cloudwatch

159 actions in the cloudwatch service. Select an action to see its access level, resource ARNs, condition keys, and a copy-paste IAM policy.

cloudwatch:AssumeAccessProfile

Permissions management

Grants permission to assume an access profile

cloudwatch:BatchGetServiceLevelIndicatorReport

Read

Grants permission to batch get service level indicator report

cloudwatch:BatchGetServiceLevelObjectiveBudgetReport

Read

Grants permission to batch retrieve a service level objective budget report

cloudwatch:CallWithBearerToken

Write

Grants permission to make API calls to CloudWatch using bearer token authentication

cloudwatch:CreateAccessGrant

Permissions management

Grants permission to create an access grant

cloudwatch:CreateAccessProfile

Permissions management

Grants permission to create an access profile

cloudwatch:CreateAlert

Write

Grants permission to create an alert

cloudwatch:CreateDomain

Write

Grants permission to create a domain

cloudwatch:CreateDomainAccessGrantForOrganization

Permissions management

Grants permission to create a domain access grant for an organization

cloudwatch:CreateDomainForOrganization

Write

Grants permission to create a domain for an organization

cloudwatch:CreateIngestionEndpoint

Write

Grants permission to create an ingestion endpoint

cloudwatch:CreateIntegration

Write

Grants permission to create an integration

cloudwatch:CreateOmniDashboard

Write

Grants permission to create an omni dashboard

cloudwatch:CreateOmniThread

Write

Grants permission to create an omni thread

cloudwatch:CreateOneTimeDeepLinkCode

Write

Grants permission to create a one-time deep link code

cloudwatch:CreateResourceMetricsConfiguration

Write

Grants permission to create a resource metrics configuration that enables detailed monitoring for a resource

cloudwatch:CreateServiceLevelObjective

Write

Grants permission to create a service level objective

cloudwatch:CreateSpace

Write

Grants permission to create a space

cloudwatch:CreateView

Write

Grants permission to create a view

cloudwatch:DeleteAccessGrant

Permissions management

Grants permission to delete an access grant

cloudwatch:DeleteAccessProfile

Permissions management

Grants permission to delete an access profile

cloudwatch:DeleteAlarmMuteRule

Write

Grants permission to delete an alarm mute rule

cloudwatch:DeleteAlarms

Write

Grants permission to delete a collection of alarms

cloudwatch:DeleteAlert

Write

Grants permission to delete an alert

cloudwatch:DeleteAnomalyDetector

Write

Grants permission to delete the specified anomaly detection model from your account

cloudwatch:DeleteDashboards

Write

Grants permission to delete all CloudWatch dashboards that you specify

cloudwatch:DeleteDomain

Write

Grants permission to delete a domain

cloudwatch:DeleteDomainAccessGrantForOrganization

Permissions management

Grants permission to delete a domain access grant for an organization

cloudwatch:DeleteDomainForOrganization

Write

Grants permission to delete a domain for an organization

cloudwatch:DeleteIngestionEndpoint

Write

Grants permission to delete an ingestion endpoint

cloudwatch:DeleteInsightRules

Write

Grants permission to delete a collection of insight rules

cloudwatch:DeleteIntegration

Write

Grants permission to delete an integration

cloudwatch:DeleteMetricStream

Write

Grants permission to delete the CloudWatch metric stream that you specify

cloudwatch:DeleteOmniDashboard

Write

Grants permission to delete an omni dashboard

cloudwatch:DeleteOmniThread

Write

Grants permission to delete an omni thread

cloudwatch:DeletePipelineRule

Write

Grants permission to delete a pipeline rule for CloudWatch pipelines for OTel metric processing

cloudwatch:DeleteResourceMetricsConfiguration

Write

Grants permission to delete a resource metrics configuration and disable detailed monitoring for a resource

cloudwatch:DeleteServiceLevelObjective

Write

Grants permission to delete a service level objective

cloudwatch:DeleteSpace

Write

Grants permission to delete a space

cloudwatch:DeleteView

Write

Grants permission to delete a view

cloudwatch:DescribeAlarmHistory

Read

Grants permission to retrieve the history for the specified alarm

cloudwatch:DescribeAlarms

Read

Grants permission to describe all alarms, currently owned by the user's account

cloudwatch:DescribeAlarmsForMetric

Read

Grants permission to describe all alarms configured on the specified metric, currently owned by the user's account

cloudwatch:DescribeAnomalyDetectors

Read

Grants permission to list the anomaly detection models that you have created in your account

cloudwatch:DescribeInsightRules

Read

Grants permission to describe all insight rules, currently owned by the user's account

cloudwatch:DisableAlarmActions

Write

Grants permission to disable actions for a collection of alarms

cloudwatch:DisableInsightRules

Write

Grants permission to disable a collection of insight rules

cloudwatch:EnableAlarmActions

Write

Grants permission to enable actions for a collection of alarms

cloudwatch:EnableInsightRules

Write

Grants permission to enable a collection of insight rules

cloudwatch:EnableTopologyDiscovery

Write

Grants permission to enable a CloudWatch topology discovery

cloudwatch:GenerateQuery

Read

Grants permission to generate a Metrics Insights or Logs Insights query string from a natural language prompt

cloudwatch:GenerateQueryResultsSummary

Read

Grants permission to generate a summary of CloudWatch LogInsights query results in natural language using generative AI

cloudwatch:GetAccessGrant

Read

Grants permission to get an access grant

cloudwatch:GetAccessProfile

Read

Grants permission to get an access profile

cloudwatch:GetAgentGraph

Read

Grants permission to get an agent graph

cloudwatch:GetAlarmMuteRule

Read

Grants permission to get an alarm mute rule

cloudwatch:GetAlert

Read

Grants permission to get an alert

cloudwatch:GetContextGraph

Read

Grants permission to get a context graph

cloudwatch:GetDashboard

Read

Grants permission to display the details of the CloudWatch dashboard you specify

cloudwatch:GetDataset

Read

Grants permission to get a dataset

cloudwatch:GetDomain

Read

Grants permission to get a domain

cloudwatch:GetDomainAccessGrantForOrganization

Read

Grants permission to get a domain access grant for an organization

cloudwatch:GetDomainForOrganization

Read

Grants permission to get a domain for an organization

cloudwatch:GetIngestionEndpoint

Read

Grants permission to get an ingestion endpoint

cloudwatch:GetInsightRuleReport

Read

Grants permission to return the top-N report of unique contributors over a time range for a given insight rule

cloudwatch:GetIntegration

Read

Grants permission to get an integration

cloudwatch:GetIntelligenceConfiguration

Read

Grants permission to get an intelligence configuration

cloudwatch:GetMetricData

Read

Grants permission to retrieve batch amounts of CloudWatch classic metric data and perform metric math on retrieved data; and grants permission to retrieve OTLP metric data using PromQL

cloudwatch:GetMetricStatistics

Read

Grants permission to retrieve statistics for the specified metric

cloudwatch:GetMetricStream

Read

Grants permission to return the details of a CloudWatch metric stream

cloudwatch:GetMetricWidgetImage

Read

Grants permission to retrieve snapshots of metric widgets

cloudwatch:GetOmniDashboard

Read

Grants permission to get an omni dashboard

cloudwatch:GetOmniThread

Read

Grants permission to get an omni thread

cloudwatch:GetOTelEnrichment

Read

Grants permission to retrieve the status of OTel Enrichment of vended metrics for PromQL querying

cloudwatch:GetPreferences

Read

Grants permission to get preferences

cloudwatch:GetProfileRecords

Read

Grants permission to query and retrieve CloudWatch application profiling data. This action is unrelated to CloudWatch access profiles (GetAccessProfile and related actions)

cloudwatch:GetRecords

Read

Grants permission to fetch logs and traces

cloudwatch:GetResourceMetricsConfiguration

Read

Grants permission to retrieve the resource metrics configuration and detailed monitoring status for a resource

cloudwatch:GetService

Read

Grants permission to retrieve information about a service

cloudwatch:GetServiceData

Read

Grants permission to retrieve service data

cloudwatch:GetServiceLevelObjective

Read

Grants permission to retrieve information about service level objective

cloudwatch:GetSpace

Read

Grants permission to get a space

cloudwatch:GetSpaceCredentials

Read

Grants permission to get space credentials

cloudwatch:GetSpaceCredentialsForOrganization

Read

Grants permission to get space credentials for an organization

cloudwatch:GetTelemetryQueryResults

Read

Grants permission to get telemetry query results

cloudwatch:GetTopologyDiscoveryStatus

Read

Grants permission to retrieve a CloudWatch topology discovery status

cloudwatch:GetTopologyMap

Read

Grants permission to retrieve a CloudWatch topology map

cloudwatch:GetView

Read

Grants permission to get a view

cloudwatch:InvokeIntegration

Write

Grants permission to invoke an integration

cloudwatch:Link

Write

Grants permission to share CloudWatch resources with a monitoring account

cloudwatch:ListAccessGrants

List

Grants permission to list access grants

cloudwatch:ListAccessProfiles

List

Grants permission to list access profiles

cloudwatch:ListAlarmMuteRules

List

Grants permission to retrieve a list of alarm mute rules owned by the user's account

cloudwatch:ListAlertContributors

List

Grants permission to list alert contributors

cloudwatch:ListAlerts

List

Grants permission to list alerts

cloudwatch:ListDashboards

List

Grants permission to return a list of all CloudWatch dashboards in your account

cloudwatch:ListDomainAccessGrantsForOrganization

List

Grants permission to list domain access grants for an organization

cloudwatch:ListDomains

List

Grants permission to list domains

cloudwatch:ListEntitiesForMetric

List

Grants permission to retrieve all the entities that are emitting a given metric

cloudwatch:ListIngestionEndpoints

List

Grants permission to list ingestion endpoints

cloudwatch:ListIntegrations

List

Grants permission to list integrations

cloudwatch:ListManagedInsightRules

Read

Grants permission to list available managed Insight Rules for a given Resource ARN

cloudwatch:ListMetrics

List

Grants permission to retrieve a list of valid metrics stored for the AWS account owner

cloudwatch:ListMetricStreams

List

Grants permission to return a list of all CloudWatch metric streams in your account

cloudwatch:ListOmniDashboards

List

Grants permission to list omni dashboards

cloudwatch:ListOmniThreads

List

Grants permission to list omni threads

cloudwatch:ListServiceLevelObjectives

List

Grants permission to list service level objectives

cloudwatch:ListServices

List

Grants permission to list services

cloudwatch:ListSpaceAccess

List

Grants permission to list access to a space

cloudwatch:ListSpaces

List

Grants permission to list spaces

cloudwatch:ListSpacesForOrganization

List

Grants permission to list spaces for an organization

cloudwatch:ListTagsForResource

List

Grants permission to list tags for an Amazon CloudWatch resource

cloudwatch:ListTelemetryFields

List

Grants permission to list telemetry fields

cloudwatch:ListTelemetryQuerySessions

List

Grants permission to list telemetry query sessions

cloudwatch:ListViews

List

Grants permission to list views

cloudwatch:PutAlarmMuteRule

Write

Grants permission to create or update an alarm mute rule

cloudwatch:PutAnomalyDetector

Write

Grants permission to create or update an anomaly detection model for a CloudWatch metric

cloudwatch:PutCompositeAlarm

Write

Grants permission to create or update a composite alarm

cloudwatch:PutDashboard

Write

Grants permission to create a CloudWatch dashboard, or update an existing dashboard if it already exists

cloudwatch:PutInsightRule

Write

Grants permission to create a new insight rule or replace an existing insight rule

cloudwatch:PutIntelligenceConfiguration

Write

Grants permission to configure an intelligence configuration

cloudwatch:PutLogAlarm

Write

Grants permission to create or update a log-based alarm and associate it with a CloudWatch Logs Insights scheduled query

cloudwatch:PutManagedInsightRules

Write

Grants permission to create managed Insight Rules

cloudwatch:PutMetricAlarm

Write

Grants permission to create or update an alarm and associates it with the specified Amazon CloudWatch metric

cloudwatch:PutMetricData

Write

Grants permission to publish metric data points to Amazon CloudWatch using CloudWatch and OTLP formats

cloudwatch:PutMetricStream

Write

Grants permission to create a CloudWatch metric stream, or update an existing metric stream if it already exists

cloudwatch:PutPipelineRule

Write

Grants permission to create or update a pipeline rule for CloudWatch pipelines for OTel metric processing

cloudwatch:PutProfileRecords

Write

Grants permission to ingest CloudWatch application profiling data. This action is unrelated to CloudWatch access profiles (GetAccessProfile and related actions)

cloudwatch:PutRecords

Write

Grants permission to put logs and traces

cloudwatch:QueryTraces

Write

Grants permission to query traces

cloudwatch:SearchPrincipals

Write

Grants permission to search principals

cloudwatch:SetAlarmState

Write

Grants permission to temporarily set the state of an alarm for testing purposes

cloudwatch:StartMetricStreams

Write

Grants permission to start all CloudWatch metric streams that you specify

cloudwatch:StartOmniThreadSession

Write

Grants permission to start an omni thread session

cloudwatch:StartOTelEnrichment

Write

Grants permission to enable OTel Enrichment of vended metrics for PromQL querying

cloudwatch:StartTelemetryQuery

Write

Grants permission to start a telemetry query

cloudwatch:StartTelemetryQuerySession

Write

Grants permission to start a telemetry query session

cloudwatch:StopMetricStreams

Write

Grants permission to stop all CloudWatch metric streams that you specify

cloudwatch:StopOTelEnrichment

Write

Grants permission to disable OTel Enrichment of vended metrics for PromQL querying

cloudwatch:StopTelemetryQuery

Write

Grants permission to stop a telemetry query

cloudwatch:StopTelemetryQuerySession

Write

Grants permission to stop a telemetry query session

cloudwatch:SubmitAlarmFeedback

Write

Grants permission to submit feedback on an anomaly detection alarm to improve its anomaly detection model

cloudwatch:SubmitFeedback

Write

Grants permission to submit feedback

cloudwatch:TagResource

Tagging

Grants permission to add tags to an Amazon CloudWatch resource

cloudwatch:UntagResource

Tagging

Grants permission to remove a tag from an Amazon CloudWatch resource

cloudwatch:UpdateAccessProfile

Permissions management

Grants permission to update an access profile

cloudwatch:UpdateAlert

Write

Grants permission to update an alert

cloudwatch:UpdateDomain

Write

Grants permission to update a domain

cloudwatch:UpdateDomainForOrganization

Write

Grants permission to update a domain for an organization

cloudwatch:UpdateIngestionEndpoint

Write

Grants permission to update an ingestion endpoint

cloudwatch:UpdateIntegration

Write

Grants permission to update an integration

cloudwatch:UpdateOmniDashboard

Write

Grants permission to update an omni dashboard

cloudwatch:UpdateOmniThread

Write

Grants permission to update an omni thread

cloudwatch:UpdateOTelEnrichment

Write

Grants permission to update the metric filters of OTel Enrichment of vended metrics for PromQL querying

cloudwatch:UpdatePreferences

Write

Grants permission to update preferences

cloudwatch:UpdateResourceMetricsConfiguration

Write

Grants permission to update the resource metrics configuration for a resource

cloudwatch:UpdateServiceLevelObjective

Write

Grants permission to update a service level objective

cloudwatch:UpdateSpace

Write

Grants permission to update a space

cloudwatch:UpdateView

Write

Grants permission to update a view