AWSObservabilityAdminLogsCentralizationServiceRolePolicy
Last Modified
Mar 12, 2026
March 12, 2026 at 09:26 PM UTC
Version
v1
Total Versions
1
Created
Sep 15, 2025
Actions
6
Risk
no risk signalRead from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
IAM Access Analyzer (1)
- Warning / TYPE_MISMATCH
Use the operator type String instead of operator ARN for the condition key kms:EncryptionContext:aws:logs:arn. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"kms:Encrypt",
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"logs.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceTag/LogsManaged": "true"
},
"ArnLike": {
"kms:EncryptionContext:aws:logs:arn": "arn:aws:logs:*:*:log-group:*"
}
},
"Resource": "*"
}
]
},
"VersionId": "v1",
"IsDefaultVersion": true,
"CreateDate": "2025-09-15T14:34:06+00:00"
}
}Version History (2 recorded)
Raw historyAWSObservabilityAdminLogsCentralizationServiceRolePolicy - Policy Version v1
No recorded action delta - this version predates the change index. View the raw diff.
Mar 12, 2026
b8de839AWSObservabilityAdminLogsCentralizationServiceRolePolicy - Policy Version v1
No recorded action delta - this version predates the change index. View the raw diff.
Sep 15, 2025
8ba06ef