Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon CloudWatch Logs

Amazon CloudWatch Logs (service prefix: logs) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon CloudWatch Logs
Actions defined by Amazon CloudWatch Logs
Permission-only actions for Amazon CloudWatch Logs
Resource types defined by Amazon CloudWatch Logs
Condition keys for Amazon CloudWatch Logs

API operations defined by Amazon CloudWatch Logs

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateKmsKey	logs:AssociateKmsKey			Write
AssociateSourceToS3TableIntegration	logs:AssociateSourceToS3TableIntegration			Write
CancelExportTask	logs:CancelExportTask			Write
CancelImportTask	logs:CancelImportTask			Write
CreateDelivery	logs:CreateDelivery			Write
CreateDelivery	logs:TagResource			Tagging, Write
CreateExportTask	logs:CreateExportTask			Write
CreateImportTask	logs:CreateImportTask			Write
CreateImportTask	iam:PassRole	iam:PassedToService	cloudtrail.amazonaws.com, logs.amazonaws.com	Write
CreateLogAnomalyDetector	logs:CreateLogAnomalyDetector			Write
CreateLogAnomalyDetector	logs:TagResource			Tagging, Write
CreateLogGroup	logs:CreateLogGroup			Write
	logs:TagLogGroup			Tagging, Write
	logs:TagResource			Tagging, Write
CreateLogStream	logs:CreateLogStream			Write
CreateLookupTable	logs:CreateLookupTable			Write
CreateLookupTable	logs:TagResource			Tagging, Write
CreateScheduledQuery	logs:CreateScheduledQuery			Write
	logs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	logs.amazonaws.com	Write
DeleteAccountPolicy	logs:DeleteAccountPolicy			Write
	logs:DeleteDataProtectionPolicy			Write
	logs:DeleteIndexPolicy			Write
	logs:DeleteRetentionPolicy			Write
	logs:DeleteSubscriptionFilter			Write
	logs:DeleteTransformer			Write
DeleteDataProtectionPolicy	logs:DeleteDataProtectionPolicy			Write
DeleteDelivery	logs:DeleteDelivery			Write
DeleteDeliveryDestination	logs:DeleteDeliveryDestination			Write
DeleteDeliveryDestinationPolicy	logs:DeleteDeliveryDestinationPolicy			Write
DeleteDeliverySource	logs:DeleteDeliverySource			Write
DeleteDestination	logs:DeleteDestination			Write
DeleteIndexPolicy	logs:DeleteIndexPolicy			Write
DeleteIntegration	logs:DeleteIntegration			Write
DeleteLogAnomalyDetector	logs:DeleteLogAnomalyDetector			Write
DeleteLogGroup	logs:DeleteLogGroup			Write
DeleteLogStream	logs:DeleteLogStream			Write
DeleteLookupTable	logs:DeleteLookupTable			Write
DeleteMetricFilter	logs:DeleteMetricFilter			Write
DeleteQueryDefinition	logs:DeleteQueryDefinition			Write
DeleteResourcePolicy	logs:DeleteResourcePolicy			Permissions management, Write
DeleteRetentionPolicy	logs:DeleteRetentionPolicy			Write
DeleteScheduledQuery	logs:DeleteScheduledQuery			Write
DeleteSubscriptionFilter	logs:DeleteSubscriptionFilter			Write
DeleteSyslogConfiguration	logs:DeleteSyslogConfiguration			Write
DeleteTransformer	logs:DeleteTransformer			Write
DescribeAccountPolicies	logs:DescribeAccountPolicies			List
DescribeConfigurationTemplates	logs:DescribeConfigurationTemplates			List
DescribeDeliveries	logs:DescribeDeliveries			List
DescribeDeliveryDestinations	logs:DescribeDeliveryDestinations			List
DescribeDeliverySources	logs:DescribeDeliverySources			List
DescribeDestinations	logs:DescribeDestinations			List
DescribeExportTasks	logs:DescribeExportTasks			List
DescribeFieldIndexes	logs:DescribeFieldIndexes			List
DescribeImportTaskBatches	logs:DescribeImportTaskBatches			List
DescribeImportTasks	logs:DescribeImportTasks			List
DescribeIndexPolicies	logs:DescribeIndexPolicies			List
DescribeLogGroups	logs:DescribeLogGroups			List
DescribeLogStreams	logs:DescribeLogStreams			List
DescribeLookupTables	logs:DescribeLookupTables			List
DescribeMetricFilters	logs:DescribeMetricFilters			List
DescribeQueries	logs:DescribeQueries			List
DescribeQueries	logs:FilterLogEvents			Read
DescribeQueryDefinitions	logs:DescribeQueryDefinitions			List
DescribeResourcePolicies	logs:DescribeResourcePolicies			List
DescribeSubscriptionFilters	logs:DescribeSubscriptionFilters			List
DisassociateKmsKey	logs:DisassociateKmsKey			Write
DisassociateSourceFromS3TableIntegration	logs:DisassociateSourceFromS3TableIntegration			Write
FilterLogEvents	logs:FilterLogEvents			Read
FilterLogEvents	logs:Unmask			Read
GetDataProtectionPolicy	logs:GetDataProtectionPolicy			Read
GetDelivery	logs:GetDelivery			Read
GetDeliveryDestination	logs:GetDeliveryDestination			Read
GetDeliveryDestinationPolicy	logs:GetDeliveryDestinationPolicy			Read
GetDeliverySource	logs:GetDeliverySource			Read
GetIntegration	logs:GetIntegration			Read
GetLogAnomalyDetector	logs:GetLogAnomalyDetector			Read
GetLogEvents	logs:GetLogEvents			Read
GetLogEvents	logs:Unmask			Read
GetLogFields	logs:GetLogFields			Read
GetLogGroupFields	logs:FilterLogEvents			Read
GetLogGroupFields	logs:GetLogGroupFields			Read
GetLogRecord	logs:FilterLogEvents			Read
	logs:GetLogRecord			Read
	logs:Unmask			Read
GetLookupTable	logs:GetLookupTable			Read
GetQueryResults	logs:FilterLogEvents			Read
	logs:GetQueryResults			Read
	logs:Unmask			Read
GetScheduledQuery	logs:GetScheduledQuery			Read
GetScheduledQueryHistory	logs:GetScheduledQueryHistory			Read
GetStorageTierPolicy	logs:GetStorageTierPolicy			Read
GetTransformer	logs:GetTransformer			Read
ListAggregateLogGroupSummaries	logs:ListAggregateLogGroupSummaries			List
ListAnomalies	logs:ListAnomalies			List
ListIntegrations	logs:ListIntegrations			List
ListLogAnomalyDetectors	logs:ListLogAnomalyDetectors			List
ListLogGroups	logs:DescribeLogGroups			List
ListLogGroups	logs:ListLogGroups			List
ListLogGroupsForQuery	logs:ListLogGroupsForQuery			List
ListScheduledQueries	logs:ListScheduledQueries			List
ListSourcesForS3TableIntegration	logs:ListSourcesForS3TableIntegration			List
ListSyslogConfigurations	logs:ListSyslogConfigurations			List
ListTagsForResource	logs:ListTagsForResource			List
ListTagsLogGroup	logs:ListTagsLogGroup			List
PutAccountPolicy	logs:PutAccountPolicy			Write
	logs:PutDataProtectionPolicy			Write
	logs:PutIndexPolicy			Write
	logs:PutRetentionPolicy			Write
	logs:PutSubscriptionFilter			Write
	logs:PutTransformer			Write
	iam:PassRole	iam:PassedToService	logs.amazonaws.com	Write
PutBearerTokenAuthentication	logs:PutBearerTokenAuthentication			Write
PutDataProtectionPolicy	logs:PutDataProtectionPolicy			Write
PutDeliveryDestination	logs:PutDeliveryDestination			Write
PutDeliveryDestination	logs:TagResource			Tagging, Write
PutDeliveryDestinationPolicy	logs:PutDeliveryDestinationPolicy			Write
PutDeliverySource	logs:PutDeliverySource			Write
PutDeliverySource	logs:TagResource			Tagging, Write
PutDestination	logs:PutDestination			Write
	logs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	logs.amazonaws.com	Write
PutDestinationPolicy	logs:PutDestinationPolicy			Write
PutIndexPolicy	logs:PutIndexPolicy			Write
PutIntegration	logs:PutIntegration			Write
PutLogEvents	logs:PutLogEvents			Write
PutLogGroupDeletionProtection	logs:PutLogGroupDeletionProtection			Write
PutMetricFilter	logs:PutMetricFilter			Write
PutQueryDefinition	logs:PutQueryDefinition			Write
PutResourcePolicy	logs:PutResourcePolicy			Permissions management, Write
PutRetentionPolicy	logs:PutRetentionPolicy			Write
PutStorageTierPolicy	logs:PutStorageTierPolicy			Write
PutSubscriptionFilter	logs:PutSubscriptionFilter			Write
PutSubscriptionFilter	iam:PassRole	iam:PassedToService	logs.amazonaws.com	Write
PutSyslogConfiguration	logs:PutSyslogConfiguration			Write
PutTransformer	logs:PutTransformer			Write
StartQuery	logs:DescribeLogGroups			List
	logs:DescribeQueryDefinitions			List
	logs:FilterLogEvents			Read
	logs:StartQuery			Read
	logs:Unmask			Read
StopQuery	logs:FilterLogEvents			Read
StopQuery	logs:StopQuery			Read
TagLogGroup	logs:TagLogGroup			Tagging, Write
TagResource	logs:TagResource			Tagging, Write
TestMetricFilter	logs:TestMetricFilter			Read
TestTransformer	logs:TestTransformer			Read
UntagLogGroup	logs:UntagLogGroup			Tagging, Write
UntagResource	logs:UntagResource			Tagging, Write
UpdateAnomaly	logs:UpdateAnomaly			Write
UpdateDeliveryConfiguration	logs:UpdateDeliveryConfiguration			Write
UpdateLogAnomalyDetector	logs:UpdateLogAnomalyDetector			Write
UpdateLookupTable	logs:UpdateLookupTable			Write
UpdateScheduledQuery	logs:UpdateScheduledQuery			Write
UpdateScheduledQuery	iam:PassRole	iam:PassedToService	logs.amazonaws.com	Write

Actions defined by Amazon CloudWatch Logs

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateKmsKey	Grants permission to associate the specified Amazon Key Management Service (Amazon KMS) customer master key (CMK) with the specified log group	log-group*	aws:ResourceTag/${TagKey}	Write
AssociateSourceToS3TableIntegration	Grants permission to associate a log source to an S3 Tables integration			Write
CancelExportTask	Grants permission to cancel an export task if it is in PENDING or RUNNING state			Write
CancelImportTask	Grants permission to cancel an import from CloudTrail Lake to CloudWatch			Write
CreateDelivery	Grants permission to create a delivery connecting a delivery source to a delivery destination	delivery*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		delivery-destination*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		delivery-source*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateExportTask	Grants permission to create an ExportTask which allows you to efficiently export data from a Log Group to your Amazon S3 bucket	log-group*	aws:ResourceTag/${TagKey}	Write
CreateImportTask	Grants permission to start an asynchronous process to import data from a CloudTrail Lake event data store into a managed log group in CloudWatch			Write
CreateLogAnomalyDetector	Grants permission to create a log anomaly detector	log-group*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateLogGroup	Grants permission to create a new log group with the specified name	log-group*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateLogStream	Grants permission to create a new log stream with the specified name	log-stream*	aws:ResourceTag/${TagKey}	Write
CreateLookupTable	Grants permission to create a lookup table	lookup-table*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateScheduledQuery	Grants permission to create a scheduled query	scheduled-query*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAccountPolicy	Grants permission to delete an account policy			Write
DeleteDataProtectionPolicy	Grants permission to delete a data protection policy attached to a log group	log-group*	aws:ResourceTag/${TagKey}	Write
DeleteDelivery	Grants permission to delete a delivery	delivery*	aws:ResourceTag/${TagKey}	Write
DeleteDeliveryDestination	Grants permission to delete a delivery destination after all associated deliveries are deleted	delivery-destination*	aws:ResourceTag/${TagKey}	Write
DeleteDeliveryDestinationPolicy	Grants permission to delete a delivery destination policy associated with a delivery destination	delivery-destination*	aws:ResourceTag/${TagKey}	Write
DeleteDeliverySource	Grants permission to delete a delivery source after all associated deliveries are deleted	delivery-destination*	aws:ResourceTag/${TagKey}	Write
DeleteDestination	Grants permission to delete the destination with the specified name	destination*	aws:ResourceTag/${TagKey}	Write
DeleteIndexPolicy	Grants permission to delete an index policy attached to a log group			Write
DeleteIntegration	Grants permission to delete the integration			Write
DeleteLogAnomalyDetector	Grants permission to delete a log anomaly detector	anomaly-detector*	aws:ResourceTag/${TagKey}	Write
DeleteLogGroup	Grants permission to delete the log group with the specified name	log-group*	aws:ResourceTag/${TagKey}	Write
DeleteLogStream	Grants permission to delete a log stream	log-stream*	aws:ResourceTag/${TagKey}	Write
DeleteLookupTable	Grants permission to delete a lookup table	lookup-table*	aws:ResourceTag/${TagKey}	Write
DeleteMetricFilter	Grants permission to delete a metric filter associated with the specified log group	log-group*	aws:ResourceTag/${TagKey}	Write
DeleteQueryDefinition	Grants permission to delete a saved CloudWatch Logs Insights query definition			Write
DeleteResourcePolicy	Grants permission to delete a resource policy from this account			Permissions management, Write
DeleteRetentionPolicy	Grants permission to delete the retention policy of the specified log group	log-group*	aws:ResourceTag/${TagKey}	Write
DeleteScheduledQuery	Grants permission to delete a scheduled query	scheduled-query*	aws:ResourceTag/${TagKey}	Write
DeleteSubscriptionFilter	Grants permission to delete a subscription filter associated with the specified log group	log-group*	aws:ResourceTag/${TagKey}	Write
DeleteSyslogConfiguration	Grants permission to delete syslog configuration for the specified log group	log-group*	aws:ResourceTag/${TagKey}	Write
DeleteTransformer	Grants permission to delete a transformer associated with the specified log group	log-group*	aws:ResourceTag/${TagKey}	Write
DescribeAccountPolicies	Grants permission to retrieve account policies			List
DescribeConfigurationTemplates	Grants permission to retrieve a list of configuration templates of available log types			List
DescribeDeliveries	Grants permission to retrieve a list of deliveries an account			List
DescribeDeliveryDestinations	Grants permission to retrieve a list of delivery destinations an account			List
DescribeDeliverySources	Grants permission to retrieve a list of delivery sources in an account			List
DescribeDestinations	Grants permission to return all the destinations that are associated with the Amazon Web Services account making the request			List
DescribeExportTasks	Grants permission to return all the export tasks that are associated with the Amazon Web Services account making the request			List
DescribeFieldIndexes	Grants permission to return all the indexing attributes that are attached with the log groups			List
DescribeImportTaskBatches	Grants permission to return detailed information about the individual batches within an import task, including status and any error			List
DescribeImportTasks	Grants permission to return all the import tasks associated with the Amazon Web Services account making the request			List
DescribeIndexPolicies	Grants permission to return all the index policies that are attached with the log groups			List
DescribeLogGroups	Grants permission to return all the log groups that are associated with the Amazon Web Services account making the request			List
DescribeLogStreams	Grants permission to return all the log streams that are associated with the specified log group	log-group*	aws:ResourceTag/${TagKey}	List
DescribeLookupTables	Grants permission to return all lookup tables			List
DescribeMetricFilters	Grants permission to return all the metrics filters associated with the specified log group	log-group*	aws:ResourceTag/${TagKey}	List
DescribeQueries	Grants permission to return a list of CloudWatch Logs Insights queries that are scheduled, executing, or have been executed recently in this account			List
DescribeQueryDefinitions	Grants permission to return a paginated list of your saved CloudWatch Logs Insights query definitions			List
DescribeResourcePolicies	Grants permission to return all the resource policies in this account			List
DescribeSubscriptionFilters	Grants permission to return all the subscription filters associated with the specified log group	log-group*	aws:ResourceTag/${TagKey}	List
DisassociateKmsKey	Grants permission to disassociate the associated Amazon Key Management Service (Amazon KMS) customer master key (CMK) from the specified log group	log-group*	aws:ResourceTag/${TagKey}	Write
DisassociateSourceFromS3TableIntegration	Grants permission to disassociate a log source from an S3 Tables integration			Write
FilterLogEvents	Grants permission to retrieve log events, optionally filtered by a filter pattern from the specified log group	log-group*	aws:ResourceTag/${TagKey}	Read
GetDataProtectionPolicy	Grants permission to retrieve a data protection policy attached to a log group	log-group*	aws:ResourceTag/${TagKey}	Read
GetDelivery	Grants permission to retrieve a single delivery	delivery*	aws:ResourceTag/${TagKey}	Read
GetDeliveryDestination	Grants permission to retrieve a single delivery destination	delivery-destination*	aws:ResourceTag/${TagKey}	Read
GetDeliveryDestinationPolicy	Grants permission to retrieve a delivery destination policy attached to a delivery destination	delivery-destination*	aws:ResourceTag/${TagKey}	Read
GetDeliverySource	Grants permission to retrieve a single delivery source	delivery-source*	aws:ResourceTag/${TagKey}	Read
GetIntegration	Grants permission to retrieve a single integration			Read
GetLogAnomalyDetector	Grants permission to get a log anomaly detector	anomaly-detector*	aws:ResourceTag/${TagKey}	Read
GetLogEvents	Grants permission to retrieve log events from the specified log stream	log-stream*	aws:ResourceTag/${TagKey}	Read
GetLogFields	Grants permission to retrieve a list of log fields for a data source			Read
GetLogGroupFields	Grants permission to return a list of the fields that are included in log events in the specified log group, along with the percentage of log events that contain each field	log-group*	aws:ResourceTag/${TagKey}	Read
GetLogRecord	Grants permission to retrieve all the fields and values of a single log event	log-group*	aws:ResourceTag/${TagKey}	Read
GetLookupTable	Grants permission to retrieve a lookup table	lookup-table*	aws:ResourceTag/${TagKey}	Read
GetQueryResults	Grants permission to return the results from the specified query	log-group*	aws:ResourceTag/${TagKey}	Read
GetScheduledQuery	Grants permission to retrieve information about a specified scheduled query	scheduled-query*	aws:ResourceTag/${TagKey}	Read
GetScheduledQueryHistory	Grants permission to return the execution history for a specified scheduled query	scheduled-query*	aws:ResourceTag/${TagKey}	Read
GetStorageTierPolicy	Grants permission to retrieve the storage tier policy for the account			Read
GetTransformer	Grants permission to return transformer associated with the specified log group	log-group*	aws:ResourceTag/${TagKey}	Read
ListAggregateLogGroupSummaries	Grants permission to return an aggregate summary of all log groups in the region grouped by specified data-source characteristics			List
ListAnomalies	Grants permission to list all anomalies detected in the Amazon Web Services account making the request	anomaly-detector	aws:ResourceTag/${TagKey}	List
ListIntegrations	Grants permission to list all integrations associated with the Amazon Web Services account making the request			List
ListLogAnomalyDetectors	Grants permission to return all the anomaly detectors that are associated with the Amazon Web Services account making the request	anomaly-detector	aws:ResourceTag/${TagKey}	List
ListLogGroups	Grants permission to return all the log groups that are associated with the Amazon Web Services account making the request			List
ListLogGroupsForQuery	Grants permission to return all the log groups that are associated with the specified query			List
ListScheduledQueries	Grants permission to return all scheduled queries that are associated with the Amazon Web Services account making the request			List
ListSourcesForS3TableIntegration	Grants permission to return all log sources associated with an S3 Tables integration			List
ListSyslogConfigurations	Grants permission to return all syslog configurations associated with the Amazon Web Services account making the request			List
ListTagsForResource	Grants permission to list the tags for the specified resource	anomaly-detector	aws:ResourceTag/${TagKey}	List
		delivery	aws:ResourceTag/${TagKey}
		delivery-destination	aws:ResourceTag/${TagKey}
		delivery-source	aws:ResourceTag/${TagKey}
		destination	aws:ResourceTag/${TagKey}
		log-group	aws:ResourceTag/${TagKey}
		lookup-table	aws:ResourceTag/${TagKey}
ListTagsLogGroup	Grants permission to list the tags for the specified log group	log-group*	aws:ResourceTag/${TagKey}	List
PutAccountPolicy	Grants permission to attach an account policy			Write
PutBearerTokenAuthentication	Grants permission to enable or disable bearer token based authentication for the specified log group	log-group*	aws:ResourceTag/${TagKey}	Write
PutDataProtectionPolicy	Grants permission to attach a data protection policy to detect and redact sensitive information from log events	log-group*	aws:ResourceTag/${TagKey}	Write
PutDeliveryDestination	Grants permission to create/update a delivery destination	delivery-destination*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys logs:DeliveryDestinationResourceArn	Write
PutDeliveryDestinationPolicy	Grants permission to attach a delivery destination policy to a delivery destination	delivery-destination*	aws:ResourceTag/${TagKey}	Write
PutDeliverySource	Grants permission to create/update a delivery source	delivery-source*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys logs:LogGeneratingResourceArns	Write
PutDestination	Grants permission to create or update a Destination	destination*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutDestinationPolicy	Grants permission to create or update an access policy associated with an existing Destination	destination*	aws:ResourceTag/${TagKey}	Write
PutIndexPolicy	Grants permission to attach an index policy at log group level to optimize search and query			Write
PutIntegration	Grants permission to create integration between cloudwatch logs and opensearch			Write
PutLogEvents	Grants permission to upload a batch of log events to the specified log stream	log-stream*	aws:ResourceTag/${TagKey}	Write
PutLogGroupDeletionProtection	Grants permission to enable or disable deletion protection for the specified log group	log-group*	aws:ResourceTag/${TagKey}	Write
PutMetricFilter	Grants permission to create or update a metric filter and associates it with the specified log group	log-group*	aws:ResourceTag/${TagKey}	Write
PutQueryDefinition	Grants permission to create or update a query definition			Write
PutResourcePolicy	Grants permission to create or update a resource policy allowing other Amazon services to put log events to this account			Permissions management, Write
PutRetentionPolicy	Grants permission to set the retention of the specified log group	log-group*	aws:ResourceTag/${TagKey}	Write
PutStorageTierPolicy	Grants permission to set the storage tier policy for the account			Write
PutSubscriptionFilter	Grants permission to create or update a subscription filter and associates it with the specified log group	destination	aws:ResourceTag/${TagKey}	Write
PutSubscriptionFilter		log-group*	aws:ResourceTag/${TagKey}	Write
PutSyslogConfiguration	Grants permission to add syslog configuration for the specified log group	log-group*	aws:ResourceTag/${TagKey}	Write
PutTransformer	Grants permission to create or update a transformer and associates it with the specified log group	log-group*	aws:ResourceTag/${TagKey}	Write
StartLiveTail	Grants permission to start a Live Tail session in CloudWatch Logs	log-group*	aws:ResourceTag/${TagKey}	Read
StartQuery	Grants permission to schedule a query of a log group using CloudWatch Logs Insights	log-group*	aws:ResourceTag/${TagKey}	Read
StopQuery	Grants permission to stop a CloudWatch Logs Insights query that is in progress			Read
TagLogGroup	Grants permission to add or update the specified tags for the specified log group	log-group*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource	Grants permission to add or update the specified tags for the specified resource	anomaly-detector	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		delivery	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		delivery-destination	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		delivery-source	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		destination	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		log-group	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		lookup-table	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		scheduled-query	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
TestMetricFilter	Grants permission to test the filter pattern of a metric filter against a sample of log event messages			Read
TestTransformer	Grants permission to test the transformer against a sample of log event messages			Read
UntagLogGroup	Grants permission to remove the specified tags from the specified log group	log-group*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove the specified tags from the specified resource	anomaly-detector	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		delivery	aws:ResourceTag/${TagKey} aws:TagKeys
		delivery-destination	aws:ResourceTag/${TagKey} aws:TagKeys
		delivery-source	aws:ResourceTag/${TagKey} aws:TagKeys
		destination	aws:ResourceTag/${TagKey} aws:TagKeys
		log-group	aws:ResourceTag/${TagKey} aws:TagKeys
		lookup-table	aws:ResourceTag/${TagKey} aws:TagKeys
		scheduled-query	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAnomaly	Grants permission to update an anomaly reported by a log anomaly detector	anomaly-detector*	aws:ResourceTag/${TagKey}	Write
UpdateDeliveryConfiguration	Grants permission to update configuration related to a delivery	delivery*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		delivery-destination*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		delivery-source*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UpdateLogAnomalyDetector	Grants permission to update a log anomaly detector	anomaly-detector*	aws:ResourceTag/${TagKey}	Write
UpdateLookupTable	Grants permission to update a lookup table	lookup-table*	aws:ResourceTag/${TagKey}	Write
UpdateScheduledQuery	Grants permission to update a scheduled query	scheduled-query*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon CloudWatch Logs

The following actions are defined by Amazon CloudWatch Logs but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CallWithBearerToken	Grants permission to authenticate requests using bearer token			Write
CreateLogDelivery	Grants permission to create the log delivery			Write
DeleteLogDelivery	Grants permission to delete the log delivery information for specified log delivery			Write
DeletePipelineRule	Grants permission to delete telemetry pipeline			Write
GetLogDelivery	Grants permission to get the log delivery information for specified log delivery			Read
IntegrateWithS3Table	Grants permission to deliver log events to S3 Tables	log-group*	aws:ResourceTag/${TagKey} logs:data_source_name logs:data_source_type	Write
Link	Grants permission to share CloudWatch resources with a monitoring account			Write
ListEntitiesForLogGroup	Grants permission to retrieve all the entities that are associated with log group			List
ListLogDeliveries	Grants permission to list all the log deliveries for specified account and/or log source			List
ListLogGroupsForEntity	Grants permission to retrieve all the log groups that are associated with entity			List
ProcessWithPipeline	Grants permission to process and transform log events through pipeline transformers before storage	log-group*	aws:ResourceTag/${TagKey} logs:data_source_name logs:data_source_type	Write
PutPipelineRule	Grants permission to create telemetry pipeline			Write
StopLiveTail	Grants permission to stop a Live Tail session that is in progress			Read
Unmask	Grants permission to fetch unmasked log events that have been redacted with a data protection policy	log-group*	aws:ResourceTag/${TagKey}	Read
UpdateLogDelivery	Grants permission to update the log delivery information for specified log delivery			Write

Resource types defined by Amazon CloudWatch Logs

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
anomaly-detector	arn:${Partition}:logs:${Region}:${Account}:anomaly-detector:${DetectorId}	aws:ResourceTag/${TagKey}
delivery	arn:${Partition}:logs:${Region}:${Account}:delivery:${DeliveryName}	aws:ResourceTag/${TagKey}
delivery-destination	arn:${Partition}:logs:${Region}:${Account}:delivery-destination:${DeliveryDestinationName}	aws:ResourceTag/${TagKey}
delivery-source	arn:${Partition}:logs:${Region}:${Account}:delivery-source:${DeliverySourceName}	aws:ResourceTag/${TagKey}
destination	arn:${Partition}:logs:${Region}:${Account}:destination:${DestinationName}	aws:ResourceTag/${TagKey}
log-group	arn:${Partition}:logs:${Region}:${Account}:log-group:${LogGroupName}	aws:ResourceTag/${TagKey}
log-stream	arn:${Partition}:logs:${Region}:${Account}:log-group:${LogGroupName}:log-stream:${LogStreamName}	aws:ResourceTag/${TagKey}
lookup-table	arn:${Partition}:logs:${Region}:${Account}:lookup-table:${LookupTableName}	aws:ResourceTag/${TagKey}
scheduled-query	arn:${Partition}:logs:${Region}:${Account}:scheduled-query:${ScheduledQueryId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon CloudWatch Logs

Amazon CloudWatch Logs defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
logs:DeliveryDestinationResourceArn	Filters access by the Log Destination ARN passed in the request	ARN
logs:LogGeneratingResourceArns	Filters access by the Log Generating Resource ARNs passed in the request	ArrayOfARN
logs:data_source_name	Filters access by the data source name passed in the request	String
logs:data_source_type	Filters access by the data source type passed in the request	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon CloudWatch Application Insights (applicationinsights)

Amazon CloudWatch Observability Access Manager (oam)