AWS AmazonCloudWatch medium security documentation change

Service: AmazonCloudWatch · 2025-11-22 · Security-related medium

File: AmazonCloudWatch/latest/monitoring/using-service-linked-roles.md

Summary

Added resource-explorer-2 and cloudtrail permissions to AWSServiceRoleForCloudWatchApplicationSignals policy and updated changelog

Security assessment

Added cloudtrail:CreateServiceLinkedChannel enables security auditing capabilities. Resource Explorer access improves security visibility. Directly expands security monitoring features.

Diff

diff --git a/AmazonCloudWatch/latest/monitoring/using-service-linked-roles.md b/AmazonCloudWatch/latest/monitoring/using-service-linked-roles.md
index ba6a9c3b8..41d0b6e4c 100644
--- a//AmazonCloudWatch/latest/monitoring/using-service-linked-roles.md
+++ b//AmazonCloudWatch/latest/monitoring/using-service-linked-roles.md
@@ -357,0 +358,4 @@ The **AWSServiceRoleForCloudWatchApplicationSignals** has an IAM policy attached
+  * `resource-explorer-2` – Retrieve current AWS resources information from AWS Resource Explorer.
+
+  * `cloudtrail` – Enable creation of service-linked channels for retrieving CloudTrail events.
+
@@ -561 +565 @@ The **AWSObservabilityAdminLogsCentralizationServiceRolePolicy** service-linked
-`logs:CreateLogGroup`
+  * `logs:CreateLogGroup`
@@ -563 +567 @@ The **AWSObservabilityAdminLogsCentralizationServiceRolePolicy** service-linked
-`logs:CreateLogStream`
+  * `logs:CreateLogStream`
@@ -565 +569 @@ The **AWSObservabilityAdminLogsCentralizationServiceRolePolicy** service-linked
-`logs:PutLogEvents`
+  * `logs:PutLogEvents`
@@ -567 +571 @@ The **AWSObservabilityAdminLogsCentralizationServiceRolePolicy** service-linked
-`kms:Encrypt`
+  * `kms:Encrypt`
@@ -569 +573 @@ The **AWSObservabilityAdminLogsCentralizationServiceRolePolicy** service-linked
-`kms:Decrypt`
+  * `kms:Decrypt`
@@ -571 +575 @@ The **AWSObservabilityAdminLogsCentralizationServiceRolePolicy** service-linked
-`kms:GenerateDataKey`
+  * `kms:GenerateDataKey`
@@ -736,0 +741 @@ Change | Description | Date
+AWSServiceRoleForCloudWatchApplicationSignals – Update to permissions of service-linked role policy |  Updated the [CloudWatchApplicationSignalsServiceRolePolicy](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/using-service-linked-roles.html#service-linked-role-signals) to include `resource-explorer-2:Search` and `cloudtrail:CreateServiceLinkedChannel` to enable new Application Signals features.  | November 12, 2025