Amazon CloudWatch (cloudwatch)

Additions

Actions

• GetDataset
  
  • Description:  Grants permission to get a dataset
  • Access:  Read
  • Resources: 

    Name: dataset

    Required: Yes

  • Conditions: 

    aws:ResourceTag/${TagKey}

• PutLogAlarm
  
  • Description:  Grants permission to create or update a log-based alarm and associate it with a CloudWatch Logs Insights scheduled query
  • Access:  Write
  • Resources: 

    Name: alarm

    Required: Yes

  • Conditions: 

    aws:RequestTag/${TagKey}

    aws:TagKeys

    cloudwatch:AlarmActions

  • Dependents: 

    iam:PassRole

    logs:CreateScheduledQuery

    logs:DeleteScheduledQuery

    logs:GetScheduledQuery

    logs:UpdateScheduledQuery

Resources

• dataset
  
  • Arn:  arn:${Partition}:cloudwatch:${Region}:${Account}:dataset/${DatasetId}
  • Conditions: 

    aws:ResourceTag/${TagKey}

Updates

Actions

• PutMetricStream
  
  Conditions
  
  • ＋ aws:ResourceTag/${TagKey}
  Resources
  
  • ＋ dataset
• SetAlarmState
  
  Conditions
  
  • ＋ aws:ResourceTag/${TagKey}
  Resources
  
  • ＋ dataset
• UpdateServiceLevelObjective
  
  Conditions
  
  • ＋ aws:ResourceTag/${TagKey}
  Resources
  
  • ＋ dataset
  • ＋ metric-stream
  • ＋ service
• DeleteAlarms
  
  Dependents
  
  • ＋ logs:CreateScheduledQuery
  • ＋ logs:DeleteScheduledQuery
  • ＋ logs:GetScheduledQuery
• GetMetricStatistics
  
  Resources
  
  • ＋ dataset
  Conditions
  
  • ＋ aws:ResourceTag/${TagKey}
• ListServiceLevelObjectives
  
  Resources
  
  • ＋ dataset
  Conditions
  
  • ＋ aws:ResourceTag/${TagKey}
• PutAlarmMuteRule
  
  Resources
  
  • ＋ dataset
  • ＋ metric-stream
  • ＋ service
  Conditions
  
  • ＋ aws:ResourceTag/${TagKey}