IAM-Permissions to allow AWS CloudWatch READ-only (Logs, Alarms, Filter, Insights, etc.)

AWSTemplateFormatVersion: 2010-09-09
Resources:
  User:
    Type: AWS::IAM::User
    Properties:
      UserName: someUser@yourCompany.com
      Policies:
        - PolicyName: allow-cloudwatch-ro
          PolicyDocument: >
            {
              "Version": "2012-10-17",
              "Statement": [
                {
                  "Effect": "Allow",
                  "Action": [
                    "logs:List*",
                    "logs:Describe*",
                    "logs:Get*",
                    "logs:PutQueryDefinition",
                    "logs:Filter*",
                    "cloudwatch:List*",
                    "cloudwatch:Get*",
                    "cloudwatch:Describe*",
                    "sns:Get*",
                    "sns:List*"
                  ],
                  "Resource": [
                    "*"
                  ]
                }
              ]
            }

We use this IAM-Policy to grant CloudWatch-Console access to a given user. The user should be able to browse, filter and use Log Insights on all our logs. We also added logs:PutQueryDefinition permission, thus the user can create Log Insights filter queries himself.

Please note: For this read-only permissions policy, we do not limit to certain resources but take ‚*‘. If you want to restrict further, you should split up the policy actions accordingly and restrict individually.

Schreibe einen Kommentar

Deine E-Mail-Adresse wird nicht veröffentlicht. Erforderliche Felder sind mit * markiert