what permissions do i need to set for cloudwatch logger