IAM Permissions

Hello! I understand you're having trouble accessing CloudWatch metrics and dashboards. The error you're receiving suggests there might be an issue with your IAM permissions. Let's address the permissions you've requested and provide some additional information.

To access CloudWatch dashboards and metrics, you'll need specific permissions. Based on your request and best practices, here's what you should have:

1. cloudwatch:GetMetricData
2. cloudwatch:GetMetricStatistics
3. cloudwatch:ListMetrics
4. cloudwatch:GetDashboard
5. cloudwatch:PutDashboard

In addition to these, you'll also need:

6. cloudwatch:ListDashboards (to be able to view dashboards)

If you need to delete dashboards in the future, you might also want to include:

7. cloudwatch:DeleteDashboards

These permissions can be granted through a custom IAM policy attached to your user (ARINAKLEINAMAZONGERM). Alternatively, your administrator could grant you the CloudWatchFullAccess policy, which includes all necessary permissions for CloudWatch operations.

It's important to note that the "security token is invalid" error often indicates an authentication issue rather than a permissions problem. This could mean:

1. Your IAM user credentials might have expired.
2. You might be using incorrect or outdated access keys.
3. There could be a mismatch between the AWS region you're trying to access and the region your credentials are valid for.

To resolve this:

1. Verify that your IAM user credentials are current and correct.
2. Ensure you're using the correct access key and secret access key.
3. Check that you're accessing the correct AWS region.

If the issue persists after verifying these points and ensuring you have the correct permissions, you may need to contact your AWS account administrator for further assistance. They can review your IAM user settings and permissions to identify any other potential issues.
Sources
CloudWatch dashboard permissions update - Amazon CloudWatch
Review IAM permissions needed for the AWS Glue Studio user - AWS Glue

If you arte using IAM account separated from root account then someone who have access to root need to add permissions to your IAM user: cloudwatch:GetMetricData cloudwatch:GetMetricStatistics cloudwatch:ListMetrics cloudwatch:GetDashboard cloudwatch:PutDashboard After that you should have access to CloudWatch service