AWS AmazonCloudWatch documentation change
Summary
Updated required IAM permissions for CloudWatch Logs agent to include DescribeLogGroups and PutRetentionPolicy. Modified section titles related to agent management.
Security assessment
The change adds documentation about required IAM permissions (including PutRetentionPolicy which controls log retention periods), improving security posture guidance. No specific vulnerability is addressed, but it enhances security documentation.
Diff
diff --git a/AmazonCloudWatch/latest/logs/AgentReference.md b/AmazonCloudWatch/latest/logs/AgentReference.md index aafa94504..3993cb5ae 100644 --- a//AmazonCloudWatch/latest/logs/AgentReference.md +++ b//AmazonCloudWatch/latest/logs/AgentReference.md @@ -364 +364 @@ Configuring multiple log sources to send data to a single log stream is not supp -The CloudWatch Logs agent requires the `CreateLogGroup`, `CreateLogStream`, `DescribeLogStreams`, and `PutLogEvents` operations. If you're using the latest agent, `DescribeLogStreams` is not needed. See the sample IAM policy below. +The CloudWatch Logs agent requires permission to perform `CreateLogGroup`, `CreateLogStream`, `DescribeLogStreams`, `DescribeLogGrooupd`, `PutLogEvents` and `PutRetentionPolicy` actions. If you're using the latest agent, `DescribeLogStreams` is not needed. See the sample IAM policy below. @@ -412 +412 @@ To use the Amazon Web Services Documentation, Javascript must be enabled. Please -Logging API and console operations with AWS CloudTrail +Stop the CloudWatch Logs agent @@ -414 +414 @@ Logging API and console operations with AWS CloudTrail -Monitoring usage with CloudWatch metrics +Quick Start with AWS CloudFormation