cloudwatch:GetProfileRecords is a Read access-level action in the cloudwatch service. Grants permission to query and retrieve CloudWatch application profiling data. This action is unrelated to CloudWatch access profiles (GetAccessProfile and related actions)
ARNs that cloudwatch:GetProfileRecords can be scoped to in an IAM policy.
Keys you can use in the Condition block of a policy that grants cloudwatch:GetProfileRecords.
Filters access by the presence of access grants associated with the request
Filters access by tags associated with the resource
A minimal policy that allows cloudwatch:GetProfileRecords. Replace "Resource": "*" with a specific ARN to follow least privilege.
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "AllowCloudwatchGetProfileRecords",
"Effect": "Allow",
"Action": "cloudwatch:GetProfileRecords",
"Resource": "*"
}
]
}