 2 |
| cloudwatch:UpdateAlert | Write | 15 | 2 |
| cloudwatch:UpdateDomain | Write | 15 | 1 |
| cloudwatch:UpdateDomainForOrganization | Write | 15 | 1 |
| cloudwatch:UpdateIngestionEndpoint | Write | 15 | 1 |
| cloudwatch:UpdateIntegration | Write | 15 | 2 |
| cloudwatch:UpdateOTelEnrichment | Write | 15 | 1 |
| cloudwatch:UpdateOmniDashboard | Write | 15 | 2 |
| cloudwatch:UpdateOmniThread | Write | 15 | 2 |
| cloudwatch:UpdatePreferences | Write | 15 | 2 |
| cloudwatch:UpdateResourceMetricsConfiguration | Write | 15 | 1 |
| cloudwatch:UpdateServiceLevelObjective | Write | 15 | 1 |
| cloudwatch:UpdateSpace | Write | 15 | 2 |
| cloudwatch:UpdateView | Write | 15 | 2 |