AWS AmazonCloudWatch high security documentation change
Summary
Removed security notice about upcoming permission requirements for CloudWatch Logs Insights queries and added natural language query generation documentation
Security assessment
The removed section explicitly addressed security permissions (requiring both logs:StartQuery and logs:GetQueryResults) for console access. Removing this warning could indicate a policy change affecting access control requirements, potentially weakening security posture if users aren't aware of required permissions.
Diff
diff --git a/AmazonCloudWatch/latest/logs/AnalyzingLogData.md b/AmazonCloudWatch/latest/logs/AnalyzingLogData.md index 891e7d16a..0777429a8 100644 --- a//AmazonCloudWatch/latest/logs/AnalyzingLogData.md +++ b//AmazonCloudWatch/latest/logs/AnalyzingLogData.md @@ -24,8 +23,0 @@ When you use either SQL or PPL commands, make sure to enclose fields with specia -###### Important - -To enhance security for CloudWatch Logs Insights queries, beginning on July 31, 2025 users must be signed on with both the `logs:StartQuery` and `logs:GetQueryResults` permissions to be able to run queries in the CloudWatch console. After this date, users who don't have both of these permissions won't be able to view query results in the console, and will instead see a banner message when attempting to view query results in the console. - -After the change, the required console experience permissions will be consistent with the current required permissions for SDK and AWS CLI users who use the StartQuery and GetQueryResults APIs. - -For information about how to create IAM policies or to add permissions to existing policies, see [Define custom IAM permissions with customer managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_create.html) and [Edit IAM policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-edit.html) in the IAM User Guide. - @@ -49,0 +42 @@ The `filterIndex` command is available only in Logs Insights QL. + * [Query generation using natural language](./CloudWatchLogs-Insights-Query-Assist.html) lets you use natural language to create CloudWatch Logs Insights queries. You can ask questions about or describe the data you're looking for, then the AI generates a query based on your prompt and provides a line-by-line explanation of how the query works. @@ -53 +45,0 @@ The `filterIndex` command is available only in Logs Insights QL. -The following CloudWatch Logs Insights features are supported only when you use Logs Insights QL. @@ -55 +47 @@ The following CloudWatch Logs Insights features are supported only when you use - * [Query generation using natural language.](./CloudWatchLogs-Insights-Query-Assist.html) +The following CloudWatch Logs Insights features are supported only when you use Logs Insights QL.