Amazon managed (predefined) policies for CloudWatch

CloudWatchApplicationSignalsReadOnlyAccess – Updated policy

CloudWatch updated the CloudWatchApplicationSignalsReadOnlyAccess policy to view how resources and services change in your account and view top observations for service anomalies in your account.

CloudWatchApplicationSignalsFullAccess – Updated policy

CloudWatch updated the CloudWatchApplicationSignalsFullAccess policy to view how resources and services change in your account and view top observations for service anomalies in your account.

AIOpsAssistantPolicy – Updated policy

CloudWatch updated the AIOpsAssistantPolicy to allow CloudWatch investigations access to additional resources to assist in queries, troubleshooting, and topology mapping.

This policy grants CloudWatch investigations the necessary permissions for conducting investigations.

AIOpsConsoleAdminPolicy – Updated policy

CloudWatch updated the AIOpsConsoleAdminPolicy policy to permit validation of investigation groups across accounts.

This policy grants users access to CloudWatch investigations actions, and to additional Amazon actions that are necessary for accessing investigation events.

AIOpsOperatorAccess – Updated policy

CloudWatch updated the AIOpsOperatorAccess policy to permit validation of investigation groups across accounts.

This policy grants users access to CloudWatch investigations actions, and to additional Amazon actions that are necessary for accessing investigation events.

June 13, 2025

AIOpsAssistantPolicy – Updates to existing policy

CloudWatch updated the AIOpsAssistantPolicy IAM policy. It added permissions to enable CloudWatch Application Insights operational investigations to find information in your resources during investigations.

The following permissions were added: appsync:GetGraphqlApi, appsync:GetDataSource, iam:ListAttachedRolePolicies, iam:ListRolePolicies, and iam:ListRoles

Additionally, the elastic-inference:Describe* permission was removed from the policy.

AmazonCloudWatchRUMReadOnlyAccess – Updated policy

CloudWatch added permissions to the AmazonCloudWatchRUMReadOnlyAccess policy.

The synthetics: describeCanaries and synthetics:describeCanariesLastRun was added so that CloudWatch RUM can display associated Synthetics Canaries to the RUM app monitor.

The cloudwatch:GetMetricData was added so that CloudWatch RUM can display associated CloudWatch metrics to the RUM app monitor.

The cloudwatch:DescribeAlarms was added so that CloudWatch RUM can display associated CloudWatch alarms to the RUM app monitor.

The logs:DescribeLogGroups was added so that CloudWatch RUM can display associated CloudWatch logs to the RUM app monitor.

The xray:GetTraceSummaries was added so that CloudWatch RUM can display associated X-Ray Trace segments to the RUM app monitor.

The rum:ListTagsForResources was added so that CloudWatch RUM can display associated tags to the RUM app monitor.

AIOpsReadOnlyAccess – Updated policy

CloudWatch updated the AIOpsReadOnlyAccess policy to permit validation of investigation groups across accounts.

This policy grants a user read-only permissions for Amazon AI Operations and other related services.

AmazonCloudWatchRUMReadOnlyAccess – Updated policy

CloudWatch added a permission to the AmazonCloudWatchRUMReadOnlyAccess policy.

The rum:GetResourcePolicy permission was added so that CloudWatch RUM can view the resource policy attached to the RUM application monitor.

AIOpsConsoleAdminPolicy – New policy

CloudWatch created a new policy named AIOpsConsoleAdminPolicy.

This policy grants users full administrative access for managing CloudWatch investigations, including the management of trusted identity propagation, and the management of IAM Identity Center and organizational access.

AIOpsOperatorAccess – New policy

CloudWatch created a new policy named AIOpsOperatorAccess.

This policy grants users access to CloudWatch investigations actions, and to additional Amazon actions that are necessary for accessing investigation events.

AIOpsReadOnlyAccess – New policy

CloudWatch created a new policy named AIOpsReadOnlyAccess.

This policy grants a user read-only permissions for Amazon AI Operations and other related services.

AIOpsAssistantPolicy – New policy

CloudWatch created a new policy named AIOpsAssistantPolicy.

You don't assign this policy to a user. You assign this policy to the Amazon AI Operations assistant to enable CloudWatch investigations to analyze your Amazon resources during the investigation of operational events.

CloudWatchFullAccessV2 – Updates to existing policies

CloudWatch updated both CloudWatchFullAccessV2 and CloudWatchFullAccess.

Permissions for Amazon OpenSearch Service were added to to enable CloudWatch Logs integration with OpenSearch Service for some features.

CloudWatchNetworkFlowMonitorServiceRolePolicy – New policy

CloudWatch added a new policy CloudWatchNetworkFlowMonitorServiceRolePolicy.

The CloudWatchNetworkFlowMonitorServiceRolePolicy grants permissions for Network Flow Monitor to publish metrics to CloudWatch. It also allows the service to use Amazon Organizations to get information for multi-account scenarios.

CloudWatchNetworkFlowMonitorTopologyServiceRolePolicy – New policy

CloudWatch added a new policy CloudWatchNetworkFlowMonitorTopologyServiceRolePolicy.

The CloudWatchNetworkFlowMonitorTopologyServiceRolePolicy grants permissions for Network Flow Monitor to generate topology snapshots of resources used in your account.

CloudWatchNetworkFlowMonitorAgentPublishPolicy – New policy

CloudWatch added a new policy CloudWatchNetworkFlowMonitorAgentPublishPolicy.

The CloudWatchNetworkFlowMonitorAgentPublishPolicy grants permissions for resources, such as Amazon EC2 and Amazon EKS instances, to send telemetry reports (metrics) to a Network Flow Monitor endpoint.

CloudWatchSyntheticsFullAccess – Update to an existing policy

CloudWatch updated the policy named CloudWatchSyntheticsFullAccess.

The following CloudWatch Logs actions have been added to allow CloudWatch Synthetics to get and use canary log data in Lambda log groups. The lambda:GetFunction permission has also been added to allow Synthetics to get information about a specific function.

Additionally, Lambda layer version actions now apply to all CloudWatch Synthetics layer ARNs.

CloudWatchInternetMonitorReadOnlyAccess – New CloudWatchInternetMonitorReadOnlyAccess.

This policy grants read only access to resources and actions available in the CloudWatch console for Internet Monitor. The scope of this policy includes internetmonitor: so that users can use read-only Internet Monitor actions and resources. It includes some cloudwatch: policies to retrieve information on CloudWatch metrics. It includes some logs: policies to manage log queries.

CloudWatchInternetMonitorFullAccess – New policy

CloudWatch created a new policy named CloudWatchInternetMonitorFullAccess.

This policy grants full access to resources and actions available in the CloudWatch console for Internet Monitor. The scope of this policy includes internetmonitor: so that users can use Internet Monitor actions and resources. It includes some cloudwatch: policies to retrieve information on CloudWatch alarms and metrics. It includes some logs: policies to manage log queries. It includes some ec2:, cloudfront:, elasticloadbalancing:, and workspaces: policies to work with resources that you add to monitors so that Internet Monitor can create a traffic profile for your application. It contains some iam: policies to manage IAM roles.

CloudWatchLambdaApplicationSignalsExecutionRolePolicy – New CloudWatchLambdaApplicationSignalsExecutionRolePolicy.

This policy is used when CloudWatch Application Signals is enabled for Lambda workloads. It enables write access to X-Ray and the log group used by CloudWatch Application Signals.

CloudWatchSyntheticsFullAccess – Update to an existing policy

CloudWatch updated the policy named CloudWatchSyntheticsFullAccess.

The lambda:ListTags, lambda:TagResource, and lambda:UntagResource permissions were added so that when you apply or change tags on a canary, you can choose to have Synthetics also apply those same tags or changes to the Lambda function that the canary uses.

CloudWatchApplicationSignalsReadOnlyAccess – New policy

CloudWatch created a new policy named CloudWatchApplicationSignalsReadOnlyAccess.

This policy grants read only access to resources and actions available in the CloudWatch console for Application Signals. The scope of this policy includes application-signals: policies so that users can use read only actions and resources available in the CloudWatch console under Application Signals. It contains an iam: policy to manage IAM roles. It includes some logs: policies to manage log queries and filters. It includes cloudwatch: policies to retrieve information on CloudWatch alarms and metrics. It includes some synthetics: policies to retrive information about synthetics canaries. It includes rum: policies to manage RUM clients and jobs. It contains an xray: policy to obtain trace summaries.

CloudWatchApplicationSignalsFullAccess – New policy

CloudWatch created a new policy named CloudWatchApplicationSignalsFullAccess.

This policy grants full access to resources and actions available in the CloudWatch console for Application Signals. The scope of this policy includes application-signals: so that users can use Application Signals actions and resources. It includes some cloudwatch: policies to retrieve information on CloudWatch alarms and metrics. It includes some logs: policies to manage log queries. It includes some synthetics: policies to write and retrieve information about synthetics canaries. It includes rum: policies to manage RUM clients and jobs. It contains an xray: policy to obtain trace summaries. It includes some cloudwatch: policies to manage CloudWatch alarms. It contains some iam: policies to manage IAM roles. It includes some sns: policies to manage Amazon Simple Notification Service notifications.

CloudWatchFullAccessV2 – Update to an existing policy

CloudWatch updated the policy named CloudWatchFullAccessV2.

The scope of the CloudWatchFullAccessPermissions policy was updated to add application-signals:* so that users can use CloudWatch Application Signals to view, investigate, and diagnose issues with the health of their services.

CloudWatchReadOnlyAccess – Update to an existing policy

CloudWatch updated the policy named CloudWatchReadOnlyAccess.

The scope of the CloudWatchReadOnlyAccessPermissions policy was updated to add application-signals:BatchGet*, application-signals:List*, and application-signals:Get* so that users can use CloudWatch Application Signals to view, investigate, and diagnose issues with the health of their services. The scope of CloudWatchReadOnlyGetRolePermissions was updated to add the iam:GetRole action so that users can check if CloudWatch Application Signals is set up.

CloudWatchApplicationSignalsServiceRolePolicy – Update to an existing policy

CloudWatch updated the policy named CloudWatchApplicationSignalsServiceRolePolicy.

The scoping of the logs:StartQuery and logs:GetQueryResults permissions was changed to add the arn:aws:logs:*:*:log-group:/aws/appsignals/*:* and arn:aws:logs:*:*:log-group:/aws/application-signals/data:* ARNs to enable Application Signals on more architectures.

CloudWatchApplicationSignalsServiceRolePolicy – Update to an existing policy

CloudWatch changed the scope of a permission in CloudWatchApplicationSignalsServiceRolePolicy.

The scope of the cloudwatch:GetMetricData permission was changed to * so that Application Signals can retrieve metrics from sources in linked accounts.

CloudWatchFullAccessV2 – Update to an existing policy

CloudWatch added permissions to CloudWatchFullAccessV2.

Existing permissions for CloudWatch Synthetics, X-Ray, and CloudWatch RUM actions and new permissions for CloudWatch Application Signals were added so that users with this policy can manage CloudWatch Application Signals.

The permission to create the CloudWatch Application Signals service-linked role was added to allow CloudWatch Application Signals to discover telemetry data in logs, metrics, traces, and tags.

CloudWatchReadOnlyAccess – Update to an existing policy

CloudWatch added permissions to CloudWatchReadOnlyAccess.

Existing read-only permissions for CloudWatch Synthetics, X-Ray, and CloudWatch RUM actions and new read-only permissions for CloudWatch Application Signals were added so that users with this policy can triage and dignose their service health issues as reported by CloudWatch Application Signals.

The cloudwatch:GenerateQuery permission was added so that users with this policy can generate a CloudWatch Metrics Insights query string from a natural language prompt.

CloudWatchReadOnlyAccess – Update to an existing policy.

CloudWatch added a permission to CloudWatchReadOnlyAccess.

The cloudwatch:GenerateQuery permission was added, so that users with this policy can generate a CloudWatch Metrics Insights query string from a natural language prompt.

December 01, 2023

CloudWatchApplicationSignalsServiceRolePolicy – New policy

CloudWatch added a new policy CloudWatchApplicationSignalsServiceRolePolicy.

The CloudWatchApplicationSignalsServiceRolePolicy grants an upcoming feature permissions to collect CloudWatch Logs data, X-Ray trace data, CloudWatch metrics data, and tagging data.

AWSServiceRoleForCloudWatchMetrics_DbPerfInsightsServiceRolePolicy – New policy

CloudWatch added a new policy AWSServiceRoleForCloudWatchMetrics_DbPerfInsightsServiceRolePolicy.

The AWSServiceRoleForCloudWatchMetrics_DbPerfInsightsServiceRolePolicy grants permission to CloudWatch to fetch Performance Insights metrics from databases on your behalf.

CloudWatchReadOnlyAccess – Update to an existing policy

CloudWatch added a permission to CloudWatchReadOnlyAccess.

The application-autoscaling:DescribeScalingPolicies permission was added so that users with this policy can access information about Application Auto Scaling policies.

CloudWatchFullAccessV2 – New policy

CloudWatch added a new policy CloudWatchFullAccessV2.

The CloudWatchFullAccessV2 grants full access to CloudWatch actions and resources while better scoping the permissions granted to other services such as Amazon SNS and Amazon EC2 Auto Scaling. For more information, see CloudWatchFullAccessV2.

AWSServiceRoleForInternetMonitor – Update to an existing policy

Amazon CloudWatch Internet Monitor added new permissions to monitor Network Load Balancer resources.

The elasticloadbalancing:DescribeLoadBalancers and ec2:DescribeNetworkInterfaces permissions are required so that Internet Monitor can monitor customers' Network Load Balancer traffic by analyzing flow logs for NLB resources.

For more information, see Using Internet Monitor.

CloudWatchReadOnlyAccess – Update to an existing policy

CloudWatch added permissions to CloudWatchReadOnlyAccess.

The logs:StartLiveTail and logs:StopLiveTail permissions were added so that users with this policy can use the console to start and stop CloudWatch Logs live tail sessions. For more information, see Use live tail to view logs in near real time.

CloudWatchCrossAccountSharingConfiguration – New policy

CloudWatch added a new policy to enable you to manage CloudWatch cross-account observability links that share CloudWatch metrics.

For more information, see CloudWatch cross-account observability.

OAMFullAccess – New policy

CloudWatch added a new policy to enable you to fully manage CloudWatch cross-account observability links and sinks.

For more information, see CloudWatch cross-account observability.

OAMReadOnlyAccess – New policy

CloudWatch added a new policy to enable you to view information about CloudWatch cross-account observability links and sinks.

For more information, see CloudWatch cross-account observability.

CloudWatchFullAccess – Update to an existing policy

CloudWatch added permissions to CloudWatchFullAccess.

The oam:ListSinks and oam:ListAttachedLinks permissions were added so that users with this policy can use the console to view data shared from source accounts in CloudWatch cross-account observability.

CloudWatchReadOnlyAccess – Update to an existing policy

CloudWatch added permissions to CloudWatchReadOnlyAccess.

The oam:ListSinks and oam:ListAttachedLinks permissions were added so that users with this policy can use the console to view data shared from source accounts in CloudWatch cross-account observability.

AmazonCloudWatchRUMServiceRolePolicy – Update to an existing policy

CloudWatch RUM updated a condition key in AmazonCloudWatchRUMServiceRolePolicy.

The "Condition": { "StringEquals": { "cloudwatch:namespace": "AWS/RUM" } } condition key was changed to the following so that CloudWatch RUM can send custom metrics to custom metric namespaces.

"Condition": {
    "StringLike": {
		"cloudwatch:namespace": [
			"RUM/CustomMetrics/*",
			"AWS/RUM"
		]
	}
}
									
								

AmazonCloudWatchRUMReadOnlyAccess – Updated policy

CloudWatch added permissions the AmazonCloudWatchRUMReadOnlyAccess policy.

The rum:ListRumMetricsDestinations and rum:BatchGetRumMetricsDefinitions permissions were added so that CloudWatch RUM can send extended metrics to CloudWatch and Evidently.

AmazonCloudWatchRUMServiceRolePolicy – Update to an existing policy

CloudWatch RUM added permissions to AmazonCloudWatchRUMServiceRolePolicy.

The cloudwatch:PutMetricData permission was added so that CloudWatch RUM can send extended metrics to CloudWatch.

CloudWatchEvidentlyReadOnlyAccess – Update to an existing policy

CloudWatch Evidently added permissions to CloudWatchEvidentlyReadOnlyAccess.

The evidently:GetSegment, evidently:ListSegments, and evidently:ListSegmentReferences permissions were added so that users with this policy can see Evidently audience segments that have been created.

CloudWatchSyntheticsFullAccess – Update to an existing policy

CloudWatch Synthetics added permissions to CloudWatchSyntheticsFullAccess.

The lambda:DeleteFunction and lambda:DeleteLayerVersion permissions were added so that CloudWatch Synthetics can delete related resources when a canary is deleted. The iam:ListAttachedRolePolicies was added so that customers can view the policies that are attached to a canary's IAM role.

AmazonCloudWatchRUMFullAccess – New policy

CloudWatch added a new policy to enable full management of CloudWatch RUM.

CloudWatch RUM allows you to perform real user monitoring of your web application. For more information, see CloudWatch RUM.

AmazonCloudWatchRUMReadOnlyAccess – New policy

CloudWatch added a new policy to enable read-only access to CloudWatch RUM.

CloudWatch RUM allows you to perform real user monitoring of your web application. For more information, see CloudWatch RUM.

CloudWatchEvidentlyFullAccess – New policy

CloudWatch added a new policy to enable full management of CloudWatch Evidently.

CloudWatch Evidently allows you to perform A/B experiments of your web applications, and to roll them out gradually. For more information, see Perform launches and A/B experiments with CloudWatch Evidently.

CloudWatchEvidentlyReadOnlyAccess – New policy

CloudWatch added a new policy to enable read-only access to CloudWatch Evidently.

CloudWatch Evidently allows you to perform A/B experiments of your web applications, and to roll them out gradually. For more information, see Perform launches and A/B experiments with CloudWatch Evidently.

AWSServiceRoleForCloudWatchRUM – New managed policy

CloudWatch added a policy for a new service-linked role to allow CloudWatch RUM to pubish monitoring data to other relevant Amazon services.

CloudWatchSyntheticsFullAccess – Update to an existing policy

CloudWatch Synthetics added permissions to CloudWatchSyntheticsFullAccess, and also changed the scope of one permission.

The kms:ListAliases permission was added so that users can list available Amazon KMS keys that can be used to encrypt canary artifacts. The kms:DescribeKey permission was added so that users can see the details of keys that will be used to encrypt for canary artifacts. And the kms:Decrypt permission was added to enable users to decrypt canary artifacts. This decryption ability is limited to use on resources within Amazon S3 buckets.

The Resource scope of the s3:GetBucketLocation permission was changed from * to arn:aws:s3:::*.

CloudWatchSyntheticsFullAccess – Update to an existing policy

CloudWatch Synthetics added a permission to CloudWatchSyntheticsFullAccess.

The lambda:UpdateFunctionCode permission was added so that users with this policy can change the runtime version of canaries.

AWSCloudWatchAlarms_ActionSSMIncidentsServiceRolePolicy – New managed policy

CloudWatch added a new managed IAM policy to allow CloudWatch to create incidents in Amazon Systems Manager Incident Manager.

CloudWatchAutomaticDashboardsAccess – Update to an existing policy

CloudWatch added a permission to the CloudWatchAutomaticDashboardsAccess managed policy. The synthetics:DescribeCanariesLastRun permission was added to this policy to enable cross-account dashboard users to see details about CloudWatch Synthetics canary runs.

CloudWatch started tracking changes

CloudWatch started tracking changes for its Amazon managed policies.