cloudwatch:PutLogAlarm is a Write access-level action in the cloudwatch service. Grants permission to create or update a log-based alarm and associate it with a CloudWatch Logs Insights scheduled query
ARNs that cloudwatch:PutLogAlarm can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants cloudwatch:PutLogAlarm.
Filters access by the presence of tags in the request
Filters access by the presence of tags in the request
Filters access by defined alarm actions
Filters access by whether the request enables propagation of the alarm's tags in notification payloads
Filters access by tags associated with the resource
A minimal policy that allows cloudwatch:PutLogAlarm. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCloudwatchPutLogAlarm",
"Effect": "Allow",
"Action": "cloudwatch:PutLogAlarm",
"Resource": "*"
}
]
}