AWS Identity and Access Management
User Guide

The AWS Documentation website is getting a new look!
Try it now and let us know what you think. Switch to the new look >>

You can return to the original look by selecting English in the language selector above.

Actions, Resources, and Condition Keys for Amazon Pinpoint

Amazon Pinpoint (service prefix: mobiletargeting) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Actions Defined by Amazon Pinpoint

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see The Actions Table.

Actions Description Access Level Resource Types (*required) Condition Keys Dependent Actions
CreateApp Create an app. Write

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreateCampaign Create a campaign for an app. Write

apps*

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreateExportJob Create an export job that exports endpoint definitions to Amazon S3. Write

apps*

CreateImportJob Import endpoint definitions from to create a segment. Write

apps*

CreateSegment Create a segment that is based on endpoint data reported to Pinpoint by your app. To allow a user to create a segment by importing endpoint data from outside of Pinpoint, allow the mobiletargeting:CreateImportJob action. Write

apps*

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

DeleteAdmChannel Delete the ADM channel for an app. Write

apps*

DeleteApnsChannel Delete the APNs channel for an app. Write

apps*

DeleteApnsSandboxChannel Delete the APNs sandbox channel for an app. Write

apps*

DeleteApnsVoipChannel Delete the APNs VoIP channel for an app. Write

apps*

DeleteApnsVoipSandboxChannel Delete the APNs VoIP sandbox channel for an app. Write

apps*

DeleteApp Delete a specific campaign. Write

apps*

DeleteBaiduChannel Delete the Baidu channel for an app. Write

apps*

DeleteCampaign Delete a specific campaign. Write

apps*

campaigns*

aws:ResourceTag/${TagKey}

DeleteEmailChannel Delete the email channel for an app. Write

apps*

DeleteEndpoint Delete an endpoint. Write

apps*

DeleteEventStream Delete the event stream for an app. Write

apps*

DeleteGcmChannel Delete the GCM channel for an app. Write

apps*

DeleteSegment Delete a specific segment. Write

apps*

segments*

aws:ResourceTag/${TagKey}

DeleteSmsChannel Delete the SMS channel for an app. Write

apps*

DeleteUserEndpoints Delete all of the endpoints that are associated with a user ID. Write

apps*

DeleteVoiceChannel Delete the Voice channel for an app. Write

apps*

GetAdmChannel Retrieve information about the Amazon Device Messaging (ADM) channel for an app. Read

apps*

GetApnsChannel Retrieve information about the APNs channel for an app. Read

apps*

GetApnsSandboxChannel Retrieve information about the APNs sandbox channel for an app. Read

apps*

GetApnsVoipChannel Retrieve information about the APNs VoIP channel for an app. Read

apps*

GetApnsVoipSandboxChannel Retrieve information about the APNs VoIP sandbox channel for an app. Read

apps*

GetApp Retrieve information about a specific app in your Amazon Pinpoint account. Read

apps*

aws:ResourceTag/${TagKey}

GetApplicationSettings Retrieve the default settings for an app. List

apps*

GetApps Retrieve a list of apps in your Amazon Pinpoint account. List

apps*

aws:ResourceTag/${TagKey}

GetBaiduChannel Retrieve information about the Baidu channel for an app. Read

apps*

GetCampaign Retrieve information about a specific campaign. Read

apps*

campaigns*

aws:ResourceTag/${TagKey}

GetCampaignActivities Retrieve information about the activities performed by a campaign. List

apps*

campaigns*

GetCampaignVersion Retrieve information about a specific campaign version. Read

apps*

campaigns*

aws:ResourceTag/${TagKey}

GetCampaignVersions Retrieve information about the current and prior versions of a campaign. List

apps*

campaigns*

aws:ResourceTag/${TagKey}

GetCampaigns Retrieve information about all campaigns for an app. List

apps*

aws:ResourceTag/${TagKey}

GetChannels Get all channels information for your app. List

apps*

GetEmailChannel Obtain information about the email channel in an app. Read

apps*

GetEndpoint Retrieve information about a specific endpoint. Read

apps*

GetEventStream Retrieve information about the event stream for an app. Read

apps*

GetExportJob Obtain information about a specific export job. Read

apps*

GetExportJobs Retrieve a list of all of the export jobs for an app. List

apps*

GetGcmChannel Retrieve information about the GCM channel for an app. Read

apps*

GetImportJob Retrieve information about a specific import job. Read

apps*

GetImportJobs Retrieve information about all import jobs for an app. List

apps*

GetSegment Retrieve information about a specific segment. Read

apps*

segments*

aws:ResourceTag/${TagKey}

GetSegmentExportJobs Retrieve information about jobs that export endpoint definitions from segments to Amazon S3. List

apps*

segments*

GetSegmentImportJobs Retrieve information about jobs that create segments by importing endpoint definitions from . List

apps*

segments*

GetSegmentVersion Retrieve information about a specific segment version. Read

apps*

segments*

aws:ResourceTag/${TagKey}

GetSegmentVersions Retrieve information about the current and prior versions of a segment. List

apps*

segments*

aws:ResourceTag/${TagKey}

GetSegments Retrieve information about the segments for an app. List

apps*

aws:ResourceTag/${TagKey}

GetSmsChannel Obtain information about the SMS channel in an app. Read

apps*

GetUserEndpoints Retrieve information about the endpoints that are associated with a user ID. Read

apps*

GetVoiceChannel Obtain information about the Voice channel in an app. Read

apps*

ListTagsForResource List tags for a resource. List

apps

campaigns

segments

aws:ResourceTag/${TagKey}

PhoneNumberValidate Obtain metadata for a phone number, such as the number type (mobile, landline, or VoIP), location, and provider. Read

apps*

PutEventStream Create or update an event stream for an app. Write

apps*

PutEvents Create or update events for an app. Write

apps*

RemoveAttributes Used to remove the attributes for an app. Write

apps*

SendMessages Send an SMS message or push notification to specific endpoints. Write

apps*

SendUsersMessages Send an SMS message or push notification to all endpoints that are associated with a specific user ID. Write

apps*

TagResource Adds tags to a resource. Tagging

apps

campaigns

segments

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

UntagResource Removes tags from a resource. Tagging

apps

campaigns

segments

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

UpdateAdmChannel Update the Amazon Device Messaging (ADM) channel for an app. Write

apps*

UpdateApnsChannel Update the Apple Push Notification service (APNs) channel for an app. Write

apps*

UpdateApnsSandboxChannel Update the Apple Push Notification service (APNs) sandbox channel for an app. Write

apps*

UpdateApnsVoipChannel Update the Apple Push Notification service (APNs) VoIP channel for an app. Write

apps*

UpdateApnsVoipSandboxChannel Update the Apple Push Notification service (APNs) VoIP sandbox channel for an app. Write

apps*

UpdateApplicationSettings Update the default settings for an app. Write

apps*

UpdateBaiduChannel Update the Baidu channel for an app. Write

apps*

UpdateCampaign Update a specific campaign. Write

apps*

campaigns*

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

UpdateEmailChannel Update the email channel for an app. Write

apps*

UpdateEndpoint Create an endpoint or update the information for an endpoint. Write

apps*

UpdateEndpointsBatch Create or update endpoints as a batch operation. Write

apps*

UpdateGcmChannel Update the Firebase Cloud Messaging (FCM) or Google Cloud Messaging (GCM) API key that allows to send push notifications to your Android app. Write

apps*

UpdateSegment Update a specific segment. Write

apps*

segments*

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

UpdateSmsChannel Update the SMS channel for an app. Write

apps*

UpdateVoiceChannel Update the Voice channel for an app. Write

apps*

Resources Defined by Amazon Pinpoint

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The Resource Types Table.

Resource Types ARN Condition Keys
apps arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}

aws:ResourceTag/${TagKey}

campaigns arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/campaigns/${CampaignId}

aws:ResourceTag/${TagKey}

segments arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/segments/${SegmentId}

aws:ResourceTag/${TagKey}

Condition Keys for Amazon Pinpoint

Amazon Pinpoint defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The Condition Keys Table.

To view the global condition keys that are available to all services, see Available Global Condition Keys in the IAM Policy Reference.

Condition Keys Description Type
aws:RequestTag/${TagKey} Filters access by a key that is present in the request the user makes to the pinpoint service. String
aws:ResourceTag/${TagKey} Filters access by a tag key and value pair. String
aws:TagKeys Filters access by the list of all the tag key names present in the request the user makes to the pinpoint service. String