AWS devopsagent documentation change

Service: devopsagent · 2026-02-28 · Documentation low

File: devopsagent/latest/userguide/aws-devops-agent-security-devops-agent-iam-permissions.md

Summary

Added AWS managed policies section with service role policy for CloudWatch metrics

Security assessment

Documents IAM policies and security best practices for telemetry collection

Diff

diff --git a/devopsagent/latest/userguide/aws-devops-agent-security-devops-agent-iam-permissions.md b/devopsagent/latest/userguide/aws-devops-agent-security-devops-agent-iam-permissions.md
index e7c63083f..ef98168aa 100644
--- a//devopsagent/latest/userguide/aws-devops-agent-security-devops-agent-iam-permissions.md
+++ b//devopsagent/latest/userguide/aws-devops-agent-security-devops-agent-iam-permissions.md
@@ -5 +5 @@
-Agent Space management actionsInvestigation and execution actionsTopology and discovery actionsPrevention and recommendation actionsBacklog task management actionsKnowledge management actionsAWS Support integration actionsUsage and monitoring actionsCommon IAM policy examples
+Agent Space management actionsInvestigation and execution actionsTopology and discovery actionsPrevention and recommendation actionsBacklog task management actionsKnowledge management actionsAWS Support integration actionsUsage and monitoring actionsCommon IAM policy examplesAWS Managed policies for AWS DevOps Agent
@@ -199,0 +200,32 @@ This policy grants view-only access to investigations and recommendations:
+## AWS Managed policies for AWS DevOps Agent
+
+AWS addresses many common use cases by providing standalone IAM policies that are created and administered by AWS. These AWS managed policies grant necessary permissions for common use cases so that you can avoid having to investigate what permissions are needed. For more information, see [AWS managed policies](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies) in the IAM User Guide.
+
+The following AWS managed policies, which you can attach to users in your account, are specific to AWS DevOps Agent.
+
+### AWSServiceRoleForAIDevOpsPolicy
+
+This Service Linked Role provides AWS DevOps Agent ability to provide usage information.
+    
+    
+    {
+      "Version" : "2012-10-17",
+      "Statement" : [
+        {
+          "Sid" : "sid1",
+          "Effect" : "Allow",
+          "Action" : [
+            "cloudwatch:PutMetricData"
+          ],
+          "Resource" : "*",
+          "Condition" : {
+            "StringEquals" : {
+              "cloudwatch:namespace" : [
+                "AWS/AIDevOps"
+              ]
+            }
+          }
+        }
+      ]
+    }
+