View a markdown version of this page

Actions, resources, and condition keys for Amazon CloudWatch Application Signals MCP Server - Service Authorization Reference
ActionsResource typesCondition keys

Actions, resources, and condition keys for Amazon CloudWatch Application Signals MCP Server

Amazon CloudWatch Application Signals MCP Server (service prefix: application-signals-mcp) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Actions defined by Amazon CloudWatch Application Signals MCP Server

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions Description Resource types (*required) Condition keys Access level

CallReadOnlyTool

Grants permission to invoke read-only Application Signals MCP tools (list_monitored_services, get_service_detail, query_service_metrics, list_service_operations, get_slo, list_slos, search_transaction_spans, query_sampled_traces, list_slis, get_enablement_guide, list_change_events, list_group_services, audit_group_health, get_group_dependencies, get_group_changes, list_grouping_attribute_definitions, audit_services, audit_slos, audit_service_operations, analyze_canary_failures)

mcp-server*

aws:ResourceTag/${TagKey}

Read

InvokeMcp

Grants permission to connect to and interact with the Application Signals MCP server (initialize, list tools, list resources, list prompts)

mcp-server*

aws:ResourceTag/${TagKey}

Read

Resource types defined by Amazon CloudWatch Application Signals MCP Server

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types ARN Condition keys

mcp-server

arn:${Partition}:application-signals-mcp:${Region}:${Account}:mcp-server/*

aws:ResourceTag/${TagKey}

Condition keys for Amazon CloudWatch Application Signals MCP Server

Amazon CloudWatch Application Signals MCP Server defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys Description Type

aws:ResourceTag/${TagKey}

Filters access by tag key-value pairs attached to the resource

String