Le traduzioni sono generate tramite traduzione automatica. In caso di conflitto tra il contenuto di una traduzione e la versione originale in Inglese, quest'ultima prevarrà.
# CloudWatchOmniSpaceAccessPolicy
**Descrizione**: fornisce l'accesso per gestire gli spazi CloudWatch Omni, visualizzare le applicazioni, la telemetria e altre funzionalità di osservabilità e monitoraggio tramite il nuovo prodotto Omni CloudWatch
`CloudWatchOmniSpaceAccessPolicy`è una policy gestita. [AWS](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-vs-inline.html#aws-managed-policies)
## Utilizzo di questa politica
È possibile associare la policy `CloudWatchOmniSpaceAccessPolicy` a utenti, gruppi e ruoli.
## Dettagli della policy
+ **Tipo**: politica AWS gestita
+ **Ora di creazione**: 22 settembre 2026, 01:47 UTC
+ **Ora modificata: 22 ** settembre 2026, 01:47 UTC
+ **ARN**: `arn:aws:iam::aws:policy/CloudWatchOmniSpaceAccessPolicy`
## Versione della politica
**Versione della politica: ** v1 (impostazione predefinita)
La versione predefinita della policy è la versione che definisce le autorizzazioni per la policy. Quando un utente o un ruolo con la policy effettua una richiesta di accesso a una AWS risorsa, AWS controlla la versione predefinita della policy per determinare se consentire la richiesta.
## Documento sulla politica JSON
```
{
"Version" : "2012-10-17",
"Statement" : [
{
"Sid" : "CloudWatchOmniSpaceAccessPermissions",
"Effect" : "Allow",
"Action" : [
"cloudwatch:UpdateSpace",
"cloudwatch:GetSpace",
"cloudwatch:ListSpaces",
"cloudwatch:GetDomain",
"cloudwatch:CreateAccessGrant",
"cloudwatch:GetAccessGrant",
"cloudwatch:ListAccessGrants",
"cloudwatch:DeleteAccessGrant",
"cloudwatch:SearchPrincipals",
"cloudwatch:StartTelemetryQuerySession",
"cloudwatch:StopTelemetryQuerySession",
"cloudwatch:ListTelemetryQuerySessions",
"cloudwatch:StopTelemetryQuery",
"cloudwatch:GetTelemetryQueryResults",
"cloudwatch:GetRecords",
"cloudwatch:GetMetricData",
"cloudwatch:ListMetrics",
"cloudwatch:GetContextGraph",
"cloudwatch:CreateAlert",
"cloudwatch:GetAlert",
"cloudwatch:UpdateAlert",
"cloudwatch:DeleteAlert",
"cloudwatch:ListAlerts",
"cloudwatch:CreateOmniDashboard",
"cloudwatch:GetOmniDashboard",
"cloudwatch:UpdateOmniDashboard",
"cloudwatch:DeleteOmniDashboard",
"cloudwatch:ListOmniDashboards",
"cloudwatch:CreateAccessProfile",
"cloudwatch:GetAccessProfile",
"cloudwatch:UpdateAccessProfile",
"cloudwatch:DeleteAccessProfile",
"cloudwatch:ListAccessProfiles",
"cloudwatch:AssumeAccessProfile",
"cloudwatch:CreateView",
"cloudwatch:GetView",
"cloudwatch:UpdateView",
"cloudwatch:DeleteView",
"cloudwatch:ListViews",
"cloudwatch:GetPreferences",
"cloudwatch:UpdatePreferences",
"cloudwatch:CreateOmniThread",
"cloudwatch:GetOmniThread",
"cloudwatch:UpdateOmniThread",
"cloudwatch:ListOmniThreads",
"cloudwatch:DeleteOmniThread",
"cloudwatch:StartOmniThreadSession",
"cloudwatch:SubmitFeedback",
"cloudwatch:CreateIntegration",
"cloudwatch:UpdateIntegration",
"cloudwatch:GetIntegration",
"cloudwatch:DeleteIntegration",
"cloudwatch:ListIntegrations",
"cloudwatch:InvokeIntegration",
"cloudwatch:GetIntelligenceConfiguration",
"cloudwatch:PutIntelligenceConfiguration",
"cloudwatch:TagResource",
"cloudwatch:UntagResource",
"cloudwatch:ListTagsForResource"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"cloudwatch:HasAccessGrant" : "true"
}
}
},
{
"Sid" : "DenyClassicCloudWatchResourceTagging",
"Effect" : "Deny",
"Action" : [
"cloudwatch:TagResource",
"cloudwatch:UntagResource",
"cloudwatch:ListTagsForResource"
],
"NotResource" : [
"arn:aws:cloudwatch:*:*:space/*",
"arn:aws:cloudwatch:*:*:domain/*",
"arn:aws:cloudwatch:*:*:organization-domain/*",
"arn:aws:cloudwatch:*:*:access-grant/*",
"arn:aws:cloudwatch:*:*:organization-access-grant/*",
"arn:aws:cloudwatch:*:*:access-profile/*",
"arn:aws:cloudwatch:*:*:omni-dashboard/*",
"arn:aws:cloudwatch:*:*:alert/*",
"arn:aws:cloudwatch:*:*:view/*",
"arn:aws:cloudwatch:*:*:integration/*",
"arn:aws:cloudwatch:*:*:dataset/*"
]
},
{
"Sid" : "AllowPassRoleForCloudWatchOmni",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : "arn:aws:iam::*:role/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"iam:PassedToService" : [
"cloudwatch.amazonaws.com"
]
}
}
},
{
"Sid" : "ListRolesAndUsers",
"Effect" : "Allow",
"Action" : [
"iam:ListUsers",
"iam:ListRoles",
"iam:GetRole",
"iam:ListAttachedRolePolicies"
],
"Resource" : "*"
},
{
"Sid" : "APIKeyConfigurationUsers",
"Effect" : "Allow",
"Action" : [
"iam:ListUserTags",
"iam:ListServiceSpecificCredentials"
],
"Resource" : "arn:aws:iam::*:user/omni/OmniIngestionUser-*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "KmsListKeysForOmni",
"Effect" : "Allow",
"Action" : "kms:ListKeys",
"Resource" : "*"
},
{
"Sid" : "KmsDescribeKeyForOmni",
"Effect" : "Allow",
"Action" : "kms:DescribeKey",
"Resource" : "arn:aws:kms:*:*:key/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "KmsCryptoOpsForOmniSpaces",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource" : "arn:aws:kms:*:*:key/*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudwatch.amazonaws.com"
]
},
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/cw-omni" : "true"
},
"StringLike" : {
"kms:EncryptionContext:aws:cloudwatch:arn" : "arn:aws:cloudwatch:*:${aws:PrincipalAccount}:space/*"
}
}
},
{
"Sid" : "KmsCryptoOpsForDatasets",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource" : "arn:aws:kms:*:*:key/*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudwatch.amazonaws.com"
]
},
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"StringLike" : {
"kms:EncryptionContext:aws:cloudwatch:arn" : "arn:aws:cloudwatch:*:${aws:PrincipalAccount}:dataset/*"
}
}
},
{
"Sid" : "KmsCryptoOpsForOmniIntelligence",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource" : "arn:aws:kms:*:*:key/*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudwatch.amazonaws.com"
]
},
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/cw-omni" : "true"
},
"StringLike" : {
"kms:EncryptionContext:aws:cloudwatch:account" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "KmsCryptoOpsForOmniIntelligenceBranchKey",
"Effect" : "Allow",
"Action" : [
"kms:Decrypt",
"kms:GenerateDataKey"
],
"Resource" : "arn:aws:kms:*:*:key/*",
"Condition" : {
"ForAnyValue:StringEquals" : {
"aws:CalledVia" : [
"cloudwatch.amazonaws.com"
]
},
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/cw-omni" : "true"
},
"StringLike" : {
"kms:EncryptionContext:aws-crypto-ec:aws:cloudwatch:account" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "ConfigServiceLinkedRecorderManagement",
"Effect" : "Allow",
"Action" : [
"config:PutServiceLinkedConfigurationRecorder",
"config:DeleteServiceLinkedConfigurationRecorder"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"config:ConfigurationRecorderServicePrincipal" : [
"cloudwatch.amazonaws.com"
]
}
}
},
{
"Sid" : "DescribeConfigurationRecorder",
"Effect" : "Allow",
"Action" : [
"config:DescribeConfigurationRecorderStatus"
],
"Resource" : "*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "AllowConfigServiceLinkedRoleCreation",
"Effect" : "Allow",
"Action" : "iam:CreateServiceLinkedRole",
"Resource" : "arn:aws:iam::*:role/aws-service-role/config.amazonaws.com/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"iam:AWSServiceName" : "config.amazonaws.com"
}
}
},
{
"Sid" : "AgentCoreEvaluator",
"Effect" : "Allow",
"Action" : [
"bedrock-agentcore:CreateEvaluator",
"bedrock-agentcore:GetEvaluator",
"bedrock-agentcore:UpdateEvaluator",
"bedrock-agentcore:DeleteEvaluator",
"bedrock-agentcore:ListEvaluators",
"bedrock-agentcore:Evaluate",
"bedrock-agentcore:TagResource",
"bedrock-agentcore:UntagResource",
"bedrock-agentcore:ListTagsForResource"
],
"Resource" : "arn:aws:bedrock-agentcore:*:*:evaluator/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "AgentCoreOnlineEvaluationConfig",
"Effect" : "Allow",
"Action" : [
"bedrock-agentcore:CreateOnlineEvaluationConfig",
"bedrock-agentcore:GetOnlineEvaluationConfig",
"bedrock-agentcore:ListOnlineEvaluationConfigs",
"bedrock-agentcore:UpdateOnlineEvaluationConfig",
"bedrock-agentcore:DeleteOnlineEvaluationConfig",
"bedrock-agentcore:TagResource",
"bedrock-agentcore:UntagResource",
"bedrock-agentcore:ListTagsForResource"
],
"Resource" : "arn:aws:bedrock-agentcore:*:*:online-evaluation-config/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "AgentCoreEvaluationDatasets",
"Effect" : "Allow",
"Action" : [
"bedrock-agentcore:GetDataset",
"bedrock-agentcore:ListDatasets",
"bedrock-agentcore:ListDatasetVersions",
"bedrock-agentcore:ListDatasetExamples",
"bedrock-agentcore:CreateDataset",
"bedrock-agentcore:UpdateDataset",
"bedrock-agentcore:CreateDatasetVersion",
"bedrock-agentcore:AddDatasetExamples",
"bedrock-agentcore:UpdateDatasetExamples",
"bedrock-agentcore:DeleteDatasetExamples",
"bedrock-agentcore:DeleteDataset",
"bedrock-agentcore:TagResource",
"bedrock-agentcore:UntagResource",
"bedrock-agentcore:ListTagsForResource"
],
"Resource" : "arn:aws:bedrock-agentcore:*:*:dataset/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "BedrockFoundationModelDiscovery",
"Effect" : "Allow",
"Action" : [
"bedrock:ListFoundationModels",
"bedrock:ListInferenceProfiles"
],
"Resource" : "*"
},
{
"Sid" : "AgentCorePassRole",
"Effect" : "Allow",
"Action" : [
"iam:PassRole"
],
"Resource" : "arn:aws:iam::*:role/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"iam:PassedToService" : [
"bedrock-agentcore.amazonaws.com"
]
}
}
},
{
"Sid" : "AnnotationAndEvalLogs",
"Effect" : "Allow",
"Action" : [
"logs:CreateLogGroup",
"logs:CreateLogStream",
"logs:PutLogEvents"
],
"Resource" : [
"arn:aws:logs:*:*:log-group:/aws/cloudwatch/*",
"arn:aws:logs:*:*:log-group:/aws/bedrock-agentcore/evaluations/*"
],
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "OnlineEvalLogGroupDiscovery",
"Effect" : "Allow",
"Action" : [
"logs:DescribeLogGroups"
],
"Resource" : "arn:aws:logs:*:*:log-group:*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "KmsCryptoOpsForCMKEvaluators",
"Effect" : "Allow",
"Action" : [
"kms:GenerateDataKey",
"kms:Decrypt"
],
"Resource" : "arn:aws:kms:*:*:key/*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
},
"StringLike" : {
"kms:EncryptionContext:aws:bedrock-agentcore:evaluatorArn" : "arn:aws:bedrock-agentcore:*:${aws:PrincipalAccount}:evaluator/*"
}
}
},
{
"Sid" : "CodeEvaluatorLambdaInvoke",
"Effect" : "Allow",
"Action" : [
"lambda:InvokeFunction",
"lambda:GetFunction"
],
"Resource" : "arn:aws:lambda:*:*:function:cloudwatchCodeEvaluator*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "ModelProviderKeyDiscovery",
"Effect" : "Allow",
"Action" : [
"secretsmanager:ListSecrets"
],
"Resource" : "*"
},
{
"Sid" : "ModelProviderKeyCreation",
"Effect" : "Allow",
"Action" : [
"secretsmanager:CreateSecret"
],
"Resource" : "arn:aws:secretsmanager:*:*:secret:cw-omni-*",
"Condition" : {
"StringEquals" : {
"aws:RequestTag/cw-omni" : "true",
"aws:ResourceAccount" : "${aws:PrincipalAccount}"
}
}
},
{
"Sid" : "ModelProviderKeyManagement",
"Effect" : "Allow",
"Action" : [
"secretsmanager:PutSecretValue",
"secretsmanager:GetSecretValue",
"secretsmanager:DeleteSecret",
"secretsmanager:TagResource"
],
"Resource" : "arn:aws:secretsmanager:*:*:secret:cw-omni-*",
"Condition" : {
"StringEquals" : {
"aws:ResourceAccount" : "${aws:PrincipalAccount}",
"aws:ResourceTag/cw-omni" : "true"
}
}
}
]
}
```
## Ulteriori informazioni
+ [Crea un set di autorizzazioni utilizzando politiche AWS gestite in IAM Identity Center ](https://docs.aws.amazon.com/singlesignon/latest/userguide/howtocreatepermissionset.html)
+ [Aggiungere e rimuovere le autorizzazioni di identità IAM ](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_manage-attach-detach.html)
+ [Comprendi il controllo delle versioni per le policy IAM ](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_managed-versioning.html)
+ [Inizia con le policy AWS gestite e passa alle autorizzazioni con privilegi minimi ](https://docs.aws.amazon.com/IAM/latest/UserGuide/best-practices.html#bp-use-aws-defined-policies)