IAM-Permissions to allow AWS CloudWatch READ-only (Logs, Alarms, Filter, Insights, etc.)

AWSTemplateFormatVersion: 2010-09-09
    Type: AWS::IAM::User
      UserName: someUser@yourCompany.com
        - PolicyName: allow-cloudwatch-ro
          PolicyDocument: >
              "Version": "2012-10-17",
              "Statement": [
                  "Effect": "Allow",
                  "Action": [
                  "Resource": [

We use this IAM-Policy to grant CloudWatch-Console access to a given user. The user should be able to browse, filter and use Log Insights on all our logs. We also added logs:PutQueryDefinition permission, thus the user can create Log Insights filter queries himself.

Please note: For this read-only permissions policy, we do not limit to certain resources but take ‚*‘. If you want to restrict further, you should split up the policy actions accordingly and restrict individually.