IAM / monitoring / cloudwatch

AWS CloudWatch (IAM)

JSON →
AWScloudwatchmonitoring

Amazon CloudWatch monitors AWS resources and applications, providing metrics, logs, and alarms.

iamaws
docs ↗
Permissions
Actions in this service
cloudwatch:PutMetricData
cloudwatch:GetMetricData
cloudwatch:ListMetrics
cloudwatch:DescribeAlarms
cloudwatch:PutMetricAlarm
cloudwatch:DeleteAlarms
cloudwatch:GetDashboard
cloudwatch:PutDashboard
Policy
Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "cloudwatch:PutMetricData", "cloudwatch:GetMetricData", "cloudwatch:ListMetrics", "cloudwatch:DescribeAlarms", "cloudwatch:PutMetricAlarm", "cloudwatch:DeleteAlarms", "cloudwatch:GetDashboard", "cloudwatch:PutDashboard" ], "Resource": "*" } ] }
SDK mapping
Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns
Known gotchas
Avoid cloudwatch:* — grants full control including deletion of alarms and dashboards.
Avoid cloudwatch:PutMetricData without conditions — can cause high costs from excessive data.
Resources
docshttps://servicereference.us-east-1.amazonaws.com/v1/cloudwatch/cloudwatch.json ↗