ElastiCache API Permissions: Actions, Resources, and Conditions Reference - Amazon ElastiCache for Redis

ElastiCache API Permissions: Actions, Resources, and Conditions Reference

When you set up access control and write permissions policies to attach to an IAM policy (either idenity-based or resource-based), use the following table as a reference. The table lists each Amazon ElastiCache API operation and the corresponding actions for which you can grant permissions to perform the action. You specify the actions in the policy's Action field, and you specify a resource value in the policy's Resource field. Unless indicated otherwise, the resource is required. Some fields include both a required resource and optional resources. When there is no resource ARN, the resource in the policy is a wildcard (*).

You can use AWS-wide condition keys in your ElastiCache policies to express conditions. For a complete list of AWS-wide keys, see Available Keys for Conditions in the IAM User Guide.

Note

To specify an action, use the elasticache: prefix followed by the API operation name (for example, elasticache:DescribeCacheClusters).

Use the scroll bars to see the rest of the table.

Amazon ElastiCache API and Required Permissions for Actions
ElastiCache API Operations Required Permissions (API Actions) Resources

AddTagsToResource

elasticache:AddTagsToResource

(Optional) Cluster, snapshot

AuthorizeCacheSecurityGroupIngress

elasticache:AuthorizeCacheSecurityGroupIngress

Security group

BatchApplyUpdateAction

elasticache:BatchApplyUpdateAction

(Optional) Cluster, replication group

BatchStopUpdateAction

elasticache:BatchStopUpdateAction

(Optional) Cluster, replication group

CompleteMigration

elasticache:CompleteMigration

(Optional) Cluster, replication group

CopySnapshot

elasticache:CopySnapshot

s3:GetBucketLocation

s3:ListAllMyBuckets

Snapshot (Source, Target)

*

*

CreateCacheCluster

elasticache:CreateCacheCluster

s3:GetObject

Note

If you use the SnapshotArns parameter, each member of the SnapshotArns list requires its own s3:GetObject permission with the s3 ARN as its resource.

Parameter group. (Optional) Cache cluster, Replication group, Snapshot, Security group Ids and Subnet group

arn:aws:s3:::my_bucket/snapshot1.rdb

Where my_bucket/snapshot1 is an S3 bucket and snapshot that you want to create the cache cluster from.

CreateCacheParameterGroup

elasticache:CreateCacheParameterGroup

Parameter group

CreateCacheSecurityGroup

elasticache:CreateCacheSecurityGroup

Security group

CreateCacheSubnetGroup

elasticache:CreateCacheSubnetGroup

Subnet group

*

CreateGlobalReplicationGroup

elasticache:CreateGlobalReplicationGroup

Global replication group, replication group

CreateReplicationGroup

elasticache:CreateReplicationGroup

s3:GetObject

Note

If you use the SnapshotArns parameter, each member of the SnapshotArns list requires its own s3:GetObject permission with the s3 ARN as its resource.

Parameter group. (Optional) Replication group, Snapshot, Subnet group, Global Replication Group, Primary cluster Id, Security group Ids

arn:aws:s3:::my_bucket/snapshot1.rdb

Where my_bucket/snapshot1 is an S3 bucket and snapshot that you want to create the cache cluster from.

CreateSnapshot

elasticache:CreateSnapshot

Snapshot. (Optional) Cache cluster, Replication group

DecreaseNodeGroupsInGlobalReplicationGroup

elasticache:DecreaseNodeGroupsInGlobalReplicationGroup

GlobalReplicationGroup

DecreaseReplicaCount

elasticache:DecreaseReplicaCount

Replication group

DeleteCacheCluster

elasticache:DeleteCacheCluster

Cache cluster. (Optional) Snapshot

DeleteCacheParameterGroup

elasticache:DeleteCacheParameterGroup

Parameter group

DeleteCacheSubnetGroup

elasticache:DeleteCacheSubnetGroup

Subnet group

DeleteGlobalReplicationGroup

elasticache:DeleteGlobalReplicationGroup

GlobalReplicationGroup

DeleteReplicationGroup

elasticache:DeleteReplicationGroup

Replication group. (Optional) Snapshot

DeleteSnapshot

elasticache:DeleteSnapshot

Snapshot

DescribeCacheClusters

elasticache:DescribeCacheClusters

Cluster

DescribeCacheEngineVersions

elasticache:DescribeCacheEngineVersions

No Resource ARN: *

DescribeCacheParameterGroups

elasticache:DescribeCacheParameterGroups

Parameter group

DescribeCacheParameters

elasticache:DescribeCacheParameters

Parameter group

DescribeCacheSecurityGroups

elasticache:DescribeCacheSecurityGroups

Security group

DescribeCacheSubnetGroups

elasticache:DescribeCacheSubnetGroups

Subnet group

*

DescribeEngineDefaultParameters

elasticache:DescribeEngineDefaultParameters

No Resource ARN:*

DescribeEvents

elasticache:DescribeEvents

No Resource ARN: *

DescribeGlobalReplicationGroups

elasticache:DescribeGlobalReplicationGroups

GlobalReplicationGroup

DescribeGlobalReplicationGroups

elasticache:DescribeGlobalReplicationGroups

No Resource ARN: *

DescribeReplicationGroups

elasticache:DescribeReplicationGroups

ReplicationGroup

DescribeReservedCacheNodes

elasticache:DescribeReservedCacheNodes

Reserved-instance

DescribeReservedCacheNodesOfferings

elasticache:DescribeReservedCacheNodesOfferings

No Resource ARN: *

DescribeServiceUpdates

elasticache:DescribeServiceUpdates

No Resource ARN: *

DescribeSnapshots

elasticache:DescribeSnapshots

Snapshot

DescribeUpdateActions

elasticache:DescribeUpdateActions

(Optional) Cluster, replication group

DisassociateGlobalReplicationGroup

elasticache:DisassociateGlobalReplicationGroup

GlobalReplicationGroup

FailoverGlobalReplicationGroup

elasticache:FailoverGlobalReplicationGroup

GlobalReplicationGroup

IncreaseNodeGroupsInGlobalReplicationGroup

elasticache:IncreaseNodeGroupsInGlobalReplicationGroup

GlobalReplicationGroup

ListAllowedNodeTypeModifications

elasticache:ListAllowedNodeTypeModifications

(Optional) Cluster, replication group

IncreaseReplicaCount

elasticache:IncreaseReplicaCount

Replicatio group

ListTagsForResource

elasticache:ListTagsForResource

(Optional) Cluster, snapshot

ModifyCacheCluster

elasticache:ModifyCacheCluster

Cache cluster. (Optional) Parameter group, Security group

ModifyCacheParameterGroup

elasticache:ModifyCacheParameterGroup

Parameter group

ModifyCacheSubnetGroup

elasticache:ModifyCacheSubnetGroup

Subnet group

ModifyGlobalReplicationGroup

elasticache:ModifyGlobalReplicationGroup

GlobalReplicationGroup

ModifyReplicationGroup

elasticache:ModifyReplicationGroup

Replication group. (Optional) Parameter group, Security group

ModifyReplicationGroupShardConfiguration

elasticache:ModifyReplicationGroupShardConfiguration

Replication group

PurchaseReservedCacheNodesOffering

elasticache:PurchaseReservedCacheNodesOffering

Reserved-instance

RebalanceSlotsInGlobalReplicationGroup

elasticache:RebalanceSlotsInGlobalReplicationGroup

GlobalReplicationGroup

RebootCacheCluster

elasticache:RebootCacheCluster

Cluster

RemoveTagsFromResource

elasticache:RemoveTagsFromResource

(Optional) Cluster, snapshot

ResetCacheParameterGroup

elasticache:ResetCacheParameterGroup

Parameter group

RevokeCacheSecurityGroupIngress

elasticache:RevokeCacheSecurityGroupIngress

No Resource ARN: *

StartMigration

elasticache:StartMigration

Replication group

TestFailover

elasticache:TestFailover

Replication group