Repolode
Submit
aws-samples

aws-samples/sample-cloudwatch-logs-iam-policy-validator

A Python script that simulates an IAM policy against CloudWatch Logs actions to check whether it works with the standard log group ARN format.

View on GitHub
Stars
5
Forks
2
Open issues
2
Last commit
last month

What is it?

This script tests an AWS IAM policy against every CloudWatch Logs API action, for both log-group and log-stream ARN formats. It calls aws iam simulate-custom-policy for each action and prints a table showing whether each one is allowed or implicitly denied.

The tool is aimed at a specific migration. AWS CloudWatch Logs is enforcing the standard log group ARN format (without a trailing :*) for IAM authorization, so policies written with the old format stop applying to log-group-level actions once enforcement begins. Running the script before that date shows which actions a policy still grants and which need its Resource element updated.

It takes a local JSON policy file and a log group name, with optional flags for region, account ID and AWS partition (aws, aws-cn or aws-us-gov). It requires Python 3.8+, AWS CLI v2, and the iam:SimulateCustomPolicy permission.

Key features

  • 01Simulates an IAM policy against each CloudWatch Logs action for log-group and log-stream ARNs.
  • 02Prints a per-action table of allowed and implicitDeny results.
  • 03Supports aws, aws-cn and aws-us-gov partitions.
  • 04Defaults the region and account ID from the environment or AWS CLI.

Use cases

  • Checking whether existing IAM policies still grant log-group actions before the ARN format enforcement takes effect.
  • Updating the Resource element of policy statements that use the old log group ARN with a trailing :*.
  • Validating CloudWatch Logs permissions in AWS China or GovCloud accounts.

Quick start

  1. 1

    Save your IAM policy document to a local JSON file

  2. 2

    Run the script against your policy file and log group name

    python3 simulate_cloudwatch_logs_policy.py policy.json MyLogGroup --region us-east-1 --account-id 123456789012

Things to know

  • Requires AWS CLI v2 installed and authenticated, with iam:SimulateCustomPolicy permission.

Topics

#aws#iam#cloudwatch-logs#policy-validation#python#cloud-security

FAQ

What is sample-cloudwatch-logs-iam-policy-validator?
A Python script that simulates an IAM policy against CloudWatch Logs actions to check whether it works with the standard log group ARN format. This script tests an AWS IAM policy against every CloudWatch Logs API action, for both log-group and log-stream ARN formats. It calls aws iam simulate-custom-policy for each action and prints a table showing whether each one is allowed or implicitly denied.
Is sample-cloudwatch-logs-iam-policy-validator free to use? What license does it have?
sample-cloudwatch-logs-iam-policy-validator is open source under the MIT-0 license. Check the license terms before using it in commercial products.
Is sample-cloudwatch-logs-iam-policy-validator still maintained?
Updated within 6 months. The last commit to sample-cloudwatch-logs-iam-policy-validator was on Sep 24, 2026.
What can I use sample-cloudwatch-logs-iam-policy-validator for?
Checking whether existing IAM policies still grant log-group actions before the ARN format enforcement takes effect. Updating the Resource element of policy statements that use the old log group ARN with a trailing :*. Validating CloudWatch Logs permissions in AWS China or GovCloud accounts.
How do I install sample-cloudwatch-logs-iam-policy-validator?
Save your IAM policy document to a local JSON file Run the script against your policy file and log group name: python3 simulate_cloudwatch_logs_policy.py policy.json MyLogGroup --region us-east-1 --account-id 123456789012
Where can I get sample-cloudwatch-logs-iam-policy-validator?
The source code and installation instructions are on GitHub: https://github.com/aws-samples/sample-cloudwatch-logs-iam-policy-validator

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects