logs:GetLogGroupFields

Read

logs:GetLogGroupFields is a Read access-level action in the logs service. Grants permission to return a list of the fields that are included in log events in the specified log group, along with the percentage of log events that contain each field

Resource types

ARNs that logs:GetLogGroupFields can be scoped to in an IAM policy.

arn:${Partition}:logs:${Region}:${Account}:log-group:${LogGroupName}

log-group

Condition keys

Keys you can use in the Condition block of a policy that grants logs:GetLogGroupFields.

aws:ResourceTag/${TagKey} String

Filters access by the tags associated with the resource

Example IAM policy

A minimal policy that allows logs:GetLogGroupFields. Replace "Resource": "*" with a specific ARN to follow least privilege.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "AllowLogsGetLogGroupFields",
      "Effect": "Allow",
      "Action": "logs:GetLogGroupFields",
      "Resource": "*"
    }
  ]
}

Related actions in logs

logs:AssociateKmsKey Write logs:AssociateSourceToS3TableIntegration Write logs:CallWithBearerToken Write logs:CancelExportTask Write logs:CancelImportTask Write logs:CreateDelivery Write logs:CreateExportTask Write logs:CreateImportTask Write logs:CreateLogAnomalyDetector Write logs:CreateLogDelivery Write logs:CreateLogGroup Write logs:CreateLogStream Write

View all logs actions →