AWS::CloudWatch::AccessGrant AccessGrantPrincipal - AWS CloudFormation
SyntaxProperties
Services or capabilities described in AWS documentation might vary by Region. To see the differences applicable to the AWS European Sovereign Cloud Region, see the AWS European Sovereign Cloud User Guide.

This is the new CloudFormation Template Reference Guide. Please update your bookmarks and links. For help getting started with CloudFormation, see the AWS CloudFormation User Guide.

AWS::CloudWatch::AccessGrant AccessGrantPrincipal

The principal receiving the grant. Specify PrincipalId, PrincipalAttributes, or both.

Syntax

To declare this entity in your CloudFormation template, use the following syntax:

JSON

{
  "PrincipalAttributes" : [ AccessGrantPrincipalAttribute, ... ],
  "PrincipalId" : String,
  "PrincipalType" : String
}

Properties

PrincipalAttributes

Attribute conditions for attribute-based access. When provided, the grant targets any principal matching all specified conditions. Supported only for IDC_USER principals.

Required: No

Type: Array of AccessGrantPrincipalAttribute

Maximum: 10

Update requires: Replacement

PrincipalId

The ID of the principal receiving the grant. An IAM principal ARN, an Identity Center UUID, or a service-defined identifier.

Required: No

Type: String

Pattern: ^[a-zA-Z0-9][a-zA-Z0-9:/_+=,.@-]*$

Minimum: 1

Maximum: 2048

Update requires: Replacement

PrincipalType

The type of principal receiving the grant.

Required: Yes

Type: String

Allowed values: IDC_USER | IDC_GROUP | IAM_USER | IAM_ROLE | IAM_ROOT | ACCESS_PROFILE | ALERT | AGENT

Update requires: Replacement