AWS AmazonCloudWatch documentation change
Summary
Removed detailed permissions and policy statements from AmazonCloudWatchRUMReadOnlyAccess policy documentation, including synthetics, cloudwatch metrics/alarms/logs, x-ray, and rum tag permissions. Simplified policy JSON structure.
Security assessment
The changes remove granular permission descriptions and simplify the policy structure but do not explicitly reference security vulnerabilities or remediation. This appears to be documentation cleanup rather than addressing a specific security issue.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.md b/AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.md index 55992d5a0..e6c7de96d 100644 --- a//AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.md +++ b//AmazonCloudWatch/latest/monitoring/auth-and-access-control-cw.md @@ -3288,15 +3287,0 @@ The **AmazonCloudWatchRUMReadOnlyAccess** allows read-only administrative access - * The `synthetics` permission allows displaying associated Synthetics Canaries to the RUM app monitor - - * The `cloudwatch` permission allows displaying associated CloudWatch metrics to the RUM app monitor - - * The `cloudwatch alarms` permission allows displaying associated CloudWatch alarms to the RUM app monitor - - * The `cloudwatch logs` permission allows displaying associated CloudWatch logs to the RUM app monitor - - * The `x-ray` permission allows displaying associated X-Ray Trace segments to the RUM app monitor - - * The `rum` permission allows displaying associated tags to the RUM app monitor - - - - @@ -3308 +3293,2 @@ The following are the contents of the **AmazonCloudWatchRUMReadOnlyAccess** poli - "Statement": [{ + "Statement": [ + { @@ -3316,38 +3302 @@ The following are the contents of the **AmazonCloudWatchRUMReadOnlyAccess** poli - "rum:GetResourcePolicy", - "rum:ListTagsForResource" - ], - "Resource": "*" - }, - { - "Effect": "Allow", - "Action": [ - "synthetics:describeCanariesLastRun", - "synthetics:describeCanaries" - ], - "Resource": "arn:aws:synthetics:*:*:canary:*" - }, - { - "Effect": "Allow", - "Action": [ - "cloudwatch:GetMetricData" - ], - "Resource": "*" - }, - { - "Effect": "Allow", - "Action": [ - "cloudwatch:DescribeAlarms" - ], - "Resource": "arn:aws:cloudwatch:*:*:alarm:*" - }, - { - "Effect": "Allow", - "Action": [ - "logs:DescribeLogGroups" - ], - "Resource": "arn:aws:logs:*:*:log-group::log-stream:*" - }, - { - "Effect": "Allow", - "Action": [ - "xray:GetTraceSummaries" + "rum:GetResourcePolicy" @@ -3638 +3586,0 @@ Change | Description | Date -AmazonCloudWatchRUMReadOnlyAccess – Updated policy | CloudWatch added permissions to the **AmazonCloudWatchRUMReadOnlyAccess** policy. The `synthetics: describeCanaries` and `synthetics:describeCanariesLastRun` was added so that CloudWatch RUM can display associated Synthetics Canaries to the RUM app monitor. The `cloudwatch:GetMetricData` was added so that CloudWatch RUM can display associated CloudWatch metrics to the RUM app monitor. The `cloudwatch:DescribeAlarms` was added so that CloudWatch RUM can display associated CloudWatch alarms to the RUM app monitor. The `logs:DescribeLogGroups` was added so that CloudWatch RUM can display associated CloudWatch logs to the RUM app monitor. The `xray:GetTraceSummaries` was added so that CloudWatch RUM can display associated X-Ray Trace segments to the RUM app monitor. The `rum:ListTagsForResources` was added so that CloudWatch RUM can display associated tags to the RUM app monitor. | June 28, 2025