title: Unable to list or view AWS Cloudwatch dashboards
body: <p>I have a user account with an IAM ROLE Policy with permissions to access specific AWS Cloudwatch dashboards. However I am not able to access the them. Below are the policy and error details. Please correct me if I am making any mistake. Thanks.</p>
  <p><strong>IAM role</strong></p>
  <pre><code>resource &quot;aws_iam_role&quot; &quot;app1_iam_role&quot; {
    name               = &quot;${terraform.workspace}-APP1-IAM-ROLE&quot;
    assume_role_policy = &lt;&lt;EOF
  {
    &quot;Version&quot;: &quot;2012-10-17&quot;,
    &quot;Statement&quot;: [
      {
        &quot;Effect&quot;: &quot;Allow&quot;,
        &quot;Principal&quot;: {
          &quot;AWS&quot;: &quot;arn:aws:iam::${var.aws_account_id[local.environment]}:root&quot;
        },
        &quot;Action&quot;: &quot;sts:AssumeRole&quot;,
        &quot;Condition&quot;: {}
      }
    ]
  }
  EOF
  }
  </code></pre>
  <p><strong>IAM Policy</strong></p>
  <pre><code>resource &quot;aws_iam_role_policy&quot; &quot;app1_role_policy&quot; {
    name = &quot;${terraform.workspace}-APP1-POLICY-DOCUMENT&quot;
    role = aws_iam_role.app1_iam_role.id
  
    policy = &lt;&lt;EOF
  {
    &quot;Version&quot;:&quot;2012-10-17&quot;,
    &quot;Statement&quot;:[
       {
          &quot;Effect&quot;:&quot;Allow&quot;,
          &quot;Action&quot;:[
             &quot;logs:DescribeLogGroups&quot;,
             &quot;logs:DescribeLogStreams&quot;,
             &quot;logs:GetLogEvents&quot;
          ],
          &quot;Resource&quot;:[
             &quot;arn:aws:logs:eu-west-2:${var.aws_account_id[local.environment]}:log-group:${local.app1_log_group_environment}-${upper(var.application_name)}-application:*&quot;,
             &quot;arn:aws:logs:eu-west-2:${var.aws_account_id[local.environment]}:log-group:${local.app1_log_group_environment}-${upper(var.application_name)}-application:log-stream:*&quot;,
          ]
       },       
       {
          &quot;Effect&quot;:&quot;Allow&quot;,
          &quot;Action&quot;:[
             &quot;cloudwatch:GetDashboard&quot;,
             &quot;cloudwatch:ListDashboards&quot;
          ],
          &quot;Resource&quot;:[
             &quot;arn:aws:cloudwatch::${var.aws_account_id[local.environment]}:dashboard/*app1_application*&quot;,
             &quot;arn:aws:cloudwatch::${var.aws_account_id[local.environment]}:dashboard/*app1_infratructure*&quot;
          ]
       }
    ]
  }
  EOF
  }
  </code></pre>
  <p><strong>Error</strong></p>
  <pre><code>To list dashboards you need cloudwatch:ListDashboards permission.
  </code></pre>
  <p>Please note that I am able to access the logs configured in the policy.
  Not sure if there in issue with how the arn for the cloudwatch dashboard.</p>