CloudWatchOmniSpaceAccessPolicy
Last Modified
Oct 14, 2026
October 14, 2026 at 11:03 PM UTC
Version
v2
Total Versions
2
Created
Oct 14, 2026
Actions
137
Risk
no risk signalRead from this policy document alone: trust policies, boundaries and SCPs in your account still decide what actually succeeds. How this is assessed
IAM Access Analyzer (1)
- Warning / POLICY_SIZE_EXCEEDS_IDENTITY_POLICY_QUOTA
The 10849 characters in the identity policy, excluding whitespace, exceed the 10240 character maximum for inline and managed policies. We recommend that you use multiple granular policies. AWS docs
Policy Document
View on GitHub{
"PolicyVersion": {
"Document": {
"Version": "2012-10-17",
"Statement": [
{
"Sid": "CloudWatchOmniSpaceAccessPermissions",
"Effect": "Allow",
"Action": [
"cloudwatch:UpdateSpace",
"cloudwatch:GetSpace",
"cloudwatch:ListSpaces",
"cloudwatch:GetDomain",
"cloudwatch:CreateAccessGrant",
"cloudwatch:GetAccessGrant",
"cloudwatch:ListAccessGrants",
"cloudwatch:DeleteAccessGrant",
"cloudwatch:SearchPrincipals",
"cloudwatch:StartTelemetryQuerySession",
"cloudwatch:StopTelemetryQuerySession",
"cloudwatch:ListTelemetryQuerySessions",
"cloudwatch:StopTelemetryQuery",
"cloudwatch:GetTelemetryQueryResults",
"cloudwatch:GetRecords",
"cloudwatch:GetMetricData",
"cloudwatch:ListMetrics",
"cloudwatch:GetContextGraph",
"cloudwatch:CreateAlert",
"cloudwatch:GetAlert",
"cloudwatch:UpdateAlert",
"cloudwatch:DeleteAlert",
"cloudwatch:ListAlerts",
"cloudwatch:CreateOmniDashboard",
"cloudwatch:GetOmniDashboard",
"cloudwatch:UpdateOmniDashboard",
"cloudwatch:DeleteOmniDashboard",
"cloudwatch:ListOmniDashboards",
"cloudwatch:CreateAccessProfile",
"cloudwatch:GetAccessProfile",
"cloudwatch:UpdateAccessProfile",
"cloudwatch:DeleteAccessProfile",
"cloudwatch:ListAccessProfiles",
"cloudwatch:AssumeAccessProfile",
"cloudwatch:CreateView",
"cloudwatch:GetView",
"cloudwatch:UpdateView",
"cloudwatch:DeleteView",
"cloudwatch:ListViews",
"cloudwatch:GetPreferences",
"cloudwatch:UpdatePreferences",
"cloudwatch:CreateOmniThread",
"cloudwatch:GetOmniThread",
"cloudwatch:UpdateOmniThread",
"cloudwatch:ListOmniThreads",
"cloudwatch:DeleteOmniThread",
"cloudwatch:StartOmniThreadSession",
"cloudwatch:SubmitFeedback",
"cloudwatch:CreateIntegration",
"cloudwatch:UpdateIntegration",
"cloudwatch:GetIntegration",
"cloudwatch:DeleteIntegration",
"cloudwatch:ListIntegrations",
"cloudwatch:InvokeIntegration",
"cloudwatch:GetIntelligenceConfiguration",
"cloudwatch:PutIntelligenceConfiguration",
"cloudwatch:TagResource",
"cloudwatch:UntagResource",
"cloudwatch:ListTagsForResource"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"cloudwatch:HasAccessGrant": "true"
}
}
},
{
"Sid": "DenyClassicCloudWatchResourceTagging",
"Effect": "Deny",
"Action": [
"cloudwatch:TagResource",
"cloudwatch:UntagResource",
"cloudwatch:ListTagsForResource"
],
"NotResource": [
"arn:aws:cloudwatch:*:*:space/*",
"arn:aws:cloudwatch:*:*:domain/*",
"arn:aws:cloudwatch:*:*:organization-domain/*",
"arn:aws:cloudwatch:*:*:access-grant/*",
"arn:aws:cloudwatch:*:*:organization-access-grant/*",
"arn:aws:cloudwatch:*:*:access-profile/*",
"arn:aws:cloudwatch:*:*:omni-dashboard/*",
"arn:aws:cloudwatch:*:*:alert/*",
"arn:aws:cloudwatch:*:*:view/*",
"arn:aws:cloudwatch:*:*:integration/*",
"arn:aws:cloudwatch:*:*:dataset/*"
]
},
{
"Sid": "AllowPassRoleForCloudWatchOmni",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": "arn:aws:iam::*:role/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"iam:PassedToService": [
"cloudwatch.amazonaws.com"
]
}
}
},
{
"Sid": "ListRolesAndUsers",
"Effect": "Allow",
"Action": [
"iam:ListUsers",
"iam:ListRoles",
"iam:GetRole",
"iam:ListAttachedRolePolicies"
],
"Resource": "*"
},
{
"Sid": "APIKeyConfigurationUsers",
"Effect": "Allow",
"Action": [
"iam:ListUserTags",
"iam:ListServiceSpecificCredentials"
],
"Resource": "arn:aws:iam::*:user/omni/OmniIngestionUser-*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "KmsListKeysForOmni",
"Effect": "Allow",
"Action": "kms:ListKeys",
"Resource": "*"
},
{
"Sid": "KmsDescribeKeyForOmni",
"Effect": "Allow",
"Action": "kms:DescribeKey",
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "KmsCryptoOpsForOmniSpaces",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudwatch.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/cw-omni": "true"
},
"StringLike": {
"kms:EncryptionContext:aws:cloudwatch:arn": "arn:aws:cloudwatch:*:${aws:PrincipalAccount}:space/*"
}
}
},
{
"Sid": "KmsCryptoOpsForDatasets",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudwatch.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
},
"StringLike": {
"kms:EncryptionContext:aws:cloudwatch:arn": "arn:aws:cloudwatch:*:${aws:PrincipalAccount}:dataset/*"
}
}
},
{
"Sid": "KmsCryptoOpsForOmniIntelligence",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudwatch.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/cw-omni": "true"
},
"StringLike": {
"kms:EncryptionContext:aws:cloudwatch:account": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "KmsCryptoOpsForOmniIntelligenceBranchKey",
"Effect": "Allow",
"Action": [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudwatch.amazonaws.com"
]
},
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/cw-omni": "true"
},
"StringLike": {
"kms:EncryptionContext:aws-crypto-ec:aws:cloudwatch:account": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "ConfigServiceLinkedRecorderManagement",
"Effect": "Allow",
"Action": [
"config:PutServiceLinkedConfigurationRecorder",
"config:DeleteServiceLinkedConfigurationRecorder"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"config:ConfigurationRecorderServicePrincipal": [
"cloudwatch.amazonaws.com"
]
}
}
},
{
"Sid": "DescribeConfigurationRecorder",
"Effect": "Allow",
"Action": [
"config:DescribeConfigurationRecorderStatus"
],
"Resource": "*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "AllowConfigServiceLinkedRoleCreation",
"Effect": "Allow",
"Action": "iam:CreateServiceLinkedRole",
"Resource": "arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"iam:AWSServiceName": "config.amazonaws.com"
}
}
},
{
"Sid": "AgentCoreEvaluator",
"Effect": "Allow",
"Action": [
"bedrock-agentcore:CreateEvaluator",
"bedrock-agentcore:GetEvaluator",
"bedrock-agentcore:UpdateEvaluator",
"bedrock-agentcore:DeleteEvaluator",
"bedrock-agentcore:ListEvaluators",
"bedrock-agentcore:Evaluate",
"bedrock-agentcore:TagResource",
"bedrock-agentcore:UntagResource",
"bedrock-agentcore:ListTagsForResource"
],
"Resource": "arn:aws:bedrock-agentcore:*:*:evaluator/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "AgentCoreOnlineEvaluationConfig",
"Effect": "Allow",
"Action": [
"bedrock-agentcore:CreateOnlineEvaluationConfig",
"bedrock-agentcore:GetOnlineEvaluationConfig",
"bedrock-agentcore:ListOnlineEvaluationConfigs",
"bedrock-agentcore:UpdateOnlineEvaluationConfig",
"bedrock-agentcore:DeleteOnlineEvaluationConfig",
"bedrock-agentcore:TagResource",
"bedrock-agentcore:UntagResource",
"bedrock-agentcore:ListTagsForResource"
],
"Resource": "arn:aws:bedrock-agentcore:*:*:online-evaluation-config/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "AgentCoreEvaluationDatasets",
"Effect": "Allow",
"Action": [
"bedrock-agentcore:GetDataset",
"bedrock-agentcore:ListDatasets",
"bedrock-agentcore:ListDatasetVersions",
"bedrock-agentcore:ListDatasetExamples",
"bedrock-agentcore:CreateDataset",
"bedrock-agentcore:UpdateDataset",
"bedrock-agentcore:CreateDatasetVersion",
"bedrock-agentcore:AddDatasetExamples",
"bedrock-agentcore:UpdateDatasetExamples",
"bedrock-agentcore:DeleteDatasetExamples",
"bedrock-agentcore:DeleteDataset",
"bedrock-agentcore:TagResource",
"bedrock-agentcore:UntagResource",
"bedrock-agentcore:ListTagsForResource"
],
"Resource": "arn:aws:bedrock-agentcore:*:*:dataset/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "BedrockFoundationModelDiscovery",
"Effect": "Allow",
"Action": [
"bedrock:ListFoundationModels",
"bedrock:ListInferenceProfiles"
],
"Resource": "*"
},
{
"Sid": "AgentCorePassRole",
"Effect": "Allow",
"Action": [
"iam:PassRole"
],
"Resource": "arn:aws:iam::*:role/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"iam:PassedToService": [
"bedrock-agentcore.amazonaws.com"
]
}
}
},
{
"Sid": "AnnotationAndEvalLogs",
"Effect": "Allow",
"Action": [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource": [
"arn:aws:logs:*:*:log-group:/aws/cloudwatch/*",
"arn:aws:logs:*:*:log-group:/aws/bedrock-agentcore/evaluations/*"
],
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "OnlineEvalLogGroupDiscovery",
"Effect": "Allow",
"Action": [
"logs:DescribeLogGroups"
],
"Resource": "arn:aws:logs:*:*:log-group:*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "KmsCryptoOpsForCMKEvaluators",
"Effect": "Allow",
"Action": [
"kms:GenerateDataKey",
"kms:Decrypt"
],
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
},
"StringLike": {
"kms:EncryptionContext:aws:bedrock-agentcore:evaluatorArn": "arn:aws:bedrock-agentcore:*:${aws:PrincipalAccount}:evaluator/*"
}
}
},
{
"Sid": "CodeEvaluatorLambdaInvoke",
"Effect": "Allow",
"Action": [
"lambda:InvokeFunction",
"lambda:GetFunction"
],
"Resource": "arn:aws:lambda:*:*:function:cloudwatchCodeEvaluator*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "ModelProviderKeyDiscovery",
"Effect": "Allow",
"Action": [
"secretsmanager:ListSecrets"
],
"Resource": "*"
},
{
"Sid": "ModelProviderKeyCreation",
"Effect": "Allow",
"Action": [
"secretsmanager:CreateSecret"
],
"Resource": "arn:aws:secretsmanager:*:*:secret:cw-omni-*",
"Condition": {
"StringEquals": {
"aws:RequestTag/cw-omni": "true",
"aws:ResourceAccount": "${aws:PrincipalAccount}"
}
}
},
{
"Sid": "ModelProviderKeyManagement",
"Effect": "Allow",
"Action": [
"secretsmanager:PutSecretValue",
"secretsmanager:GetSecretValue",
"secretsmanager:DeleteSecret",
"secretsmanager:TagResource"
],
"Resource": "arn:aws:secretsmanager:*:*:secret:cw-omni-*",
"Condition": {
"StringEquals": {
"aws:ResourceAccount": "${aws:PrincipalAccount}",
"aws:ResourceTag/cw-omni": "true"
}
}
},
{
"Sid": "IdentityStoreReadForPrincipalSearch",
"Effect": "Allow",
"Action": [
"identitystore:ListUsers",
"identitystore:ListGroups",
"identitystore:DescribeUser",
"identitystore:DescribeGroup"
],
"Resource": [
"arn:aws:identitystore::*:identitystore/*",
"arn:aws:identitystore:::user/*",
"arn:aws:identitystore:::group/*"
],
"Condition": {
"ForAnyValue:StringEquals": {
"aws:CalledVia": [
"cloudwatch.amazonaws.com"
]
}
}
},
{
"Sid": "KmsDecryptForIdentityStoreCMK",
"Effect": "Allow",
"Action": "kms:Decrypt",
"Resource": "arn:aws:kms:*:*:key/*",
"Condition": {
"ForAnyValue:StringEquals": {
"kms:EncryptionContextKeys": [
"aws:identitystore:identitystore-arn"
]
},
"StringLike": {
"kms:ViaService": "identitystore.*.amazonaws.com"
}
}
},
{
"Sid": "SnsTopicDiscoveryForAlerts",
"Effect": "Allow",
"Action": "sns:ListTopics",
"Resource": "*"
}
]
},
"VersionId": "v2",
"IsDefaultVersion": true,
"CreateDate": "2026-10-14T22:17:08+00:00"
}
}Version History (2 recorded)
Raw historyv2updated
5 actions added
v1new policy
113 actions added
74 never-before-seen actions: bedrock-agentcore:AddDatasetExamples, bedrock-agentcore:CreateDataset, bedrock-agentcore:CreateDatasetVersion, bedrock-agentcore:CreateEvaluator, bedrock-agentcore:CreateOnlineEvaluationConfig, bedrock-agentcore:DeleteDataset, bedrock-agentcore:DeleteDatasetExamples, bedrock-agentcore:DeleteEvaluator, bedrock-agentcore:DeleteOnlineEvaluationConfig, bedrock-agentcore:Evaluate, bedrock-agentcore:GetDataset, bedrock-agentcore:ListDatasetExamples, bedrock-agentcore:ListDatasetVersions, bedrock-agentcore:ListDatasets, bedrock-agentcore:TagResource, bedrock-agentcore:UntagResource, bedrock-agentcore:UpdateDataset, bedrock-agentcore:UpdateDatasetExamples, bedrock-agentcore:UpdateEvaluator, bedrock-agentcore:UpdateOnlineEvaluationConfig, cloudwatch:AssumeAccessProfile, cloudwatch:CreateAccessGrant, cloudwatch:CreateAccessProfile, cloudwatch:CreateAlert, cloudwatch:CreateIntegration, cloudwatch:CreateOmniDashboard, cloudwatch:CreateOmniThread, cloudwatch:CreateView, cloudwatch:DeleteAccessGrant, cloudwatch:DeleteAccessProfile, cloudwatch:DeleteAlert, cloudwatch:DeleteIntegration, cloudwatch:DeleteOmniDashboard, cloudwatch:DeleteOmniThread, cloudwatch:DeleteView, cloudwatch:GetAccessGrant, cloudwatch:GetAccessProfile, cloudwatch:GetAlert, cloudwatch:GetContextGraph, cloudwatch:GetDomain, cloudwatch:GetIntegration, cloudwatch:GetIntelligenceConfiguration, cloudwatch:GetOmniDashboard, cloudwatch:GetOmniThread, cloudwatch:GetPreferences, cloudwatch:GetRecords, cloudwatch:GetSpace, cloudwatch:GetTelemetryQueryResults, cloudwatch:GetView, cloudwatch:InvokeIntegration, cloudwatch:ListAccessGrants, cloudwatch:ListAccessProfiles, cloudwatch:ListAlerts, cloudwatch:ListIntegrations, cloudwatch:ListOmniDashboards, cloudwatch:ListOmniThreads, cloudwatch:ListSpaces, cloudwatch:ListTelemetryQuerySessions, cloudwatch:ListViews, cloudwatch:PutIntelligenceConfiguration, cloudwatch:SearchPrincipals, cloudwatch:StartOmniThreadSession, cloudwatch:StartTelemetryQuerySession, cloudwatch:StopTelemetryQuery, cloudwatch:StopTelemetryQuerySession, cloudwatch:SubmitFeedback, cloudwatch:UpdateAccessProfile, cloudwatch:UpdateAlert, cloudwatch:UpdateIntegration, cloudwatch:UpdateOmniDashboard, cloudwatch:UpdateOmniThread, cloudwatch:UpdatePreferences, cloudwatch:UpdateSpace, cloudwatch:UpdateView
8 permissions management, incl. cloudwatch:AssumeAccessProfile: cloudwatch:AssumeAccessProfile, cloudwatch:CreateAccessGrant, cloudwatch:CreateAccessProfile, cloudwatch:DeleteAccessGrant, cloudwatch:DeleteAccessProfile, cloudwatch:UpdateAccessProfile, iam:CreateServiceLinkedRole, iam:PassRole