CloudWatch Logs

Prefix logs, 133 actions · Domain Monitoring & Observability

116 AWS managed policies. 8 have reviewed guidance; the rest have authoritative permission data pending editorial review. 35 are service-linked role policies, shown with permission data only.

User access (14)

AmazonBraketFullAccessAdmin
AmazonCloudWatchRUMFullAccessAdmin
AmazonDataZoneProjectRolePermissionsBoundaryAdmin
AmazonMonitronFullAccessAdmin
AmazonSSMFullAccessAdmin
AWSBatchFullAccessAdmin
AWSLambda_ReadOnlyAccessAnalyst
AWSLambdaFullAccessHigh privilegeAdmin
AWSPanoramaFullAccessAdmin
CloudWatchFullAccessAdmin
CloudWatchFullAccessV2Admin
CloudWatchInternetMonitorReadOnlyAccessAnalyst
CloudWatchLogsFullAccessAdmin
CloudWatchLogsReadOnlyAccessAnalyst

Operator and limited (37)

AlexaForBusinessGatewayExecutionOperator
AmazonBraketJobsExecutionPolicyOperator
AmazonEKSLocalOutpostClusterPolicyOperator
AmazonEKSServicePolicyOperator
AmazonElasticFileSystemsUtilsOperator
AmazonRDSCustomInstanceProfileRolePolicyOperator
AmazonSageMakerClusterInstanceRolePolicyOperator
AmazonSageMakerGroundTruthExecutionOperator
AWSCleanRoomsFullAccessNoQueryingOperator
AWSDeepLensLambdaFunctionAccessPolicyOperator
AWSDiscoveryContinuousExportFirehosePolicyOperator
AWSElasticBeanstalkEKSImageBuildOperator
AWSIoTWirelessLoggingOperator
AWSLambdaExecuteOperator
AWSLambdaManagedEC2ResourceOperatorOperator
AWSNetworkFirewallFullAccessOperator
AWSProtonCodeBuildProvisioningBasicAccessOperator
AWSThinkboxAssetServerPolicyOperator
AWSThinkboxAWSPortalGatewayPolicyOperator
AWSThinkboxAWSPortalWorkerPolicyOperator
AWSThinkboxDeadlineResourceTrackerAccessPolicyOperator
AWSTransformInfrastructureExecutorAccessBatchOperator
AWSTransformSecurityAgentExecutorAccessOperator
BedrockAgentCoreFullAccessOperator
CloudWatchAgentAdminPolicyOperator
CloudWatchAgentServerPolicyOperator
CloudWatchInternetMonitorFullAccessOperator
CloudWatchLambdaApplicationSignalsExecutionRolePolicyOperator
CloudWatchLambdaInsightsExecutionRolePolicyOperator
CloudWatchLogsAPIKeyAccessOperator
CloudWatchLogsCrossAccountSharingConfigurationOperator
CloudWatchOpenSearchDashboardAccessOperator
CloudWatchOpenSearchDashboardsFullAccessOperator
CloudWatchReadOnlyAccessOperator
EC2InstanceProfileForImageBuilderOperator
EC2InstanceProfileForImageBuilderECRContainerBuildsOperator
GameLiftContainerFleetPolicyOperator

Service roles (30)

AmazonAPIGatewayPushToCloudWatchLogsOperator
AmazonDMSCloudWatchLogsRoleOperator
AmazonEC2ContainerServiceforEC2RoleOperator
AmazonEC2RoleforSSMHigh privilegeOperator
AmazonECSTaskExecutionRolePolicyOperator
AmazonGrafanaCloudWatchAccessAnalyst
AmazonRDSEnhancedMonitoringRoleOperator
AmazonS3ObjectLambdaExecutionRolePolicyOperator
AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicyOperator
AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicyOperator
AmazonSecurityLakeMetastoreManagerOperator
AmazonSNSRoleOperator
AWSAppSyncPushToCloudWatchLogsOperator
AWSCodeStarServiceRoleAdmin
AWSControlTowerCloudTrailRolePolicyOperator
AWSElasticBeanstalkEnhancedHealthOperator
AWSElasticBeanstalkRoleCWLOperator
AWSGlueDataBrewServiceRoleOperator
AWSIoTLoggingOperator
AWSLambdaBasicDurableExecutionRolePolicyOperator
AWSLambdaBasicExecutionRoleOperator
AWSLambdaDynamoDBExecutionRoleOperator
AWSLambdaKinesisExecutionRoleOperator
AWSLambdaMSKExecutionRoleOperator
AWSLambdaSQSQueueExecutionRoleOperator
AWSLambdaVPCAccessExecutionRoleOperator
AWSPanoramaApplianceRolePolicyOperator
AWSPanoramaApplianceServiceRolePolicyOperator
AWSTransferLoggingAccessOperator
AWSTransformApplicationECSDeploymentPolicyOperator

Service-linked roles (35)

AmazonBraketServiceRolePolicyOperator
AmazonGuardDutyMalwareProtectionServiceRolePolicyOperator
AmazonMacieServiceRolePolicyOperator
AmazonManagedBlockchainServiceRolePolicyOperator
AmazonMQServiceRolePolicyOperator
AmazonMWAAServiceRolePolicyOperator
AmazonRedshiftServiceLinkedRolePolicyOperator
AmazonSageMakerHyperPodServiceRolePolicyOperator
AmazonWorkMailEventsServiceRolePolicyOperator
APIGatewayServiceRolePolicyOperator
ApplicationDiscoveryServiceContinuousExportServiceRolePolicyOperator
AppRunnerServiceRolePolicyOperator
AppStudioServiceRolePolicyOperator
AuroraDsqlServiceLinkedRolePolicyOperator
AWSChatbotServiceLinkedRolePolicyOperator
AWSCloudFrontLoggerOperator
AWSDataSyncDiscoveryServiceRolePolicyOperator
AWSDataSyncServiceRolePolicyOperator
AWSElasticLoadBalancingServiceRolePolicyOperator
AWSIoTManagedIntegrationsRolePolicyOperator
AWSMediaTailorServiceRolePolicyOperator
AWSObservabilityAdminLogsCentralizationServiceRolePolicyOperator
AWSObservabilityAdminTelemetryEnablementServiceRolePolicyOperator
AWSServiceRoleForAWSTransformCustomOperator
AWSServiceRoleForIoTSiteWiseOperator
AWSServiceRoleForNeptuneGraphPolicyOperator
ClientVPNServiceRolePolicyOperator
CloudHSMServiceRolePolicyOperator
CloudWatchApplicationSignalsServiceRolePolicyOperator
CloudWatchInternetMonitorServiceRolePolicyOperator
MediaPackageServiceRolePolicyOperator
MonitronServiceRolePolicyOperator
QBusinessServiceRolePolicyOperator
Route53ResolverServiceRolePolicyOperator
SecurityLakeServiceLinkedRoleOperator

Also grants CloudWatch Logs actions (151)

associatekmskey associatesourcetos3tableintegration callwithbearertoken cancelexporttask cancelimporttask createdelivery createexporttask createimporttask createloganomalydetector createlogdelivery createloggroup createlogstream createlookuptable createscheduledquery deleteaccountpolicy deletedataprotectionpolicy deletedelivery deletedeliverydestination deletedeliverydestinationpolicy deletedeliverysource deletedestination deleteindexpolicy deleteintegration deleteloganomalydetector deletelogdelivery deleteloggroup deletelogstream deletelookuptable deletemetricfilter deletepipelinerule deletequerydefinition deleteresourcepolicy deleteretentionpolicy deletescheduledquery deletesubscriptionfilter deletesyslogconfiguration deletetransformer describeaccountpolicies describeconfigurationtemplates describedeliveries describedeliverydestinations describedeliverysources describedestinations describeexporttasks describefieldindexes describeimporttaskbatches describeimporttasks describeindexpolicies describeloggroups describelogstreams describelookuptables describemetricfilters describequeries describequerydefinitions describeresourcepolicies describesubscriptionfilters disassociatekmskey disassociatesourcefroms3tableintegration filterlogevents getdataprotectionpolicy getdelivery getdeliverydestination getdeliverydestinationpolicy getdeliverysource getintegration getloganomalydetector getlogdelivery getlogevents getlogfields getloggroupfields getlogrecord getlookuptable getqueryresults getscheduledquery getscheduledqueryhistory getstoragetierpolicy gettransformer integratewithdataset integratewiths3table link listaggregateloggroupsummaries listanomalies listentitiesforloggroup listintegrations listloganomalydetectors listlogdeliveries listloggroups listloggroupsforentity listloggroupsforquery listscheduledqueries listsourcesfors3tableintegration listsyslogconfigurations listtagsforresource listtagsloggroup processwithpipeline putaccountpolicy putbearertokenauthentication putdataprotectionpolicy putdeliverydestination putdeliverydestinationpolicy putdeliverysource putdestination putdestinationpolicy putindexpolicy putintegration putlogevents putloggroupdeletionprotection putmetricfilter putpipelinerule putquerydefinition putresourcepolicy putretentionpolicy putstoragetierpolicy putsubscriptionfilter putsyslogconfiguration puttransformer startlivetail startquery stoplivetail stopquery tagloggroup tagresource testmetricfilter testtransformer unmask untagloggroup untagresource updateanomaly updatedeliveryconfiguration updateloganomalydetector updatelogdelivery updatelookuptable updatescheduledquery

Actions (133)

CloudWatch Logs actions that managed policies grant
Action	Access level	Policies granting without limits	Policies granting with resource or condition limits
logs:AssociateKmsKey	Write	14	4
logs:AssociateSourceToS3TableIntegration	Write	14	2
logs:CallWithBearerToken	Write	15	2
logs:CancelExportTask	Write	14	2
logs:CancelImportTask	Write	14	2
logs:CreateDelivery	Write	15	4
logs:CreateExportTask	Write	15	3
logs:CreateImportTask	Write	15	3
logs:CreateLogAnomalyDetector	Write	15	3
logs:CreateLogDelivery	Write	29	11
logs:CreateLogGroup	Write	57	109
logs:CreateLogStream	Write	46	106
logs:CreateLookupTable	Write	15	3
logs:CreateScheduledQuery	Write	15	3
logs:DeleteAccountPolicy	Write	14	2
logs:DeleteDataProtectionPolicy	Write	14	3
logs:DeleteDelivery	Write	14	2
logs:DeleteDeliveryDestination	Write	14	2
logs:DeleteDeliveryDestinationPolicy	Write	14	2
logs:DeleteDeliverySource	Write	14	2
logs:DeleteDestination	Write	14	2
logs:DeleteIndexPolicy	Write	14	2
logs:DeleteIntegration	Write	15	2
logs:DeleteLogAnomalyDetector	Write	14	2
logs:DeleteLogDelivery	Write	27	10
logs:DeleteLogGroup	Write	15	17
logs:DeleteLogStream	Write	15	5
logs:DeleteLookupTable	Write	14	2
logs:DeleteMetricFilter	Write	14	2
logs:DeletePipelineRule	Write	14	2
logs:DeleteQueryDefinition	Write	14	2
logs:DeleteResourcePolicy	Permissions management	14	2
logs:DeleteRetentionPolicy	Write	15	4
logs:DeleteScheduledQuery	Write	14	2
logs:DeleteSubscriptionFilter	Write	14	3
logs:DeleteSyslogConfiguration	Write	14	2
logs:DeleteTransformer	Write	14	2
logs:DescribeAccountPolicies	List	33	7
logs:DescribeConfigurationTemplates	List	29	6
logs:DescribeDeliveries	List	33	8
logs:DescribeDeliveryDestinations	List	33	9
logs:DescribeDeliverySources	List	33	9
logs:DescribeDestinations	List	34	11
logs:DescribeExportTasks	List	32	9
logs:DescribeFieldIndexes	List	30	6
logs:DescribeImportTaskBatches	List	29	6
logs:DescribeImportTasks	List	29	6
logs:DescribeIndexPolicies	List	33	8
logs:DescribeLogGroups	List	94	42
logs:DescribeLogStreams	List	60	74
logs:DescribeLookupTables	List	29	6
logs:DescribeMetricFilters	List	37	11
logs:DescribeQueries	List	31	10
logs:DescribeQueryDefinitions	List	34	13
logs:DescribeResourcePolicies	List	43	16
logs:DescribeSubscriptionFilters	List	32	11
logs:DisassociateKmsKey	Write	14	3
logs:DisassociateSourceFromS3TableIntegration	Write	14	2
logs:FilterLogEvents	Read	26	17
logs:GetDataProtectionPolicy	Read	28	8
logs:GetDelivery	Read	27	6
logs:GetDeliveryDestination	Read	27	6
logs:GetDeliveryDestinationPolicy	Read	27	6
logs:GetDeliverySource	Read	27	6
logs:GetIntegration	Read	27	6
logs:GetLogAnomalyDetector	Read	27	7
logs:GetLogDelivery	Read	41	16
logs:GetLogEvents	Read	47	35
logs:GetLogFields	Read	21	6
logs:GetLogGroupFields	Read	26	12
logs:GetLogRecord	Read	23	12
logs:GetLookupTable	Read	21	5
logs:GetQueryResults	Read	34	15
logs:GetScheduledQuery	Read	22	6
logs:GetScheduledQueryHistory	Read	21	5
logs:GetStorageTierPolicy	Read	21	5
logs:GetTransformer	Read	23	6
logs:IntegrateWithDataset	Write	14	2
logs:IntegrateWithS3Table	Write	14	2
logs:Link	Write	15	2
logs:ListAggregateLogGroupSummaries	List	20	5
logs:ListAnomalies	List	21	5
logs:ListEntitiesForLogGroup	List	21	5
logs:ListIntegrations	List	26	6
logs:ListLogAnomalyDetectors	List	24	6
logs:ListLogDeliveries	List	38	15
logs:ListLogGroups	List	20	6
logs:ListLogGroupsForEntity	List	21	5
logs:ListLogGroupsForQuery	List	22	5
logs:ListScheduledQueries	List	20	6
logs:ListSourcesForS3TableIntegration	List	20	6
logs:ListSyslogConfigurations	List	19	5
logs:ListTagsForResource	List	26	10
logs:ListTagsLogGroup	List	24	5
logs:ProcessWithPipeline	Write	14	2
logs:PutAccountPolicy	Write	14	2
logs:PutBearerTokenAuthentication	Write	14	2
logs:PutDataProtectionPolicy	Write	14	3
logs:PutDeliveryDestination	Write	14	3
logs:PutDeliveryDestinationPolicy	Write	14	2
logs:PutDeliverySource	Write	14	3
logs:PutDestination	Write	14	2
logs:PutDestinationPolicy	Write	14	2
logs:PutIndexPolicy	Write	14	3
logs:PutIntegration	Write	15	2
logs:PutLogEvents	Write	47	103
logs:PutLogGroupDeletionProtection	Write	14	2
logs:PutMetricFilter	Write	17	2
logs:PutPipelineRule	Write	14	2
logs:PutQueryDefinition	Write	14	2
logs:PutResourcePolicy	Permissions management	17	15
logs:PutRetentionPolicy	Write	22	32
logs:PutStorageTierPolicy	Write	14	2
logs:PutSubscriptionFilter	Write	14	3
logs:PutSyslogConfiguration	Write	14	2
logs:PutTransformer	Write	14	2
logs:StartLiveTail	Read	18	4
logs:StartQuery	Read	29	19
logs:StopLiveTail	Read	20	4
logs:StopQuery	Read	29	7
logs:TagLogGroup	Tagging	15	4
logs:TagResource	Tagging	15	10
logs:TestMetricFilter	Read	22	5
logs:TestTransformer	Read	14	2
logs:Unmask	Read	14	2
logs:UntagLogGroup	Tagging	15	2
logs:UntagResource	Tagging	15	7
logs:UpdateAnomaly	Write	14	2
logs:UpdateDeliveryConfiguration	Write	14	2
logs:UpdateLogAnomalyDetector	Write	14	2
logs:UpdateLogDelivery	Write	24	9
logs:UpdateLookupTable	Write	14	2
logs:UpdateScheduledQuery	Write	14	2