AWS network-firewall documentation change

Service: network-firewall · 2025-06-07 · Documentation low

File: network-firewall/latest/developerguide/logging-cw-logs.md

Summary

Added documentation for CloudWatch log metrics permissions required for detailed monitoring dashboard, including IAM policy examples and cost warnings

Security assessment

The changes add documentation about required IAM permissions (including logs:StartQuery and logs:GetQueryResults) for monitoring features. While this relates to access control configuration, there is no evidence of addressing a specific security vulnerability. The changes improve security documentation by clarifying permission requirements.

Diff

diff --git a/network-firewall/latest/developerguide/logging-cw-logs.md b/network-firewall/latest/developerguide/logging-cw-logs.md
index 642c98f99..0b2d2c78b 100644
--- a//network-firewall/latest/developerguide/logging-cw-logs.md
+++ b//network-firewall/latest/developerguide/logging-cw-logs.md
@@ -5 +5 @@
-Permissions to publish logs to CloudWatch Logs 
+Permissions to publish logs to CloudWatch Logs(Optional) Permissions to access CloudWatch log metrics in Network Firewall
@@ -43 +43 @@ The following shows the log stream for TLS logging for the example firewall `tes
-You must have the following permissions settings to configure your firewall to send logs to a CloudWatch Logs log group. 
+You must have the following permissions settings to configure your firewall to send logs to a CloudWatch Logs log group and to access log metrics in Network Firewall.
@@ -77,0 +78,66 @@ You must have the following permissions settings to configure your firewall to s
+###### Important
+
+Additional fees are incurred when Network Firewall queries CloudWatch to fetch log data for the detailed monitoring dashboard. For best practices to minimize additional cost, see [Working with the firewall monitoring dashboard](./nwfw-using-dashboard.html).
+
+## (Optional) Permissions to access CloudWatch log metrics in Network Firewall
+
+You must have the following permissions settings added to your existing CloudWatch permissions to configure your firewall to query CloudWatch logs for the detailed monitoring dashboard.
+
+###### Important
+
+Additional fees are incurred when querying logs, whether through CloudWatch Logs or through Amazon Athena for logs stored in S3. For best practices to minimize additional cost, see [Working with the firewall monitoring dashboard](./nwfw-using-dashboard.html).
+    
+    
+    {
+                "Effect": "Allow",
+                "Action": [
+                    "logs:StartQuery",
+                    "logs:GetQueryResults"
+                ],
+                "Resource": "CloudWatch Logs log group ARN"
+            }
+
+The following view shows both standard CloudWatch permissions and the additional permissions needed for detailed monitoring.
+    
+    
+    {
+        "Version": "2012-10-17",
+        "Statement": [
+            {
+                "Action": [
+                    "logs:CreateLogDelivery",
+                    "logs:GetLogDelivery",
+                    "logs:UpdateLogDelivery",
+                    "logs:DeleteLogDelivery",
+                    "logs:ListLogDeliveries"
+                ],
+                "Resource": [
+                    "*"
+                ],
+                "Effect": "Allow",
+                "Sid": "FirewallLogging"
+            },
+            {
+                "Sid": "FirewallLoggingCWL",
+                "Action": [
+                    "logs:PutResourcePolicy",
+                    "logs:DescribeResourcePolicies",
+                    "logs:DescribeLogGroups",
+                ],
+                "Resource": [
+                    "CloudWatch Logs log group ARN"
+                ],
+                "Effect": "Allow"
+            },
+            {
+                "Sid": "FirewallLoggingSearch",
+                "Effect": "Allow",
+                "Action": [
+                    "logs:StartQuery",
+                    "logs:GetQueryResults"
+                ],
+                "Resource": "*"
+            }
+        ]
+    }
+