cloudwatch

67 actions in the cloudwatch service. Select an action to see its access level, resource ARNs, condition keys, and a copy-paste IAM policy.

cloudwatch:BatchGetServiceLevelIndicatorReport

Read

Grants permission to batch get service level indicator report

cloudwatch:BatchGetServiceLevelObjectiveBudgetReport

Read

Grants permission to batch retrieve a service level objective budget report

cloudwatch:CallWithBearerToken

Write

Grants permission to make API calls to CloudWatch using bearer token authentication

cloudwatch:CreateServiceLevelObjective

Write

Grants permission to create a service level objective

cloudwatch:DeleteAlarmMuteRule

Write

Grants permission to delete an alarm mute rule

cloudwatch:DeleteAlarms

Write

Grants permission to delete a collection of alarms

cloudwatch:DeleteAnomalyDetector

Write

Grants permission to delete the specified anomaly detection model from your account

cloudwatch:DeleteDashboards

Write

Grants permission to delete all CloudWatch dashboards that you specify

cloudwatch:DeleteInsightRules

Write

Grants permission to delete a collection of insight rules

cloudwatch:DeleteMetricStream

Write

Grants permission to delete the CloudWatch metric stream that you specify

cloudwatch:DeletePipelineRule

Write

Grants permission to delete a pipeline rule for CloudWatch pipelines for OTel metric processing

cloudwatch:DeleteServiceLevelObjective

Write

Grants permission to delete a service level objective

cloudwatch:DescribeAlarmHistory

Read

Grants permission to retrieve the history for the specified alarm

cloudwatch:DescribeAlarms

Read

Grants permission to describe all alarms, currently owned by the user's account

cloudwatch:DescribeAlarmsForMetric

Read

Grants permission to describe all alarms configured on the specified metric, currently owned by the user's account

cloudwatch:DescribeAnomalyDetectors

Read

Grants permission to list the anomaly detection models that you have created in your account

cloudwatch:DescribeInsightRules

Read

Grants permission to describe all insight rules, currently owned by the user's account

cloudwatch:DisableAlarmActions

Write

Grants permission to disable actions for a collection of alarms

cloudwatch:DisableInsightRules

Write

Grants permission to disable a collection of insight rules

cloudwatch:EnableAlarmActions

Write

Grants permission to enable actions for a collection of alarms

cloudwatch:EnableInsightRules

Write

Grants permission to enable a collection of insight rules

cloudwatch:EnableTopologyDiscovery

Write

Grants permission to enable a CloudWatch topology discovery

cloudwatch:GenerateQuery

Read

Grants permission to generate a Metrics Insights or Logs Insights query string from a natural language prompt

cloudwatch:GenerateQueryResultsSummary

Read

Grants permission to generate a summary of CloudWatch LogInsights query results in natural language using generative AI

cloudwatch:GetAlarmMuteRule

Read

Grants permission to get an alarm mute rule

cloudwatch:GetDashboard

Read

Grants permission to display the details of the CloudWatch dashboard you specify

cloudwatch:GetDataset

Read

Grants permission to get a dataset

cloudwatch:GetInsightRuleReport

Read

Grants permission to return the top-N report of unique contributors over a time range for a given insight rule

cloudwatch:GetMetricData

Read

Grants permission to retrieve batch amounts of CloudWatch classic metric data and perform metric math on retrieved data; and grants permission to retrieve OTLP metric data using PromQL

cloudwatch:GetMetricStatistics

Read

Grants permission to retrieve statistics for the specified metric

cloudwatch:GetMetricStream

Read

Grants permission to return the details of a CloudWatch metric stream

cloudwatch:GetMetricWidgetImage

Read

Grants permission to retrieve snapshots of metric widgets

cloudwatch:GetOTelEnrichment

Read

Grants permission to retrieve the status of OTel Enrichment of vended metrics for PromQL querying

cloudwatch:GetService

Read

Grants permission to retrieve information about a service

cloudwatch:GetServiceData

Read

Grants permission to retrieve service data

cloudwatch:GetServiceLevelObjective

Read

Grants permission to retrieve information about service level objective

cloudwatch:GetTopologyDiscoveryStatus

Read

Grants permission to retrieve a CloudWatch topology discovery status

cloudwatch:GetTopologyMap

Read

Grants permission to retrieve a CloudWatch topology map

cloudwatch:Link

Write

Grants permission to share CloudWatch resources with a monitoring account

cloudwatch:ListAlarmMuteRules

List

Grants permission to retrieve a list of alarm mute rules owned by the user's account

cloudwatch:ListDashboards

List

Grants permission to return a list of all CloudWatch dashboards in your account

cloudwatch:ListEntitiesForMetric

List

Grants permission to retrieve all the entities that are emitting a given metric

cloudwatch:ListManagedInsightRules

Read

Grants permission to list available managed Insight Rules for a given Resource ARN

cloudwatch:ListMetrics

List

Grants permission to retrieve a list of valid metrics stored for the AWS account owner

cloudwatch:ListMetricStreams

List

Grants permission to return a list of all CloudWatch metric streams in your account

cloudwatch:ListServiceLevelObjectives

List

Grants permission to list service level objectives

cloudwatch:ListServices

List

Grants permission to list services

cloudwatch:ListTagsForResource

List

Grants permission to list tags for an Amazon CloudWatch resource

cloudwatch:PutAlarmMuteRule

Write

Grants permission to create or update an alarm mute rule

cloudwatch:PutAnomalyDetector

Write

Grants permission to create or update an anomaly detection model for a CloudWatch metric

cloudwatch:PutCompositeAlarm

Write

Grants permission to create or update a composite alarm

cloudwatch:PutDashboard

Write

Grants permission to create a CloudWatch dashboard, or update an existing dashboard if it already exists

cloudwatch:PutInsightRule

Write

Grants permission to create a new insight rule or replace an existing insight rule

cloudwatch:PutLogAlarm

Write

Grants permission to create or update a log-based alarm and associate it with a CloudWatch Logs Insights scheduled query

cloudwatch:PutManagedInsightRules

Write

Grants permission to create managed Insight Rules

cloudwatch:PutMetricAlarm

Write

Grants permission to create or update an alarm and associates it with the specified Amazon CloudWatch metric

cloudwatch:PutMetricData

Write

Grants permission to publish metric data points to Amazon CloudWatch using CloudWatch and OTLP formats

cloudwatch:PutMetricStream

Write

Grants permission to create a CloudWatch metric stream, or update an existing metric stream if it already exists

cloudwatch:PutPipelineRule

Write

Grants permission to create or update a pipeline rule for CloudWatch pipelines for OTel metric processing

cloudwatch:SetAlarmState

Write

Grants permission to temporarily set the state of an alarm for testing purposes

cloudwatch:StartMetricStreams

Write

Grants permission to start all CloudWatch metric streams that you specify

cloudwatch:StartOTelEnrichment

Write

Grants permission to enable OTel Enrichment of vended metrics for PromQL querying

cloudwatch:StopMetricStreams

Write

Grants permission to stop all CloudWatch metric streams that you specify

cloudwatch:StopOTelEnrichment

Write

Grants permission to disable OTel Enrichment of vended metrics for PromQL querying

cloudwatch:TagResource

Tagging

Grants permission to add tags to an Amazon CloudWatch resource

cloudwatch:UntagResource

Tagging

Grants permission to remove a tag from an Amazon CloudWatch resource

cloudwatch:UpdateServiceLevelObjective

Write

Grants permission to update a service level objective