# Identity and access management for Amazon CloudWatch Logs
<a name="auth-and-access-control-cwl"></a>

Access to Amazon CloudWatch Logs requires credentials that Amazon can use to authenticate your requests. Those credentials must have permissions to access Amazon resources, such as to retrieve CloudWatch Logs data about your cloud resources. The following sections provide details on how you can use [Amazon Identity and Access Management (IAM)](https://docs.amazonaws.cn/IAM/latest/UserGuide/introduction.html) and CloudWatch Logs to help secure your resources by controlling who can access them:
+ [Authentication](#authentication-cwl)
+ [Access control](#access-control-cwl)

## Authentication
<a name="authentication-cwl"></a>

To provide access, add permissions to your users, groups, or roles:
+ Users managed in IAM through an identity provider:

  Create a role for identity federation. Follow the instructions in [Create a role for a third-party identity provider (federation)](https://docs.amazonaws.cn//IAM/latest/UserGuide/id_roles_create_for-idp.html) in the *IAM User Guide*.
+ IAM users:
  + Create a role that your user can assume. Follow the instructions in [Create a role for an IAM user](https://docs.amazonaws.cn//IAM/latest/UserGuide/id_roles_create_for-user.html) in the *IAM User Guide*.
  + (Not recommended) Attach a policy directly to a user or add a user to a user group. Follow the instructions in [Adding permissions to a user (console)](https://docs.amazonaws.cn//IAM/latest/UserGuide/id_users_change-permissions.html#users_change_permissions-add-console) in the *IAM User Guide*.

## Access control
<a name="access-control-cwl"></a>

You can have valid credentials to authenticate your requests, but unless you have permissions you cannot create or access CloudWatch Logs resources. For example, you must have permissions to create log streams, create log groups, and so on.

The following sections describe how to manage permissions for CloudWatch Logs. We recommend that you read the overview first.
+ [Overview of managing access permissions to your CloudWatch Logs resources](iam-access-control-overview-cwl.md)
+ [Using identity-based policies (IAM policies) for CloudWatch Logs](iam-identity-based-access-control-cwl.md)
+ [CloudWatch Logs permissions reference](permissions-reference-cwl.md)