Actions, resources, and condition keys for Amazon Pinpoint - AWS Identity and Access Management

Actions, resources, and condition keys for Amazon Pinpoint

Tip

This page is moving to a new location on November 16, 2020. Please update your bookmark to use the new page at https://docs.aws.amazon.com/service-authorization/latest/reference/list_amazonpinpoint.html.

Amazon Pinpoint (service prefix: mobiletargeting) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Actions defined by Amazon Pinpoint

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see The actions table.

Actions Description Access level Resource types (*required) Condition keys Dependent actions
CreateApp Create an app. Write

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreateCampaign Create a campaign for an app. Write

apps*

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreateEmailTemplate Create an email template. Write

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreateExportJob Create an export job that exports endpoint definitions to Amazon S3. Write

apps*

CreateImportJob Import endpoint definitions from to create a segment. Write

apps*

CreateJourney Create a Journey for an app. Write

apps*

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreatePushTemplate Create a push notification template. Write

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreateRecommenderConfiguration Create an Amazon Pinpoint configuration for a recommender model. Write
CreateSegment Create a segment that is based on endpoint data reported to Pinpoint by your app. To allow a user to create a segment by importing endpoint data from outside of Pinpoint, allow the mobiletargeting:CreateImportJob action. Write

apps*

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreateSmsTemplate Create an sms message template. Write

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreateVoiceTemplate Create a voice message template. Write

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

DeleteAdmChannel Delete the ADM channel for an app. Write

apps*

DeleteApnsChannel Delete the APNs channel for an app. Write

apps*

DeleteApnsSandboxChannel Delete the APNs sandbox channel for an app. Write

apps*

DeleteApnsVoipChannel Delete the APNs VoIP channel for an app. Write

apps*

DeleteApnsVoipSandboxChannel Delete the APNs VoIP sandbox channel for an app. Write

apps*

DeleteApp Delete a specific campaign. Write

apps*

DeleteBaiduChannel Delete the Baidu channel for an app. Write

apps*

DeleteCampaign Delete a specific campaign. Write

apps*

campaigns*

DeleteEmailChannel Delete the email channel for an app. Write

apps*

DeleteEmailTemplate Delete an email template or an email template version. Write

templates*

DeleteEndpoint Delete an endpoint. Write

apps*

DeleteEventStream Delete the event stream for an app. Write

apps*

DeleteGcmChannel Delete the GCM channel for an app. Write

apps*

DeleteJourney Delete a specific journey. Write

apps*

journeys*

DeletePushTemplate Delete a push notification template or a push notification template version. Write

templates*

DeleteRecommenderConfiguration Delete an Amazon Pinpoint configuration for a recommender model. Write

recommenders*

DeleteSegment Delete a specific segment. Write

apps*

segments*

DeleteSmsChannel Delete the SMS channel for an app. Write

apps*

DeleteSmsTemplate Delete an sms message template or an sms message template version. Write

templates*

DeleteUserEndpoints Delete all of the endpoints that are associated with a user ID. Write

apps*

DeleteVoiceChannel Delete the Voice channel for an app. Write

apps*

DeleteVoiceTemplate Delete a voice message template or a voice message template version. Write

templates*

GetAdmChannel Retrieve information about the Amazon Device Messaging (ADM) channel for an app. Read

apps*

GetApnsChannel Retrieve information about the APNs channel for an app. Read

apps*

GetApnsSandboxChannel Retrieve information about the APNs sandbox channel for an app. Read

apps*

GetApnsVoipChannel Retrieve information about the APNs VoIP channel for an app. Read

apps*

GetApnsVoipSandboxChannel Retrieve information about the APNs VoIP sandbox channel for an app. Read

apps*

GetApp Retrieve information about a specific app in your Amazon Pinpoint account. Read

apps*

GetApplicationSettings Retrieve the default settings for an app. List

apps*

GetApps Retrieve a list of apps in your Amazon Pinpoint account. List

apps*

GetBaiduChannel Retrieve information about the Baidu channel for an app. Read

apps*

GetCampaign Retrieve information about a specific campaign. Read

apps*

campaigns*

GetCampaignActivities Retrieve information about the activities performed by a campaign. List

apps*

campaigns*

GetCampaignVersion Retrieve information about a specific campaign version. Read

apps*

campaigns*

GetCampaignVersions Retrieve information about the current and prior versions of a campaign. List

apps*

campaigns*

GetCampaigns Retrieve information about all campaigns for an app. List

apps*

GetChannels Get all channels information for your app. List

apps*

GetEmailChannel Obtain information about the email channel in an app. Read

apps*

GetEmailTemplate Retrieve information about a specific or the active version of an email template. Read

templates*

GetEndpoint Retrieve information about a specific endpoint. Read

apps*

GetEventStream Retrieve information about the event stream for an app. Read

apps*

GetExportJob Obtain information about a specific export job. Read

apps*

GetExportJobs Retrieve a list of all of the export jobs for an app. List

apps*

GetGcmChannel Retrieve information about the GCM channel for an app. Read

apps*

GetImportJob Retrieve information about a specific import job. Read

apps*

GetImportJobs Retrieve information about all import jobs for an app. List

apps*

GetJourney Retrieve information about a specific journey. Read

apps*

journeys*

GetPushTemplate Retrieve information about a specific or the active version of an push notification template. Read

templates*

GetRecommenderConfiguration Retrieve information about an Amazon Pinpoint configuration for a recommender model. Read

recommenders*

GetRecommenderConfigurations Retrieve information about all the recommender model configurations that are associated with an Amazon Pinpoint account. List
GetSegment Retrieve information about a specific segment. Read

apps*

segments*

GetSegmentExportJobs Retrieve information about jobs that export endpoint definitions from segments to Amazon S3. List

apps*

segments*

GetSegmentImportJobs Retrieve information about jobs that create segments by importing endpoint definitions from . List

apps*

segments*

GetSegmentVersion Retrieve information about a specific segment version. Read

apps*

segments*

GetSegmentVersions Retrieve information about the current and prior versions of a segment. List

apps*

segments*

GetSegments Retrieve information about the segments for an app. List

apps*

GetSmsChannel Obtain information about the SMS channel in an app. Read

apps*

GetSmsTemplate Retrieve information about a specific or the active version of an sms message template. Read

templates*

GetUserEndpoints Retrieve information about the endpoints that are associated with a user ID. Read

apps*

GetVoiceChannel Obtain information about the Voice channel in an app. Read

apps*

GetVoiceTemplate Retrieve information about a specific or the active version of a voice message template. Read

templates*

ListJourneys Retrieve information about all journeys for an app. List

apps*

ListTagsForResource List tags for a resource. List

apps

campaigns

segments

ListTemplateVersions Retrieve all versions about a specific template. List

templates*

ListTemplates Retrieve metadata about the queried templates. List

templates*

PhoneNumberValidate Obtain metadata for a phone number, such as the number type (mobile, landline, or VoIP), location, and provider. Read

apps*

PutEventStream Create or update an event stream for an app. Write

apps*

PutEvents Create or update events for an app. Write

apps*

RemoveAttributes Used to remove the attributes for an app. Write

apps*

SendMessages Send an SMS message or push notification to specific endpoints. Write

apps*

SendUsersMessages Send an SMS message or push notification to all endpoints that are associated with a specific user ID. Write

apps*

TagResource Adds tags to a resource. Tagging

apps

campaigns

segments

aws:RequestTag/${TagKey}

aws:TagKeys

UntagResource Removes tags from a resource. Tagging

apps

campaigns

segments

aws:RequestTag/${TagKey}

aws:TagKeys

UpdateAdmChannel Update the Amazon Device Messaging (ADM) channel for an app. Write

apps*

UpdateApnsChannel Update the Apple Push Notification service (APNs) channel for an app. Write

apps*

UpdateApnsSandboxChannel Update the Apple Push Notification service (APNs) sandbox channel for an app. Write

apps*

UpdateApnsVoipChannel Update the Apple Push Notification service (APNs) VoIP channel for an app. Write

apps*

UpdateApnsVoipSandboxChannel Update the Apple Push Notification service (APNs) VoIP sandbox channel for an app. Write

apps*

UpdateApplicationSettings Update the default settings for an app. Write

apps*

UpdateBaiduChannel Update the Baidu channel for an app. Write

apps*

UpdateCampaign Update a specific campaign. Write

apps*

campaigns*

aws:RequestTag/${TagKey}

aws:TagKeys

UpdateEmailChannel Update the email channel for an app. Write

apps*

UpdateEmailTemplate Update a specific email template under the same version or generate a new version. Write

templates*

aws:RequestTag/${TagKey}

aws:TagKeys

UpdateEndpoint Create an endpoint or update the information for an endpoint. Write

apps*

UpdateEndpointsBatch Create or update endpoints as a batch operation. Write

apps*

UpdateGcmChannel Update the Firebase Cloud Messaging (FCM) or Google Cloud Messaging (GCM) API key that allows to send push notifications to your Android app. Write

apps*

UpdateJourney Update a specific journey. Write

apps*

journeys*

aws:RequestTag/${TagKey}

aws:TagKeys

UpdateJourneyState Update a specific journey state. Write

apps*

journeys*

aws:RequestTag/${TagKey}

aws:TagKeys

UpdatePushTemplate Update a specific push notification template under the same version or generate a new version. Write

templates*

aws:RequestTag/${TagKey}

aws:TagKeys

UpdateRecommenderConfiguration Update an Amazon Pinpoint configuration for a recommender model. Write

recommenders*

UpdateSegment Update a specific segment. Write

apps*

segments*

aws:RequestTag/${TagKey}

aws:TagKeys

UpdateSmsChannel Update the SMS channel for an app. Write

apps*

UpdateSmsTemplate Update a specific sms message template under the same version or generate a new version. Write

templates*

aws:RequestTag/${TagKey}

aws:TagKeys

UpdateTemplateActiveVersion Upate the active version parameter of a specific template. Write

templates*

UpdateVoiceChannel Update the Voice channel for an app. Write

apps*

UpdateVoiceTemplate Update a specific voice message template under the same version or generate a new version. Write

templates*

aws:RequestTag/${TagKey}

aws:TagKeys

Resource types defined by Amazon Pinpoint

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The resource types table.

Resource types ARN Condition keys
apps arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}

aws:ResourceTag/${TagKey}

campaigns arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/campaigns/${CampaignId}

aws:ResourceTag/${TagKey}

journeys arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/journeys/${JourneyId}

aws:ResourceTag/${TagKey}

segments arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/segments/${SegmentId}

aws:ResourceTag/${TagKey}

templates arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/${ChannelType}

aws:ResourceTag/${TagKey}

recommenders arn:${Partition}:mobiletargeting:${Region}:${Account}:recommenders/${RecommenderId}

Condition keys for Amazon Pinpoint

Amazon Pinpoint defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys Description Type
aws:RequestTag/${TagKey} Filters access by a key that is present in the request the user makes to the pinpoint service. String
aws:ResourceTag/${TagKey} Filters access by a tag key and value pair. String
aws:TagKeys Filters access by the list of all the tag key names present in the request the user makes to the pinpoint service. String