Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon CloudWatch

Amazon CloudWatch (service prefix: cloudwatch) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon CloudWatch
Actions defined by Amazon CloudWatch
Permission-only actions for Amazon CloudWatch
Resource types defined by Amazon CloudWatch
Condition keys for Amazon CloudWatch

API operations defined by Amazon CloudWatch

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
DeleteAlarmMuteRule	cloudwatch:DeleteAlarmMuteRule			Write
DeleteAlarms	cloudwatch:DeleteAlarms			Write
DeleteAnomalyDetector	cloudwatch:DeleteAnomalyDetector			Write
DeleteDashboards	cloudwatch:DeleteDashboards			Write
DeleteInsightRules	cloudwatch:DeleteInsightRules			Write
DeleteMetricStream	cloudwatch:DeleteMetricStream			Write
DescribeAlarmHistory	cloudwatch:DescribeAlarmHistory			Read
DescribeAlarms	cloudwatch:DescribeAlarms			Read
DescribeAlarmsForMetric	cloudwatch:DescribeAlarmsForMetric			Read
DescribeAnomalyDetectors	cloudwatch:DescribeAnomalyDetectors			Read
DescribeInsightRules	cloudwatch:DescribeInsightRules			Read
DisableAlarmActions	cloudwatch:DisableAlarmActions			Write
DisableInsightRules	cloudwatch:DisableInsightRules			Write
EnableAlarmActions	cloudwatch:EnableAlarmActions			Write
EnableInsightRules	cloudwatch:EnableInsightRules			Write
GetAlarmMuteRule	cloudwatch:GetAlarmMuteRule			Read
GetDashboard	cloudwatch:GetDashboard			Read
GetDataset	cloudwatch:GetDataset			Read
GetInsightRuleReport	cloudwatch:GetInsightRuleReport			Read
GetMetricData	cloudwatch:GetMetricData			Read
GetMetricStatistics	cloudwatch:GetMetricStatistics			Read
GetMetricStream	cloudwatch:GetMetricStream			Read
GetMetricWidgetImage	cloudwatch:GetMetricWidgetImage			Read
GetOTelEnrichment	cloudwatch:GetOTelEnrichment			Read
ListAlarmMuteRules	cloudwatch:ListAlarmMuteRules			List
ListDashboards	cloudwatch:ListDashboards			List
ListManagedInsightRules	cloudwatch:ListManagedInsightRules			Read
ListMetricStreams	cloudwatch:ListMetricStreams			List
ListMetrics	cloudwatch:ListMetrics			List
ListTagsForResource	cloudwatch:ListTagsForResource			List
PutAlarmMuteRule	cloudwatch:PutAlarmMuteRule			Write
PutAlarmMuteRule	cloudwatch:TagResource			Tagging, Write
PutAnomalyDetector	cloudwatch:PutAnomalyDetector			Write
PutCompositeAlarm	cloudwatch:PutCompositeAlarm			Write
PutCompositeAlarm	cloudwatch:TagResource			Tagging, Write
PutDashboard	cloudwatch:PutDashboard			Write
PutDashboard	cloudwatch:TagResource			Tagging, Write
PutInsightRule	cloudwatch:PutInsightRule			Write
PutInsightRule	cloudwatch:TagResource			Tagging, Write
PutLogAlarm	cloudwatch:PutLogAlarm			Write
	cloudwatch:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	cloudwatch.amazonaws.com	Write
PutManagedInsightRules	cloudwatch:PutManagedInsightRules			Write
PutMetricAlarm	cloudwatch:PutMetricAlarm			Write
PutMetricAlarm	cloudwatch:TagResource			Tagging, Write
PutMetricData	cloudwatch:PutMetricData			Write
PutMetricStream	cloudwatch:PutMetricStream			Write
	cloudwatch:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	streams.metrics.cloudwatch.amazonaws.com	Write
SetAlarmState	cloudwatch:SetAlarmState			Write
StartMetricStreams	cloudwatch:StartMetricStreams			Write
StartOTelEnrichment	cloudwatch:StartOTelEnrichment			Write
StopMetricStreams	cloudwatch:StopMetricStreams			Write
StopOTelEnrichment	cloudwatch:StopOTelEnrichment			Write
TagResource	cloudwatch:TagResource			Tagging, Write
UntagResource	cloudwatch:UntagResource			Tagging, Write

Actions defined by Amazon CloudWatch

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchGetServiceLevelIndicatorReport	Grants permission to batch get service level indicator report			Read
BatchGetServiceLevelObjectiveBudgetReport	Grants permission to batch retrieve a service level objective budget report	slo*	aws:ResourceTag/${TagKey}	Read
CreateServiceLevelObjective	Grants permission to create a service level objective		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteAlarmMuteRule	Grants permission to delete an alarm mute rule	alarm-mute-rule*	aws:ResourceTag/${TagKey}	Write
DeleteAlarms	Grants permission to delete a collection of alarms	alarm*	aws:ResourceTag/${TagKey}	Write
DeleteAnomalyDetector	Grants permission to delete the specified anomaly detection model from your account			Write
DeleteDashboards	Grants permission to delete all CloudWatch dashboards that you specify	dashboard*	aws:ResourceTag/${TagKey}	Write
DeleteInsightRules	Grants permission to delete a collection of insight rules	insight-rule*	aws:ResourceTag/${TagKey}	Write
DeleteMetricStream	Grants permission to delete the CloudWatch metric stream that you specify	metric-stream*	aws:ResourceTag/${TagKey}	Write
DeleteServiceLevelObjective	Grants permission to delete a service level objective	slo*	aws:ResourceTag/${TagKey}	Write
DescribeAlarmHistory	Grants permission to retrieve the history for the specified alarm	alarm*	aws:ResourceTag/${TagKey}	Read
DescribeAlarms	Grants permission to describe all alarms, currently owned by the user's account	alarm*	aws:ResourceTag/${TagKey}	Read
DescribeAlarmsForMetric	Grants permission to describe all alarms configured on the specified metric, currently owned by the user's account			Read
DescribeAnomalyDetectors	Grants permission to list the anomaly detection models that you have created in your account			Read
DescribeInsightRules	Grants permission to describe all insight rules, currently owned by the user's account			Read
DisableAlarmActions	Grants permission to disable actions for a collection of alarms	alarm*	aws:ResourceTag/${TagKey}	Write
DisableInsightRules	Grants permission to disable a collection of insight rules	insight-rule*	aws:ResourceTag/${TagKey}	Write
EnableAlarmActions	Grants permission to enable actions for a collection of alarms	alarm*	aws:ResourceTag/${TagKey}	Write
EnableInsightRules	Grants permission to enable a collection of insight rules	insight-rule*	aws:ResourceTag/${TagKey}	Write
EnableTopologyDiscovery	Grants permission to enable a CloudWatch topology discovery			Write
GenerateQuery	Grants permission to generate a Metrics Insights or Logs Insights query string from a natural language prompt			Read
GenerateQueryResultsSummary	Grants permission to generate a summary of CloudWatch LogInsights query results in natural language using generative AI			Read
GetAlarmMuteRule	Grants permission to get an alarm mute rule	alarm-mute-rule*	aws:ResourceTag/${TagKey}	Read
GetDashboard	Grants permission to display the details of the CloudWatch dashboard you specify	dashboard*	aws:ResourceTag/${TagKey}	Read
GetDataset	Grants permission to get a dataset	dataset*	aws:ResourceTag/${TagKey}	Read
GetInsightRuleReport	Grants permission to return the top-N report of unique contributors over a time range for a given insight rule	insight-rule*	aws:ResourceTag/${TagKey}	Read
GetMetricData	Grants permission to retrieve batch amounts of CloudWatch classic metric data and perform metric math on retrieved data; and grants permission to retrieve OTLP metric data using PromQL	dataset	aws:ResourceTag/${TagKey}	Read
GetMetricStatistics	Grants permission to retrieve statistics for the specified metric			Read
GetMetricStream	Grants permission to return the details of a CloudWatch metric stream	metric-stream*	aws:ResourceTag/${TagKey}	Read
GetMetricWidgetImage	Grants permission to retrieve snapshots of metric widgets			Read
GetService	Grants permission to retrieve information about a service	service*	aws:ResourceTag/${TagKey}	Read
GetServiceLevelObjective	Grants permission to retrieve information about service level objective	slo*	aws:ResourceTag/${TagKey}	Read
GetTopologyMap	Grants permission to retrieve a CloudWatch topology map			Read
ListAlarmMuteRules	Grants permission to retrieve a list of alarm mute rules owned by the user's account	alarm-mute-rule*	aws:ResourceTag/${TagKey}	List
ListDashboards	Grants permission to return a list of all CloudWatch dashboards in your account			List
ListManagedInsightRules	Grants permission to list available managed Insight Rules for a given Resource ARN		aws:RequestTag/${TagKey} aws:TagKeys cloudwatch:requestManagedResourceARNs	Read
ListMetricStreams	Grants permission to return a list of all CloudWatch metric streams in your account			List
ListMetrics	Grants permission to retrieve a list of valid metrics stored for the Amazon Web Services account owner	dataset	aws:ResourceTag/${TagKey}	List
ListServiceLevelObjectives	Grants permission to list service level objectives			List
ListServices	Grants permission to list services			List
ListTagsForResource	Grants permission to list tags for an Amazon CloudWatch resource	alarm	aws:ResourceTag/${TagKey}	List
		alarm-mute-rule	aws:ResourceTag/${TagKey}
		dashboard	aws:ResourceTag/${TagKey}
		dataset	aws:ResourceTag/${TagKey}
		insight-rule	aws:ResourceTag/${TagKey}
		metric-stream	aws:ResourceTag/${TagKey}
		service	aws:ResourceTag/${TagKey}
		slo	aws:ResourceTag/${TagKey}
	SCENARIO: CloudWatch-Alarm	alarm*
	SCENARIO: CloudWatch-AlarmMuteRule	alarm-mute-rule*
	SCENARIO: CloudWatch-InsightRule	insight-rule*
	SCENARIO: CloudWatch-ServiceLevelObjective	slo*
	SCENARIO: CloudWatch-Dashboard	dashboard*
	SCENARIO: CloudWatch-Dataset	dataset*
	SCENARIO: CloudWatch-MetricStream	metric-stream*
	SCENARIO: CloudWatch-Service	service*
PutAlarmMuteRule	Grants permission to create or update an alarm mute rule	alarm	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutAlarmMuteRule	Grants permission to create or update an alarm mute rule	alarm-mute-rule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutAnomalyDetector	Grants permission to create or update an anomaly detection model for a CloudWatch metric			Write
PutCompositeAlarm	Grants permission to create or update a composite alarm	alarm*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys cloudwatch:AlarmActions	Write
PutDashboard	Grants permission to create a CloudWatch dashboard, or update an existing dashboard if it already exists	dashboard*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutInsightRule	Grants permission to create a new insight rule or replace an existing insight rule	insight-rule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys cloudwatch:requestInsightRuleLogGroups	Write
PutLogAlarm	Grants permission to create or update a log-based alarm and associate it with a CloudWatch Logs Insights scheduled query	alarm*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys cloudwatch:AlarmActions	Write
PutManagedInsightRules	Grants permission to create managed Insight Rules		aws:RequestTag/${TagKey} aws:TagKeys cloudwatch:requestManagedResourceARNs	Write
PutMetricAlarm	Grants permission to create or update an alarm and associates it with the specified Amazon CloudWatch metric	alarm*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys cloudwatch:AlarmActions	Write
PutMetricAlarm		dataset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys cloudwatch:AlarmActions	Write
PutMetricData	Grants permission to publish metric data points to Amazon CloudWatch using CloudWatch and OTLP formats	dataset	aws:ResourceTag/${TagKey} cloudwatch:namespace	Write
PutMetricStream	Grants permission to create a CloudWatch metric stream, or update an existing metric stream if it already exists	metric-stream*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
SetAlarmState	Grants permission to temporarily set the state of an alarm for testing purposes	alarm*	aws:ResourceTag/${TagKey}	Write
StartMetricStreams	Grants permission to start all CloudWatch metric streams that you specify	metric-stream*	aws:ResourceTag/${TagKey}	Write
StopMetricStreams	Grants permission to stop all CloudWatch metric streams that you specify	metric-stream*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add tags to an Amazon CloudWatch resource	alarm	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		alarm-mute-rule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		dashboard	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		dataset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		insight-rule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		metric-stream	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		service	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		slo	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
	SCENARIO: CloudWatch-Alarm	alarm*
	SCENARIO: CloudWatch-AlarmMuteRule	alarm-mute-rule*
	SCENARIO: CloudWatch-InsightRule	insight-rule*
	SCENARIO: CloudWatch-ServiceLevelObjective	slo*
	SCENARIO: CloudWatch-Dashboard	dashboard*
	SCENARIO: CloudWatch-Dataset	dataset*
	SCENARIO: CloudWatch-MetricStream	metric-stream*
	SCENARIO: CloudWatch-Service	service*
UntagResource	Grants permission to remove a tag from an Amazon CloudWatch resource	alarm	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		alarm-mute-rule	aws:ResourceTag/${TagKey} aws:TagKeys
		dashboard	aws:ResourceTag/${TagKey} aws:TagKeys
		dataset	aws:ResourceTag/${TagKey} aws:TagKeys
		insight-rule	aws:ResourceTag/${TagKey} aws:TagKeys
		metric-stream	aws:ResourceTag/${TagKey} aws:TagKeys
		service	aws:ResourceTag/${TagKey} aws:TagKeys
		slo	aws:ResourceTag/${TagKey} aws:TagKeys
	SCENARIO: CloudWatch-Alarm	alarm*
	SCENARIO: CloudWatch-AlarmMuteRule	alarm-mute-rule*
	SCENARIO: CloudWatch-InsightRule	insight-rule*
	SCENARIO: CloudWatch-ServiceLevelObjective	slo*
	SCENARIO: CloudWatch-Dashboard	dashboard*
	SCENARIO: CloudWatch-Dataset	dataset*
	SCENARIO: CloudWatch-MetricStream	metric-stream*
	SCENARIO: CloudWatch-Service	service*
UpdateServiceLevelObjective	Grants permission to update a service level objective	slo*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon CloudWatch

The following actions are defined by Amazon CloudWatch but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CallWithBearerToken	Grants permission to make API calls to CloudWatch using bearer token authentication			Write
DeletePipelineRule	Grants permission to delete a pipeline rule for CloudWatch pipelines for OTel metric processing	dataset*	aws:ResourceTag/${TagKey}	Write
GetOTelEnrichment	Grants permission to retrieve the status of OTel Enrichment of vended metrics for PromQL querying			Read
GetServiceData	Grants permission to retrieve service data	service*	aws:ResourceTag/${TagKey}	Read
GetTopologyDiscoveryStatus	Grants permission to retrieve a CloudWatch topology discovery status			Read
Link	Grants permission to share CloudWatch resources with a monitoring account			Write
ListEntitiesForMetric	Grants permission to retrieve all the entities that are emitting a given metric			List
PutPipelineRule	Grants permission to create or update a pipeline rule for CloudWatch pipelines for OTel metric processing	dataset*	aws:ResourceTag/${TagKey}	Write
StartOTelEnrichment	Grants permission to enable OTel Enrichment of vended metrics for PromQL querying			Write
StopOTelEnrichment	Grants permission to disable OTel Enrichment of vended metrics for PromQL querying			Write

Resource types defined by Amazon CloudWatch

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
alarm	arn:${Partition}:cloudwatch:${Region}:${Account}:alarm:${AlarmName}	aws:ResourceTag/${TagKey}
alarm-mute-rule	arn:${Partition}:cloudwatch:${Region}:${Account}:alarm-mute-rule:${AlarmMuteRuleName}	aws:ResourceTag/${TagKey}
dashboard	arn:${Partition}:cloudwatch::${Account}:dashboard/${DashboardName}	aws:ResourceTag/${TagKey}
dataset	arn:${Partition}:cloudwatch:${Region}:${Account}:dataset/${DatasetId}	aws:ResourceTag/${TagKey}
insight-rule	arn:${Partition}:cloudwatch:${Region}:${Account}:insight-rule/${InsightRuleName}	aws:ResourceTag/${TagKey}
metric-stream	arn:${Partition}:cloudwatch:${Region}:${Account}:metric-stream/${MetricStreamName}	aws:ResourceTag/${TagKey}
service	arn:${Partition}:cloudwatch:${Region}:${Account}:service/${ServiceName}-${UniqueAttributesHex}	aws:ResourceTag/${TagKey}
slo	arn:${Partition}:cloudwatch:${Region}:${Account}:slo/${SloName}	aws:ResourceTag/${TagKey}

Condition keys for Amazon CloudWatch

Amazon CloudWatch defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tags in the request	String
aws:ResourceTag/${TagKey}	Filters access by tags associated with the resource	String
aws:TagKeys	Filters access by the presence of tags in the request	ArrayOfString
cloudwatch:AlarmActions	Filters access by defined alarm actions	ArrayOfString
cloudwatch:namespace	Filters access by the presence of optional namespace values	String
cloudwatch:requestInsightRuleLogGroups	Filters access by the Log Groups specified in an Insight Rule	ArrayOfString
cloudwatch:requestManagedResourceARNs	Filters access by the Resource ARNs specified in a managed Insight Rule	ArrayOfARN

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon CloudFront (cloudfront)

Amazon CloudWatch Application Insights (applicationinsights)