AWS Identity and Access Management
User Guide

Actions, Resources, and Condition Keys for Amazon Lightsail

Amazon Lightsail (service prefix: lightsail) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Actions Defined by Amazon Lightsail

You can specify the following actions in the Action element of an IAM policy statement. By using policies, you define the permissions for anyone performing an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions. For details about the columns in the following table, see The Actions Table.

Actions Description Access Level Resource Types (*required) Condition Keys Dependent Actions
AllocateStaticIp Allocates a static IP address. Write

StaticIp*

AttachDisk Attachs disk to an instance Write

Disk*

Instance*

AttachInstancesToLoadBalancer Attach instances to load balancer Write

Instance*

LoadBalancer*

AttachLoadBalancerTlsCertificate Attach tls certificate to load balancer Write

LoadBalancer*

AttachStaticIp Attaches a static IP address to a specific Amazon Lightsail instance. Write

Instance*

StaticIp*

CloseInstancePublicPorts Closes the public ports on a specific Amazon Lightsail instance. Write

Instance*

CopySnapshot Copy snapshot from a reigon to another region within Lightsail Write
CreateCloudFormationStack Creates a new Amazon EC2 instance from an exported Amazon Lightsail snapshot List

ExportSnapshotRecord*

CreateDisk Create disk Write

Disk*

CreateDiskFromSnapshot Create disk from snapshot Write

Disk*

CreateDiskSnapshot Create disk snapshot Write

Disk*

CreateDomain Creates a domain resource for the specified domain. Write

Domain*

CreateDomainEntry Creates one of the following entry records associated with the domain: A record, CNAME record, TXT record, or MX record. Write

Domain*

CreateInstanceSnapshot Creates a snapshot of a specific instance. You can use a snapshot to create a new instance that is based on that snapshot. Write

Instance*

InstanceSnapshot*

CreateInstances Creates one or more Amazon Lightsail instances. Write

KeyPair*

CreateInstancesFromSnapshot Uses a specific snapshot as a blueprint for creating one or more new instances that are based on that identical configuration. Write

Instance*

InstanceSnapshot*

CreateKeyPair Creates sn SSH key pair. Write

KeyPair*

CreateLoadBalancer Create load balance Write

LoadBalancer*

CreateLoadBalancerTlsCertificate Create loadBalancer tls certificate Write

LoadBalancer*

CreateRelationalDatabase Creates a new relational database. Write

RelationalDatabase*

CreateRelationalDatabaseFromSnapshot Creates a new relational database from snapshot. Write

RelationalDatabase*

CreateRelationalDatabaseSnapshot Create a relational database snapshot. Write

RelationalDatabaseSnapshot*

DeleteDisk Delete disk Write

Disk*

DeleteDiskSnapshot Delete disk snapshot Write

Disk*

DeleteDomain Deletes the specified domain recordset and all of its domain records. Write

Domain*

DeleteDomainEntry Deletes a specific domain entry. Write

Domain*

DeleteInstance Deletes a specific Amazon Lightsail instance. Write

Instance*

DeleteInstanceSnapshot Deletes a specific snapshot of an instance. Write

InstanceSnapshot*

DeleteKeyPair Deletes a specific SSH key pair. Write

KeyPair*

DeleteKnownHostKeys Deletes the known host key or certificate used by the Amazon Lightsail browser-based SSH or RDP clients to authenticate an instance. Write

Instance*

DeleteLoadBalancer Delete load balancer Write

LoadBalancer*

DeleteLoadBalancerTlsCertificate Delete load balancer tls certificate Write

LoadBalancer*

DeleteRelationalDatabase Delete an existing relational database. Write

RelationalDatabase*

DeleteRelationalDatabaseSnapshot Delete a relational database snapshot. Write

RelationalDatabaseSnapshot*

DetachDisk Detach disk from the instance Write

Disk*

DetachInstancesFromLoadBalancer Detach instances from load balancer Write

Instance*

LoadBalancer*

DetachStaticIp Detaches a static IP from the Amazon Lightsail instance to which it is attached. Write

Instance*

StaticIp*

DownloadDefaultKeyPair Downloads the default SSH key pair from the user's account. Write

KeyPair*

ExportSnapshot Export snapshots from Lightsail to AWS in the same account Write
GetActiveNames Returns the names of all active (not deleted) resources. Read
GetBlueprints Returns the list of available instance images, or blueprints. You can use a blueprint to create a new instance already running a specific operating system, as well as a preinstalled app or development stack. The software each instance is running depends on the blueprint image you choose. List
GetBundles Returns the list of bundles that are available for purchase. A bundle describes the specifications for your instance. List
GetCloudFormationStackRecords Return informatinon about all cloud formation stack records List

CloudFormationStackRecord*

GetDisk Return information about the disk Read

Disk*

GetDiskSnapshot Return information about disk snapshot Read

Disk*

GetDiskSnapshots Return information about all disk snapshots List

Disk*

GetDisks Return information about all disks List
GetDomain Returns information about a specific domain recordset. List

Domain*

GetDomains Returns a list of all domains in the user's account. Read

Domain*

GetExportSnapshotRecords Return informatinon about all export snapshot records List

ExportSnapshotRecord*

GetInstance Returns information about a specific Amazon Lightsail instance. Read

Instance*

GetInstanceAccessDetails Returns temporary SSH keys you can use to connect to a specific instance. Write

Instance*

GetInstanceMetricData Returns the data points for the specified Amazon Lightsail instance metric, given an instance name. Read

Instance*

GetInstancePortStates Returns the port states for a specific instance. Read

Instance*

GetInstanceSnapshot Returns information about a specific instance snapshot. Read

InstanceSnapshot*

GetInstanceSnapshots Returns all instance snapshots for the user's account. List

InstanceSnapshot*

GetInstanceState Returns the state of a specific instance. Read

Instance*

GetInstances Returns information about all Amazon Lightsail instances. List

Instance*

GetKeyPair Returns information about a specific key pair. List

KeyPair*

GetKeyPairs Returns information about all key pairs in the user's account. Read

KeyPair*

GetLoadBalancer Return informatinon about load balance Read

LoadBalancer*

GetLoadBalancerMetricData Return metric information about load balancer Read

LoadBalancer*

GetLoadBalancerTlsCertificates Return information about the certificate of load balancer List

LoadBalancer*

GetLoadBalancers Return informatinon about load balances List

LoadBalancer*

GetOperation Returns information about a specific operation. Operations include events such as when you create an instance, allocate a static IP, attach a static IP, and so on. Read
GetOperations Returns information about all operations. Read
GetOperationsForResource Gets operations for a specific resource. Read

Domain

Instance

InstanceSnapshot

KeyPair

StaticIp

GetRegions Returns a list of all valid regions for Amazon Lightsail. List
GetRelationalDatabase Return informatinon about a relational database List

RelationalDatabase*

GetRelationalDatabaseBlueprints Return informatinon about all relational database blueprints List
GetRelationalDatabaseBundles Return informatinon about all relational bundles List
GetRelationalDatabaseEvents Return informatinon about the relational database events List
GetRelationalDatabaseLogEvents Return informatinon about the relational database log events List
GetRelationalDatabaseLogStreams Return informatinon about the relational database log streams List
GetRelationalDatabaseMasterUserPassword Return informatinon about the master user password Write
GetRelationalDatabaseMetricData Return informatinon about the relational database metric data List
GetRelationalDatabaseParameters Return informatinon about all relational database parameters List
GetRelationalDatabaseSnapshot Return informatinon about a relational database snapshot List

RelationalDatabase*

GetRelationalDatabaseSnapshots Return informatinon about all relational database snapshot List

RelationalDatabase*

GetRelationalDatabases Return informatinon about all relational databases List

RelationalDatabase*

GetStaticIp Returns information about a specific static IP. Read

StaticIp*

GetStaticIps Returns information about all static IPs in the user's account. List

StaticIp*

ImportKeyPair Imports a public SSH key from a specific key pair. Write

KeyPair*

IsVpcPeered Returns a Boolean value indicating whether your Lightsail VPC is peered. List
OpenInstancePublicPorts Adds public ports to an Amazon Lightsail instance. Write

Instance*

PeerVpc Tries to peer the Lightsail VPC with the user's default VPC. Write
PutInstancePublicPorts Sets the specified open ports for an instance Write

Instance*

RebootInstance Restarts a specific instance. When your Amazon Lightsail instance is finished rebooting, Lightsail assigns a new public IP address. To use the same IP address after restarting, create a static IP address and attach it to the instance. Write

Instance*

RebootRelationalDatabase Reboot a relational database. Write

RelationalDatabase*

ReleaseStaticIp Deletes a specific static IP from your account. Write

StaticIp*

StartInstance Starts a specific Amazon Lightsail instance from a stopped state. To restart an instance, use the reboot instance operation. Write

Instance*

StartRelationalDatabase Start a relational database. Write

RelationalDatabase*

StopInstance Stops a specific Amazon Lightsail instance that is currently running. Write

Instance*

StopRelationalDatabase Stop a relational database. Write

RelationalDatabase*

TagResource Tag a resource. Write

Disk

Domain

Instance

LoadBalancer

RelationalDatabase

UnpeerVpc Attempts to unpeer the Lightsail VPC from the user's default VPC. Write
UntagResource Untag a resource. Write

Disk

Domain

Instance

LoadBalancer

RelationalDatabase

UpdateDomainEntry Updates a domain RecordSet after it is created. Write

Domain*

UpdateLoadBalancerAttribute Detach instances from load balancer Write

LoadBalancer*

UpdateRelationalDatabase Update an existing relational database. Write

RelationalDatabase*

UpdateRelationalDatabaseParameters Update the parameters of the relational database. Write

Resources Defined by Amazon Lightsail

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The Resource Types Table.

Resource Types ARN Condition Keys
Domain arn:${Partition}:lightsail:${Region}:${Account}:Domain/${Id}
Instance arn:${Partition}:lightsail:${Region}:${Account}:Instance/${Id}
InstanceSnapshot arn:${Partition}:lightsail:${Region}:${Account}:InstanceSnapshot/${Id}
KeyPair arn:${Partition}:lightsail:${Region}:${Account}:KeyPair/${Id}
StaticIp arn:${Partition}:lightsail:${Region}:${Account}:StaticIp/${Id}
Disk arn:${Partition}:lightsail:${Region}:${Account}:Disk/${Id}
DiskSnapshot arn:${Partition}:lightsail:${Region}:${Account}:DiskSnapshot/${Id}
LoadBalancer arn:${Partition}:lightsail:${Region}:${Account}:LoadBalancer/${Id}
ExportSnapshotRecord arn:${Partition}:lightsail:${Region}:${Account}:ExportSnapshotRecord/${Id}
CloudFormationStackRecord arn:${Partition}:lightsail:${Region}:${Account}:CloudFormationStackRecord/${Id}
RelationalDatabase arn:${Partition}:lightsail:${Region}:${Account}:RelationalDatabase/${Id}
RelationalDatabaseSnapshot arn:${Partition}:lightsail:${Region}:${Account}:RelationalDatabaseSnapshot/${Id}

Condition Keys for Amazon Lightsail

Lightsail has no service-specific context keys that can be used in the Condition element of policy statements. For the list of the global context keys that are available to all services, see Available Keys for Conditions in the IAM Policy Reference.