IAM / monitoring / logs

AWS CloudWatch Logs (IAM)

JSON →

AWSlogsmonitoring

Amazon CloudWatch Logs centralizes logs from AWS services and applications for monitoring and troubleshooting.

iamaws

docs ↗

Permissions

Actions in this service

logs:CreateLogGroup

logs:DeleteLogGroup

logs:CreateLogStream

logs:DeleteLogStream

logs:PutLogEvents

logs:GetLogEvents

logs:StartQuery

logs:StopQuery

Policy

Minimal privilege example

Copy-paste least-privilege policy statement — not yet harness-verified.

{ "Version": "2012-10-17", "Statement": [ { "Effect": "Allow", "Action": [ "logs:CreateLogGroup", "logs:DeleteLogGroup", "logs:CreateLogStream", "logs:DeleteLogStream", "logs:PutLogEvents", "logs:GetLogEvents", "logs:StartQuery", "logs:StopQuery" ], "Resource": "*" } ] }

SDK mapping

Method → permission

SDK method mapping (e.g. boto3.get_object() → s3:GetObject) is not yet collected.

Footguns

Known gotchas

Avoid logs:* — grants full control including deletion of log groups and streams.

Avoid logs:PutLogEvents without conditions — can lead to excessive log ingestion costs.

Resources

docshttps://servicereference.us-east-1.amazonaws.com/v1/logs/logs.json ↗