ElastiCache API permissions: Actions, resources, and conditions reference - Amazon ElastiCache

ElastiCache API permissions: Actions, resources, and conditions reference

When you set up access control and write permissions policies to attach to an IAM policy (either idenity-based or resource-based), use the following table as a reference. The table lists each Amazon ElastiCache API operation and the corresponding actions for which you can grant permissions to perform the action. You specify the actions in the policy's Action field, and you specify a resource value in the policy's Resource field. Unless indicated otherwise, the resource is required. Some fields include both a required resource and optional resources. When there is no resource ARN, the resource in the policy is a wildcard (*).

You can use condition keys in your ElastiCache policies to express conditions. To see a list of ElastiCache-specific condition keys, along with the actions and resource types to which they apply, see Using condition keys. For a complete list of AWS-wide keys, see Available Keys for Conditions in the IAM User Guide.

Note

To specify an action, use the elasticache: prefix followed by the API operation name (for example, elasticache:DescribeCacheClusters).

Use the scroll bars to see the rest of the table.

Amazon ElastiCache API and required permissions for actions
ElastiCache API operations Required permissions (API actions) Resources

AddTagsToResource

elasticache:AddTagsToResource

(Optional) Cluster, snapshot

AuthorizeCacheSecurityGroupIngress

elasticache:AuthorizeCacheSecurityGroupIngress

Security group

CreateCacheCluster

elasticache:CreateCacheCluster

elasticache:AddTagsToResource

Parameter group. (Optional) Cache cluster, Replication group, Snapshot, Security group Ids and Subnet group

Where my_bucket/snapshot1 is an S3 bucket and snapshot that you want to create the cache cluster from.

CreateCacheParameterGroup

elasticache:CreateCacheParameterGroup

elasticache:AddTagsToResource

Parameter group

CreateCacheSecurityGroup

elasticache:CreateCacheSecurityGroup

elasticache:AddTagsToResource

Security group

CreateCacheSubnetGroup

elasticache:CreateCacheSubnetGroup

elasticache:AddTagsToResource

Subnet group

*

DecreaseNodeGroupsInGlobalReplicationGroup

elasticache:DecreaseNodeGroupsInGlobalReplicationGroup

GlobalReplicationGroup

DecreaseReplicaCount

elasticache:DecreaseReplicaCount

Replication group

DeleteCacheCluster

elasticache:DeleteCacheCluster

Cache cluster. (Optional) Snapshot

DeleteCacheParameterGroup

elasticache:DeleteCacheParameterGroup

Parameter group

DeleteCacheSubnetGroup

elasticache:DeleteCacheSubnetGroup

Subnet group

DescribeCacheClusters

elasticache:DescribeCacheClusters

Cluster

DescribeCacheEngineVersions

elasticache:DescribeCacheEngineVersions

No Resource ARN: *

DescribeCacheParameterGroups

elasticache:DescribeCacheParameterGroups

Parameter group

DescribeCacheParameters

elasticache:DescribeCacheParameters

Parameter group

DescribeCacheSecurityGroups

elasticache:DescribeCacheSecurityGroups

Security group

DescribeCacheSubnetGroups

elasticache:DescribeCacheSubnetGroups

Subnet group

*

DescribeEngineDefaultParameters

elasticache:DescribeEngineDefaultParameters

No Resource ARN:*

DescribeEvents

elasticache:DescribeEvents

No Resource ARN: *

DescribeReservedCacheNodes

elasticache:DescribeReservedCacheNodes

Reserved-instance

DescribeReservedCacheNodesOfferings

elasticache:DescribeReservedCacheNodesOfferings

No Resource ARN: *

DescribeServiceUpdates

elasticache:DescribeServiceUpdates

No Resource ARN: *

ListTagsForResource

elasticache:ListTagsForResource

(Optional) Cluster, snapshot

ModifyCacheCluster

elasticache:ModifyCacheCluster

Cache cluster. (Optional) Parameter group, Security group

ModifyCacheParameterGroup

elasticache:ModifyCacheParameterGroup

Parameter group

ModifyCacheSubnetGroup

elasticache:ModifyCacheSubnetGroup

Subnet group

ModifyReplicationGroupShardConfiguration

elasticache:ModifyReplicationGroupShardConfiguration

Replication group

PurchaseReservedCacheNodesOffering

elasticache:PurchaseReservedCacheNodesOffering

elasticache:AddTagsToResource

Reserved-instance

RebootCacheCluster

elasticache:RebootCacheCluster

Cluster

RemoveTagsFromResource

elasticache:RemoveTagsFromResource

(Optional) Cluster, snapshot

ResetCacheParameterGroup

elasticache:ResetCacheParameterGroup

Parameter group

RevokeCacheSecurityGroupIngress

elasticache:RevokeCacheSecurityGroupIngress

No Resource ARN: *