# Getting started with workflow monitor
The following steps provide a basic overview of using workflow monitor for the first time.
1. Setup workflow monitor IAM permissions for administrator and operator level roles: [Workflow monitor IAM policies](monitor-with-workflow-monitor-configure-getting-started-IAM.md)
1. Build alarm templates or import predefined templates created by AWS: [CloudWatch alarms](monitor-with-workflow-monitor-configure-alarms.md)
1. Build notification events that will be delivered by EventBridge: [EventBridge rules ](monitor-with-workflow-monitor-configure-notifications.md)
1. Discover signal maps using your existing AWS Elemental resources: [Signal maps ](monitor-with-workflow-monitor-configure-signal-maps.md)
1. Attach the alarm templates and notification rules to your signal map: [Attaching templates](monitor-with-workflow-monitor-configure-signal-maps-attach.md)
1. Deploy the templates to begin monitoring the signal map: [Deploying monitoring templates](monitor-with-workflow-monitor-configure-deploy.md)
1. Monitor and review your workflow monitor resources using the overview section of the AWS console: [Overview](monitor-with-workflow-monitor-operate-overview.md)
![\[The individual steps of setting up workflow monitor. Begin by creating the IAM roles. Next, create templates for alarms and events. Next, discover a signal map and attach your templates to the map. After a signal map has templates attached, the templates must be deployed. The final step is monitoring using the templates and overview resources.\]](http://docs.aws.amazon.com/medialive/latest/ug/images/workflowmonitor-overview-steps.png)
# Workflow monitor IAM policies
Workflow monitor interacts with multiple AWS services to create signal maps, build CloudWatch and EventBridge resources, and CloudFormation templates. Because workflow monitor interacts with a wide range of services, specific AWS Identity and Access Management (IAM) policies must be assigned for these services. The following examples indicate the necessary IAM policies for both administrator and operator IAM roles.
## Administrator IAM policy
The following example policy is for an administrator-level workflow monitor IAM policy. This role allows for the creation and management of workflow monitor resources and the supported service resources that interact with workflow monitor.
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cloudwatch:List*",
"cloudwatch:Describe*",
"cloudwatch:Get*",
"cloudwatch:PutAnomalyDetector",
"cloudwatch:PutMetricData",
"cloudwatch:PutMetricAlarm",
"cloudwatch:PutCompositeAlarm",
"cloudwatch:PutDashboard",
"cloudwatch:DeleteAlarms",
"cloudwatch:DeleteAnomalyDetector",
"cloudwatch:DeleteDashboards",
"cloudwatch:TagResource",
"cloudwatch:UntagResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudformation:List*",
"cloudformation:Describe*",
"cloudformation:CreateStack",
"cloudformation:UpdateStack",
"cloudformation:DeleteStack",
"cloudformation:TagResource",
"cloudformation:UntagResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudfront:List*",
"cloudfront:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:DescribeNetworkInterfaces"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"events:List*",
"events:Describe*",
"events:CreateEventBus",
"events:PutRule",
"events:PutTargets",
"events:EnableRule",
"events:DisableRule",
"events:DeleteRule",
"events:RemoveTargets",
"events:TagResource",
"events:UntagResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"logs:Describe*",
"logs:Get*",
"logs:TagLogGroup",
"logs:TagResource",
"logs:UntagLogGroup",
"logs:UntagResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediaconnect:List*",
"mediaconnect:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"medialive:*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediapackage:List*",
"mediapackage:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediapackagev2:List*",
"mediapackagev2:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediapackage-vod:List*",
"mediapackage-vod:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediatailor:List*",
"mediatailor:Describe*",
"mediatailor:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"resource-groups:ListGroups",
"resource-groups:GetGroup",
"resource-groups:GetTags",
"resource-groups:GetGroupQuery",
"resource-groups:GetGroupConfiguration",
"resource-groups:CreateGroup",
"resource-groups:UngroupResources",
"resource-groups:GroupResources",
"resource-groups:DeleteGroup",
"resource-groups:UpdateGroupQuery",
"resource-groups:UpdateGroup",
"resource-groups:Tag",
"resource-groups:Untag"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:*"
],
"Resource": "arn:aws:s3:::workflow-monitor-templates*"
},
{
"Effect": "Allow",
"Action": [
"sns:TagResource",
"sns:UntagResource"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"tag:Get*",
"tag:Describe*",
"tag:TagResources",
"tag:UntagResources"
],
"Resource": "*"
}
]
}
```
------
## Operator IAM policy
The following example policy is for an operator-level workflow monitor IAM policy. This role allows for limited and read-only access to the workflow monitor resources and the supported service resources that interact with workflow monitor.
------
#### [ JSON ]
****
```
{
"Version":"2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": [
"cloudwatch:List*",
"cloudwatch:Describe*",
"cloudwatch:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudformation:List*",
"cloudformation:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"cloudfront:List*",
"cloudfront:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"ec2:DescribeNetworkInterfaces"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"events:List*",
"events:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"logs:Describe*",
"logs:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediaconnect:List*",
"mediaconnect:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"medialive:List*",
"medialive:Get*",
"medialive:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediapackage:List*",
"mediapackage:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediapackagev2:List*",
"mediapackagev2:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediapackage-vod:List*",
"mediapackage-vod:Describe*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"mediatailor:List*",
"mediatailor:Describe*",
"mediatailor:Get*"
],
"Resource": "*"
},
{
"Effect": "Allow",
"Action": [
"s3:Get*",
"s3:List*"
],
"Resource": "arn:aws:s3:::workflow-monitor-templates*"
},
{
"Effect": "Allow",
"Action": [
"tag:Get*",
"tag:Describe*"
],
"Resource": "*"
}
]
}
```
------