AWS AmazonCloudWatch documentation change

Service: AmazonCloudWatch · 2025-06-16 · Documentation low

File: AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.md

Summary

Expanded AmazonCloudWatchRUMReadOnlyAccess policy permissions to include synthetics, cloudwatch metrics/alarms/logs, X-Ray, and tags access

Security assessment

Adds documentation about expanded IAM policy permissions but does not address a specific security vulnerability. The changes enhance read-only access for monitoring integration purposes without evidence of fixing a security flaw.

Diff

diff --git a/AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.md b/AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.md
index e6c7de96d..55992d5a0 100644
--- a//AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.md
+++ b//AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.md
@@ -3287,0 +3288,15 @@ The **AmazonCloudWatchRUMReadOnlyAccess** allows read-only administrative access
+  * The `synthetics` permission allows displaying associated Synthetics Canaries to the RUM app monitor
+
+  * The `cloudwatch` permission allows displaying associated CloudWatch metrics to the RUM app monitor
+
+  * The `cloudwatch alarms` permission allows displaying associated CloudWatch alarms to the RUM app monitor 
+
+  * The `cloudwatch logs` permission allows displaying associated CloudWatch logs to the RUM app monitor 
+
+  * The `x-ray` permission allows displaying associated X-Ray Trace segments to the RUM app monitor 
+
+  * The `rum` permission allows displaying associated tags to the RUM app monitor 
+
+
+
+
@@ -3293,2 +3308 @@ The following are the contents of the **AmazonCloudWatchRUMReadOnlyAccess** poli
-    	"Statement": [
-    		{
+        "Statement": [{
@@ -3302 +3316,38 @@ The following are the contents of the **AmazonCloudWatchRUMReadOnlyAccess** poli
-    				"rum:GetResourcePolicy"
+                    "rum:GetResourcePolicy",
+                    "rum:ListTagsForResource"
+                ],
+                "Resource": "*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "synthetics:describeCanariesLastRun",
+                    "synthetics:describeCanaries"
+                ],
+                "Resource": "arn:aws:synthetics:*:*:canary:*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "cloudwatch:GetMetricData"
+                ],
+                "Resource": "*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "cloudwatch:DescribeAlarms"
+                ],
+                "Resource": "arn:aws:cloudwatch:*:*:alarm:*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "logs:DescribeLogGroups"
+                ],
+                "Resource": "arn:aws:logs:*:*:log-group::log-stream:*"
+            },
+            {
+                "Effect": "Allow",
+                "Action": [
+                    "xray:GetTraceSummaries"
@@ -3586,0 +3638 @@ Change | Description | Date
+AmazonCloudWatchRUMReadOnlyAccess – Updated policy |  CloudWatch added permissions to the **AmazonCloudWatchRUMReadOnlyAccess** policy. The `synthetics: describeCanaries` and `synthetics:describeCanariesLastRun` was added so that CloudWatch RUM can display associated Synthetics Canaries to the RUM app monitor. The `cloudwatch:GetMetricData` was added so that CloudWatch RUM can display associated CloudWatch metrics to the RUM app monitor. The `cloudwatch:DescribeAlarms` was added so that CloudWatch RUM can display associated CloudWatch alarms to the RUM app monitor. The `logs:DescribeLogGroups` was added so that CloudWatch RUM can display associated CloudWatch logs to the RUM app monitor. The `xray:GetTraceSummaries` was added so that CloudWatch RUM can display associated X-Ray Trace segments to the RUM app monitor. The `rum:ListTagsForResources` was added so that CloudWatch RUM can display associated tags to the RUM app monitor. | June 28, 2025