AWS AmazonCloudWatch documentation change
Summary
Added two entries to document history: 1) Updated CloudWatchSyntheticsFullAccess policy with ListMetrics permission and restricted APIGateway permissions, 2) Updated AWSObservabilityAdminTelemetryEnablementServiceRolePolicy for new telemetry configurations.
Security assessment
The first update restricts APIGateway permissions from wildcard to specific resources, which follows the principle of least privilege and improves security posture. The second update documents policy changes for telemetry enablement. While these are security improvements, there's no evidence they address specific security incidents - they appear to be routine policy updates and enhancements.
Diff
diff --git a/AmazonCloudWatch/latest/monitoring/DocumentHistory.md b/AmazonCloudWatch/latest/monitoring/DocumentHistory.md index fcc93ccf9..6dd42ab66 100644 --- a//AmazonCloudWatch/latest/monitoring/DocumentHistory.md +++ b//AmazonCloudWatch/latest/monitoring/DocumentHistory.md @@ -10,0 +11,2 @@ Change| Description| Date +Updated CloudWatchSyntheticsFullAccess managed policy| The `cloudwatch:ListMetrics` permission was added to the **CloudWatchSyntheticsFullAccess** policy. Additionally, the `apigateway:GET` permission has been changed from allowing all resources to specific API Gateway resources: REST APIs, REST API stages, REST API stage Swagger exports, and HTTP APIs. For more information, see [CloudWatchSyntheticsFullAccess](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/managed-policies-cloudwatch.html#managed-policies-cloudwatch-CloudWatchSyntheticsFullAccess).| March 31, 2026 +Updated AWSObservabilityAdminTelemetryEnablementServiceRolePolicy policy| CloudWatch updated the **AWSObservabilityAdminTelemetryEnablementServiceRolePolicy** that grants CloudWatch the permissions necessary to enable and manage telemetry configurations for the newly supported AWS resources based on telemetry rules. For more information, see [AWSObservabilityAdminTelemetryEnablementServiceRolePolicy](https://docs.aws.amazon.com/AmazonCloudWatch/latest/monitoring/using-service-linked-roles.html#service-linked-role-telemetry-enablement).| March 31, 2026