logs:CreateLogGroup
Literal appearances in AWS managed IAM policies. Statements that use wildcards (for example s3:*) are not counted here. This is not an IAM authorization simulation.
Policies (any)
141
Allow (Action)
141
Deny (Action)
0
NotAction
2
Index generated 4/7/2026, 3:29:24 AM. 559 policies include at least one wildcard action string (any service).
Action reference
SAR-style (unofficial)Service: Amazon CloudWatch Logs
Access level
WriteDescription
Grants permission to create a new log group with the specified name
Resource types
- log-group*
Allow (Action)
- AWSAppSyncPushToCloudWatchLogs
- AWSApplicationMigrationNetworkMigrationMultiAccount
- AWSBatchServiceRole
- AWSChatbotServiceLinkedRolePolicy
- AWSCleanRoomsFullAccess
- AWSCleanRoomsFullAccessNoQuerying
- AWSCloudFrontLogger
- AWSCloudTrailFullAccess
- AWSCloudTrail_FullAccess
- AWSConfigServiceRolePolicy
- AWSControlTowerServiceRolePolicy
- AWSDataSyncDiscoveryServiceRolePolicy
- AWSDataSyncFullAccess
- AWSDataSyncServiceRolePolicy
- AWSDeepLensLambdaFunctionAccessPolicy
- AWSDeepRacerRoboMakerAccessPolicy
- AWSDeepRacerServiceRolePolicy
- AWSElasticBeanstalkCustomPlatformforEC2Role
- AWSElasticBeanstalkManagedUpdatesCustomerRolePolicy
- AWSElasticBeanstalkManagedUpdatesServiceRolePolicy
- AWSElasticBeanstalkRoleCWL
- AWSElasticBeanstalkService
- AWSGlueDataBrewServiceRole
- AWSGlueServiceRole
- AWSIoTLogging
- AWSIoTManagedIntegrationsRolePolicy
- AWSIoTWirelessLogging
- AWSLambdaBasicDurableExecutionRolePolicy
- AWSLambdaBasicExecutionRole
- AWSLambdaDynamoDBExecutionRole
- AWSLambdaKinesisExecutionRole
- AWSLambdaMSKExecutionRole
- AWSLambdaSQSQueueExecutionRole
- AWSLambdaVPCAccessExecutionRole
- AWSMediaTailorServiceRolePolicy
- AWSObservabilityAdminLogsCentralizationServiceRolePolicy
- AWSObservabilityAdminTelemetryEnablementServiceRolePolicy
- AWSOpsWorksCloudWatchLogs
- AWSPanoramaApplianceRolePolicy
- AWSPanoramaApplianceServiceRolePolicy
- AWSPanoramaGreengrassGroupRolePolicy
- AWSProtonCodeBuildProvisioningBasicAccess
- AWSQuickSetupPatchPolicyDeploymentRolePolicy
- AWSQuickSetupPatchPolicyPermissionsBoundary
- AWSRefactoringToolkitFullAccess
- AWSServiceRoleForImageBuilder
- AWSServiceRoleForIoTSiteWise
- AWSServiceRoleForNeptuneGraphPolicy
- AWSThinkboxAWSPortalAdminPolicy
- AWSThinkboxAWSPortalGatewayPolicy
- AWSThinkboxAWSPortalWorkerPolicy
- AWSThinkboxDeadlineResourceTrackerAccessPolicy
- AWSTransferLoggingAccess
- AWSTransformApplicationECSDeploymentPolicy
- AWS_ConfigRole
- AdministratorAccess-AWSElasticBeanstalk
- AdministratorAccess-Amplify
- AlexaForBusinessGatewayExecution
- AmazonAPIGatewayPushToCloudWatchLogs
- AmazonApplicationWizardFullaccess
- AmazonBedrockStudioPermissionsBoundary
- AmazonBraketFullAccess
- AmazonBraketJobsExecutionPolicy
- AmazonBraketServiceRolePolicy
- AmazonChimeFullAccess
- AmazonCloudWatchRUMFullAccess
- AmazonConnectFullAccess
- AmazonConnect_FullAccess
- AmazonDMSCloudWatchLogsRole
- AmazonDataZoneProjectDeploymentPermissionsBoundary
- AmazonDataZoneRedshiftGlueProvisioningPolicy
- AmazonDataZoneSageMakerEnvironmentRolePermissionsBoundary
- AmazonEC2RoleforSSM
- AmazonECSInfrastructureRoleforExpressGatewayServices
- AmazonECSServiceRolePolicy
- AmazonECS_FullAccess
- AmazonEKSLocalOutpostClusterPolicy
- AmazonEKSServicePolicy
- AmazonEKSServiceRolePolicy
- AmazonElasticFileSystemsUtils
- AmazonFSxFullAccess
- AmazonGuardDutyMalwareProtectionServiceRolePolicy
- AmazonLaunchWizardFullAccessV2
- AmazonLaunchWizardFullaccess
- AmazonLaunchWizard_Fullaccess
- AmazonMQApiFullAccess
- AmazonMQFullAccess
- AmazonMQServiceRolePolicy
- AmazonMWAAServiceRolePolicy
- AmazonMacieServiceRolePolicy
- AmazonManagedBlockchainServiceRolePolicy
- AmazonMonitronFullAccess
- AmazonRDSBetaServiceRolePolicy
- AmazonRDSCustomInstanceProfileRolePolicy
- AmazonRDSEnhancedMonitoringRole
- AmazonRDSPreviewServiceRolePolicy
- AmazonRDSServiceRolePolicy
- AmazonRedshiftAllCommandsFullAccess
- AmazonRedshiftServiceLinkedRolePolicy
- AmazonS3ObjectLambdaExecutionRolePolicy
- AmazonSNSRole
- AmazonSageMakerAdmin-ServiceCatalogProductsServiceRolePolicy
- AmazonSageMakerCanvasDataPrepFullAccess
- AmazonSageMakerCanvasFullAccess
- AmazonSageMakerClusterInstanceRolePolicy
- AmazonSageMakerFullAccess
- AmazonSageMakerGroundTruthExecution
- AmazonSageMakerHyperPodInferenceAccess
- AmazonSageMakerHyperPodServiceRolePolicy
- AmazonSageMakerServiceCatalogProductsApiGatewayServiceRolePolicy
- AmazonSageMakerServiceCatalogProductsCodeBuildServiceRolePolicy
- AmazonSageMakerServiceCatalogProductsGlueServiceRolePolicy
- AmazonSageMakerServiceCatalogProductsLambdaServiceRolePolicy
- AmazonSecurityLakeMetastoreManager
- AmazonWorkMailEventsServiceRolePolicy
- AmazonWorkMailFullAccess
- AppRunnerServiceRolePolicy
- AppStudioServiceRolePolicy
- ApplicationDiscoveryServiceContinuousExportServiceRolePolicy
- AwsGlueSessionUserRestrictedNotebookServiceRole
- AwsGlueSessionUserRestrictedServiceRole
- BatchServiceRolePolicy
- BedrockAgentCoreFullAccess
- CloudHSMServiceRolePolicy
- CloudWatchAgentAdminPolicy
- CloudWatchAgentServerPolicy
- CloudWatchInternetMonitorServiceRolePolicy
- CloudWatchLambdaApplicationSignalsExecutionRolePolicy
- CloudWatchLambdaInsightsExecutionRolePolicy
- EC2InstanceProfileForImageBuilder
- EC2InstanceProfileForImageBuilderECRContainerBuilds
- GameLiftContainerFleetPolicy
- MediaPackageServiceRolePolicy
- MonitronServiceRolePolicy
- QBusinessServiceRolePolicy
- SageMakerStudioAdminIAMDefaultExecutionPolicy
- SageMakerStudioProjectProvisioningRolePolicy
- SageMakerStudioProjectRoleMachineLearningPolicy
- SageMakerStudioProjectUserRolePermissionsBoundary
- SageMakerStudioProjectUserRolePolicy
- SageMakerStudioUserIAMDefaultExecutionPolicy
Deny (Action)
None
Thanks to Ian McKay for iam-dataset (MIT), structured data derived from the AWS Service Authorization Reference. Not maintained by AWS and not guaranteed current. IAMTrail's managed policy archive is separate.
Definitions bundle generated 4/7/2026, 3:29:24 AM