Mods
AWS

IAM Role: AWS/CloudWatch/Metadata

PermissionGrant
cloudwatch:DescribeAlarmHistoryMetadata
cloudwatch:DescribeAlarmsMetadata
cloudwatch:DescribeAlarmsForMetricMetadata
cloudwatch:DescribeInsightRulesMetadata
cloudwatch:GetDashboardMetadata
cloudwatch:GetInsightRuleReportMetadata
cloudwatch:GetMetricDataMetadata
cloudwatch:GetMetricStatisticsMetadata
cloudwatch:GetMetricStreamMetadata
cloudwatch:GetMetricWidgetImageMetadata
cloudwatch:ListDashboardsMetadata
cloudwatch:ListMetricStreamsMetadata
cloudwatch:ListMetricsMetadata
ec2:DescribeSecurityGroupsMetadata
ec2:DescribeSubnetsMetadata
ec2:DescribeVpcsMetadata
iam:ListRolesMetadata
s3:GetBucketLocationMetadata
s3:ListAllMyBucketsMetadata
sns:ListTopicsMetadata
synthetics:DescribeCanariesMetadata
synthetics:DescribeCanariesLastRunMetadata
synthetics:DescribeRuntimeVersionsMetadata
synthetics:GetCanaryMetadata
synthetics:GetCanaryRunsMetadata
synthetics:ListTagsForResourceMetadata
xray:GetGroupsMetadata
xray:GetServiceGraphMetadata
xray:GetTraceSummariesMetadata