AWS AmazonCloudWatch: Add aws:SourceAccount condition to resource policy

Service: AmazonCloudWatch · 2026-09-27 · Documentation medium

File: AmazonCloudWatch/latest/monitoring/broadcom-carbonblack-source-config.md · Type: iam

Summary

Adds a StringEquals aws:SourceAccount condition to the resource policy example, restricting access to the specified AWS account.

Security assessment

Adding an aws:SourceAccount condition to a resource policy is a confused-deputy prevention best practice that scopes which account can invoke the resource, tightening authorization.

Evidence

+                        "aws:SourceAccount": "<aws-account-number>"

Diff

diff --git a/AmazonCloudWatch/latest/monitoring/broadcom-carbonblack-source-config.md b/AmazonCloudWatch/latest/monitoring/broadcom-carbonblack-source-config.md
index cbbca23c6..efcceee1a 100644
--- a//AmazonCloudWatch/latest/monitoring/broadcom-carbonblack-source-config.md
+++ b//AmazonCloudWatch/latest/monitoring/broadcom-carbonblack-source-config.md
@@ -110,0 +111,3 @@ Asia Pacific (Sydney) ap-southeast-2 | `arn:aws:iam::132308400445:role/mcs-psc-p
+                    },
+                    "StringEquals": {
+                        "aws:SourceAccount": "<aws-account-number>"