Custom grant actions
A Custom grant allows exactly the actions you list. Nothing is added by
default. Each action is named service:Action, such as
cloudwatch:GetAlert. When you choose Custom in the
add-grants form, the Select actions drawer groups the actions of
each service into Read, Write, and Permissions
management, the same way the IAM console does. Use this page to
decide which actions a member needs for a task, and to see what each action
allows. For the add-grants procedure, see Manage space members and permissions.
A member who holds a Custom grant and a Viewer, Editor, or Space Admin grant gets the combination of both. To keep a member's access narrow, give them only the Custom grant.
Limits on Custom grants
-
Resource and tag scoping applies only to CloudWatch actions. You can limit a
cloudwatch:action to named resources, to resources with a tag, or to a data scope only when the action acts on a resource type: telemetry query actions (aDataSetdata scope), alerts, dashboards, access profiles, and integrations. Othercloudwatch:actions, such ascloudwatch:GetSpace, apply to the whole space and accept no scope. Actions from every other service, such asbedrock-agentcore:orlogs:, accept no resource or tag scope. They apply to everything the Omni Space Access role can reach. -
One service per action group. An action group in the drawer holds actions from one service. To grant actions from two services, add two groups.
-
Actions from other services also need the Space Access role. A member can use a
bedrock-agentcore:orlogs:action only when the Omni Space Access role for the space also allows it. See Control access to your space. Model inference is separate. The base policy lets a space set up and view evaluations, but invoking a model also requires the optional Amazon managed policyCloudWatchOmniModelInferencePolicyon the role. -
DevOps Agent actions are not part of the Space Access role. To use the DevOps Agent from a space, attach the Amazon managed policy
AIDevOpsAgentFullAccessto the role.
Actions by service
| Service | Actions | What the actions are used for | Grant it to |
|---|---|---|---|
| CloudWatch | cloudwatch:StartTelemetryQuerySession,
cloudwatch:ListTelemetryQuerySessions,
cloudwatch:StopTelemetryQuerySession,
cloudwatch:StopTelemetryQuery,
cloudwatch:GetTelemetryQueryResults |
Run queries in the explorer, in dashboards, and in the alert query preview: open and close query sessions, cancel a query, and read its results. Each is checked under its own name. The data a query reads is checked separately, as the next two rows describe. | Members who read telemetry. Included in Viewer. |
| CloudWatch | cloudwatch:GetRecords |
Read logs and traces. GetRecords is the permission behind
StartTelemetryQuery and
ListTelemetryFields: Omni checks it for
every logs or traces dataset a query references, and for the
dataset that ListTelemetryFields names. A
dataset named without a logs. or
traces. prefix, including
default, counts as both and is checked
once. |
Members who read logs and traces. Included in Viewer. |
| CloudWatch | cloudwatch:GetMetricData,
cloudwatch:ListMetrics |
Read metrics. When StartTelemetryQuery
references a metrics. dataset, that part is
checked as both actions. ListTelemetryFields on
a metrics dataset is checked as
cloudwatch:ListMetrics alone. A query that
spans logs or traces and metrics needs this row and the
cloudwatch:GetRecords row. |
Members who read metrics. Included in Viewer. |
| CloudWatch | cloudwatch:GetContextGraph |
See the application map. | Members who read telemetry. Included in Viewer. |
| CloudWatch | cloudwatch:CreateOmniThread,
cloudwatch:GetOmniThread,
cloudwatch:UpdateOmniThread,
cloudwatch:ListOmniThreads,
cloudwatch:DeleteOmniThread,
cloudwatch:StartOmniThreadSession |
Ask the Omni agent questions and manage conversations. The agent reads with the member's own access, so grant the query actions too. | Members who use the Omni agent. Included in Viewer. |
| CloudWatch | cloudwatch:SubmitFeedback |
Rate an answer or send feedback. | Members who use the Omni agent. Included in Editor. |
| CloudWatch | cloudwatch:ListAlerts,
cloudwatch:GetAlert,
cloudwatch:CreateAlert,
cloudwatch:UpdateAlert,
cloudwatch:DeleteAlert |
See alerts and their state, and create, change, or delete
them. Creating an alert also needs
cloudwatch:ListAccessProfiles and
cloudwatch:AssumeAccessProfile on the
profile the alert uses. Can be limited to named alerts or
tagged alerts. |
Members who work with alerts. Viewer includes the List and Get actions. Editor includes all five. |
| CloudWatch | cloudwatch:ListOmniDashboards,
cloudwatch:GetOmniDashboard,
cloudwatch:CreateOmniDashboard,
cloudwatch:UpdateOmniDashboard,
cloudwatch:DeleteOmniDashboard |
See dashboards, and create, change, or delete them. Viewing a dashboard also needs the query actions. Can be limited to named or tagged dashboards. | Members who work with dashboards. Viewer includes the List and Get actions. Editor includes all five. |
| CloudWatch | cloudwatch:ListViews,
cloudwatch:GetView,
cloudwatch:CreateView,
cloudwatch:UpdateView,
cloudwatch:DeleteView |
See saved views, and create, change, or delete them. | Members who work with saved views. Viewer includes the List and Get actions. Editor includes all five. |
| CloudWatch | cloudwatch:GetSpace,
cloudwatch:ListSpaces,
cloudwatch:UpdateSpace |
Read the space's details, list the spaces the member can open, and change the space's name and configuration. | Viewer includes cloudwatch:GetSpace and
cloudwatch:ListSpaces. Space Admin includes
cloudwatch:UpdateSpace. |
| CloudWatch | cloudwatch:GetPreferences,
cloudwatch:UpdatePreferences |
Read and save the member's own preferences. | Any member. Included in Viewer. |
| CloudWatch | cloudwatch:ListAccessGrants,
cloudwatch:GetAccessGrant,
cloudwatch:CreateAccessGrant,
cloudwatch:DeleteAccessGrant |
Read the grants in the space, and add or remove them. | Viewer includes the List and Get actions. Space Admin
includes cloudwatch:CreateAccessGrant and
cloudwatch:DeleteAccessGrant. |
| CloudWatch | cloudwatch:ListAccessProfiles,
cloudwatch:GetAccessProfile,
cloudwatch:CreateAccessProfile,
cloudwatch:UpdateAccessProfile,
cloudwatch:DeleteAccessProfile,
cloudwatch:AssumeAccessProfile |
See access profiles, manage them, and act as one.
cloudwatch:AssumeAccessProfile is what a
member needs to set a profile on an alert, and what an alert
needs to run. Can be limited to named or tagged
profiles. |
Viewer includes the List and Get actions. Editor adds
cloudwatch:AssumeAccessProfile. Space Admin
includes all six. |
| CloudWatch | cloudwatch:ListIntegrations,
cloudwatch:GetIntegration,
cloudwatch:CreateIntegration,
cloudwatch:UpdateIntegration,
cloudwatch:DeleteIntegration |
You can see, connect, change, or remove integrations such as Slack and Amazon DevOps Agent. You can limit these actions to named or tagged integrations. | Viewer includes the List and Get actions. Space Admin includes all five. |
| CloudWatch | cloudwatch:InvokeIntegration |
Send a message through an integration. Can be limited to named integrations and, for Slack, to channels. | Access profiles that alerts use to notify. No permission level includes it. |
| CloudWatch | cloudwatch:GetIntelligenceConfiguration,
cloudwatch:PutIntelligenceConfiguration |
Read the account's intelligence configuration, and turn intelligence features on or off. | Viewer includes
cloudwatch:GetIntelligenceConfiguration.
Editor includes
cloudwatch:PutIntelligenceConfiguration. |
| CloudWatch | cloudwatch:TagResource,
cloudwatch:UntagResource,
cloudwatch:ListTagsForResource |
Read, add, and remove tags on Omni resources. Only these resource types accept tags: spaces, domains, organization domains, access grants, organization access grants, access profiles, dashboards, alerts, views, integrations, and datasets. The Space Access role denies tagging of any other CloudWatch resource. These are the tags that a tag-scoped grant matches on. | Members who organize resources by tag, and Space Admins who set up tag-scoped grants. |
| Bedrock AgentCore | bedrock-agentcore:ListEvaluators,
bedrock-agentcore:GetEvaluator,
bedrock-agentcore:CreateEvaluator,
bedrock-agentcore:UpdateEvaluator,
bedrock-agentcore:DeleteEvaluator,
bedrock-agentcore:Evaluate |
See, author, and run evaluators for agent evaluations. | Members who run or author agent evaluations. |
| Bedrock AgentCore | bedrock-agentcore:ListDatasets,
bedrock-agentcore:GetDataset,
bedrock-agentcore:ListDatasetVersions,
bedrock-agentcore:ListDatasetExamples,
bedrock-agentcore:CreateDataset,
bedrock-agentcore:UpdateDataset,
bedrock-agentcore:CreateDatasetVersion,
bedrock-agentcore:AddDatasetExamples,
bedrock-agentcore:UpdateDatasetExamples,
bedrock-agentcore:DeleteDatasetExamples,
bedrock-agentcore:DeleteDataset,
bedrock-agentcore:TagResource,
bedrock-agentcore:UntagResource,
bedrock-agentcore:ListTagsForResource |
See and manage the datasets that evaluations run against. The tag actions also read or change tags on evaluators and online evaluation configs. | Members who author agent evaluations. |
| Bedrock AgentCore | bedrock-agentcore:ListOnlineEvaluationConfigs,
bedrock-agentcore:GetOnlineEvaluationConfig,
bedrock-agentcore:CreateOnlineEvaluationConfig,
bedrock-agentcore:UpdateOnlineEvaluationConfig,
bedrock-agentcore:DeleteOnlineEvaluationConfig |
Set up online evaluations that run on live traffic without a user. | Members who set up online evaluations. |
| Bedrock | bedrock:ListFoundationModels,
bedrock:ListInferenceProfiles |
Choose a model when creating an evaluator. | Members who author agent evaluations. |
| Bedrock | bedrock:InvokeModel,
bedrock:InvokeModelWithResponseStream,
bedrock-mantle:CreateInference,
bedrock-mantle:CallWithBearerToken |
Invoke the model when an evaluation or the playground
runs. The bedrock-mantle actions cover models
served through the bedrock-mantle endpoint in
Amazon Bedrock. The Space Access role must also carry the optional
CloudWatchOmniModelInferencePolicy. |
Members who run evaluations or use the playground. |
| IAM | iam:PassRole |
Pass a service role in your account to CloudWatch or to Bedrock AgentCore, for example the role that online evaluations run as. | Members who set up the space or online evaluations. |
| IAM | iam:ListRoles, iam:GetRole,
iam:ListAttachedRolePolicies,
iam:ListUsers,
iam:ListUserTags,
iam:ListServiceSpecificCredentials |
Fill the role picker, inspect an existing role during Azure VM ingestion setup, and list the ingestion users and their OTLP bearer tokens. | Members who set up telemetry sources or choose service roles. |
| IAM | iam:CreateServiceLinkedRole |
Create the Amazon Config service-linked role that Azure topology needs. | Members who set up Azure topology. |
| CloudWatch Logs | logs:CreateLogGroup,
logs:CreateLogStream,
logs:PutLogEvents |
Write evaluation results to log groups. | Members who run evaluations. |
| CloudWatch Logs | logs:DescribeLogGroups |
List log groups for the online evaluation log-group picker. | Members who set up online evaluations. |
| CloudWatch Logs | logs:DescribeIndexPolicies,
logs:PutIndexPolicy |
Index the service name on the spans log group so online evaluations can sample by service. | Members who set up online evaluations. |
| KMS | kms:DescribeKey,
kms:GenerateDataKey,
kms:Decrypt |
Validate and use a customer managed key for space encryption and for stored provider keys. | Members who configure encryption or store provider keys. |
| Lambda | lambda:InvokeFunction,
lambda:GetFunction |
Run code-based custom evaluators. | Members who use code evaluators. |
| Secrets Manager | secretsmanager:ListSecrets,
secretsmanager:CreateSecret,
secretsmanager:TagResource,
secretsmanager:PutSecretValue,
secretsmanager:GetSecretValue,
secretsmanager:DeleteSecret |
Store, read, rotate, and delete model provider API keys used by evaluators. | Members who add provider keys. |
| Config | config:PutServiceLinkedConfigurationRecorder,
config:DeleteServiceLinkedConfigurationRecorder,
config:DescribeConfigurationRecorderStatus |
Turn the Amazon Config recorder on or off, and read its status, to build the Azure topology map. | Members who set up Azure topology. |