Policy: CloudWatchLogsReadOnlyAccess ARN: arn:aws:iam::aws:policy/CloudWatchLogsReadOnlyAccess Allowed Actions Actions Services cloudwatch:GenerateQuery cloudwatch logs:Describe* logs logs:FilterLogEvents logs logs:Get* logs logs:List* logs logs:StartLiveTail logs logs:StartQuery logs logs:StopLiveTail logs logs:StopQuery logs logs:TestMetricFilter logs