Actions, resources, and condition keys for Amazon Pinpoint

Amazon Pinpoint (service prefix: mobiletargeting) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Topics

Actions defined by Amazon Pinpoint
Resource types defined by Amazon Pinpoint
Condition keys for Amazon Pinpoint

Actions defined by Amazon Pinpoint

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys
CreateApp	Grants permission to create an app	Write	apps*
CreateApp	Grants permission to create an app	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateCampaign	Grants permission to create a campaign for an app	Write	app*
CreateCampaign	Grants permission to create a campaign for an app	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateEmailTemplate	Grants permission to create an email template	Write	template*
CreateEmailTemplate	Grants permission to create an email template	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateExportJob	Grants permission to create an export job that exports endpoint definitions to Amazon S3	Write	app*
CreateImportJob	Grants permission to import endpoint definitions from to create a segment	Write	app*
CreateInAppTemplate	Grants permission to create an in-app message template	Write	template*
CreateInAppTemplate	Grants permission to create an in-app message template	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateJourney	Grants permission to create a Journey for an app	Write	journeys*
CreateJourney	Grants permission to create a Journey for an app	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreatePushTemplate	Grants permission to create a push notification template	Write	template*
CreatePushTemplate	Grants permission to create a push notification template	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateRecommenderConfiguration	Grants permission to create an Amazon Pinpoint configuration for a recommender model	Write	recommenders*
CreateSegment	Grants permission to create a segment that is based on endpoint data reported to Pinpoint by your app. To allow a user to create a segment by importing endpoint data from outside of Pinpoint, allow the mobiletargeting:CreateImportJob action	Write	app*
CreateSegment		Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateSmsTemplate	Grants permission to create an sms message template	Write	template*
CreateSmsTemplate	Grants permission to create an sms message template	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateVoiceTemplate	Grants permission to create a voice message template	Write	template*
CreateVoiceTemplate	Grants permission to create a voice message template	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
DeleteAdmChannel	Grants permission to delete the ADM channel for an app	Write	channel*
DeleteApnsChannel	Grants permission to delete the APNs channel for an app	Write	channel*
DeleteApnsSandboxChannel	Grants permission to delete the APNs sandbox channel for an app	Write	channel*
DeleteApnsVoipChannel	Grants permission to delete the APNs VoIP channel for an app	Write	channel*
DeleteApnsVoipSandboxChannel	Grants permission to delete the APNs VoIP sandbox channel for an app	Write	channel*
DeleteApp	Grants permission to delete a specific campaign	Write	app*
DeleteBaiduChannel	Grants permission to delete the Baidu channel for an app	Write	channel*
DeleteCampaign	Grants permission to delete a specific campaign	Write	campaign*
DeleteEmailChannel	Grants permission to delete the email channel for an app	Write	channel*
DeleteEmailTemplate	Grants permission to delete an email template or an email template version	Write	template*
DeleteEndpoint	Grants permission to delete an endpoint	Write	endpoint*
DeleteEventStream	Grants permission to delete the event stream for an app	Write	event-stream*
DeleteGcmChannel	Grants permission to delete the GCM channel for an app	Write	channel*
DeleteInAppTemplate	Grants permission to delete an in-app message template or an in-app message template version	Write	template*
DeleteJourney	Grants permission to delete a specific journey	Write	journey*
DeletePushTemplate	Grants permission to delete a push notification template or a push notification template version	Write	template*
DeleteRecommenderConfiguration	Grants permission to delete an Amazon Pinpoint configuration for a recommender model	Write	recommender*
DeleteSegment	Grants permission to delete a specific segment	Write	segment*
DeleteSmsChannel	Grants permission to delete the SMS channel for an app	Write	channel*
DeleteSmsTemplate	Grants permission to delete an sms message template or an sms message template version	Write	template*
DeleteUserEndpoints	Grants permission to delete all of the endpoints that are associated with a user ID	Write	user*
DeleteVoiceChannel	Grants permission to delete the Voice channel for an app	Write	channel*
DeleteVoiceTemplate	Grants permission to delete a voice message template or a voice message template version	Write	template*
GetAdmChannel	Grants permission to retrieve information about the Amazon Device Messaging (ADM) channel for an app	Read	channel*
GetApnsChannel	Grants permission to retrieve information about the APNs channel for an app	Read	channel*
GetApnsSandboxChannel	Grants permission to retrieve information about the APNs sandbox channel for an app	Read	channel*
GetApnsVoipChannel	Grants permission to retrieve information about the APNs VoIP channel for an app	Read	channel*
GetApnsVoipSandboxChannel	Grants permission to retrieve information about the APNs VoIP sandbox channel for an app	Read	channel*
GetApp	Grants permission to retrieve information about a specific app in your Amazon Pinpoint account	Read	app*
GetApplicationDateRangeKpi	Grants permission to retrieve (queries) pre-aggregated data for a standard metric that applies to an application	Read	application-metrics*
GetApplicationSettings	Grants permission to retrieve the default settings for an app	List	app*
GetApps	Grants permission to retrieve a list of apps in your Amazon Pinpoint account	Read	apps*
GetBaiduChannel	Grants permission to retrieve information about the Baidu channel for an app	Read	channel*
GetCampaign	Grants permission to retrieve information about a specific campaign	Read	campaign*
GetCampaignActivities	Grants permission to retrieve information about the activities performed by a campaign	List	campaign*
GetCampaignDateRangeKpi	Grants permission to retrieve (queries) pre-aggregated data for a standard metric that applies to a campaign	Read	campaign-metrics*
GetCampaignVersion	Grants permission to retrieve information about a specific campaign version	Read	campaign*
GetCampaignVersions	Grants permission to retrieve information about the current and prior versions of a campaign	List	campaign*
GetCampaigns	Grants permission to retrieve information about all campaigns for an app	List	app*
GetChannels	Grants permission to get all channels information for your app	List	channels*
GetEmailChannel	Grants permission to obtain information about the email channel in an app	Read	channel*
GetEmailTemplate	Grants permission to retrieve information about a specific or the active version of an email template	Read	template*
GetEndpoint	Grants permission to retrieve information about a specific endpoint	Read	endpoint*
GetEventStream	Grants permission to retrieve information about the event stream for an app	Read	event-stream*
GetExportJob	Grants permission to obtain information about a specific export job	Read	export-job*
GetExportJobs	Grants permission to retrieve a list of all of the export jobs for an app	List	app*
GetGcmChannel	Grants permission to retrieve information about the GCM channel for an app	Read	channel*
GetImportJob	Grants permission to retrieve information about a specific import job	Read	import-job*
GetImportJobs	Grants permission to retrieve information about all import jobs for an app	List	app*
GetInAppMessages	Grants permission to retrive in-app messages for the given endpoint id	Read	app*
GetInAppTemplate	Grants permission to retrieve information about a specific or the active version of an in-app message template	Read	template*
GetJourney	Grants permission to retrieve information about a specific journey	Read	journey*
GetJourneyDateRangeKpi	Grants permission to retrieve (queries) pre-aggregated data for a standard engagement metric that applies to a journey	Read	journey-metrics*
GetJourneyExecutionActivityMetrics	Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey activity	Read	journey-execution-activity-metrics*
GetJourneyExecutionMetrics	Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey	Read	journey-execution-metrics*
GetJourneyRunExecutionActivityMetrics	Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey activity for a single journey run	Read	journey*
GetJourneyRunExecutionMetrics	Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey for a single journey run	Read	journey*
GetJourneyRuns	Grants permission to retrieve information about all journey runs for a journey	List	journey*
GetPushTemplate	Grants permission to retrieve information about a specific or the active version of an push notification template	Read	template*
GetRecommenderConfiguration	Grants permission to retrieve information about an Amazon Pinpoint configuration for a recommender model	Read	recommender*
GetRecommenderConfigurations	Grants permission to retrieve information about all the recommender model configurations that are associated with an Amazon Pinpoint account	List	recommenders*
GetReports [permission only]	Grants permission to mobiletargeting:GetReports	Read	reports*
GetSegment	Grants permission to retrieve information about a specific segment	Read	segment*
GetSegmentExportJobs	Grants permission to retrieve information about jobs that export endpoint definitions from segments to Amazon S3	List	segment*
GetSegmentImportJobs	Grants permission to retrieve information about jobs that create segments by importing endpoint definitions from	List	segment*
GetSegmentVersion	Grants permission to retrieve information about a specific segment version	Read	segment*
GetSegmentVersions	Grants permission to retrieve information about the current and prior versions of a segment	List	segment*
GetSegments	Grants permission to retrieve information about the segments for an app	List	app*
GetSmsChannel	Grants permission to obtain information about the SMS channel in an app	Read	channel*
GetSmsTemplate	Grants permission to retrieve information about a specific or the active version of an sms message template	Read	template*
GetUserEndpoints	Grants permission to retrieve information about the endpoints that are associated with a user ID	Read	user*
GetVoiceChannel	Grants permission to obtain information about the Voice channel in an app	Read	channel*
GetVoiceTemplate	Grants permission to retrieve information about a specific or the active version of a voice message template	Read	template*
ListJourneys	Grants permission to retrieve information about all journeys for an app	List	app*
ListTagsForResource	Grants permission to list tags for a resource	Read	app
			campaign
			journey
			segment
			template
ListTemplateVersions	Grants permission to retrieve all versions about a specific template	List	template*
ListTemplates	Grants permission to retrieve metadata about the queried templates	List	templates*
PhoneNumberValidate	Grants permission to obtain metadata for a phone number, such as the number type (mobile, landline, or VoIP), location, and provider	Read	phone-number-validate*
PutEventStream	Grants permission to create or update an event stream for an app	Write	event-stream*
PutEvents	Grants permission to create or update events for an app	Write	events*
RemoveAttributes	Grants permission to remove the attributes for an app	Write	attribute*
SendMessages	Grants permission to send an SMS message or push notification to specific endpoints	Write	messages*
SendOTPMessage	Grants permission to send an OTP code to a user of your application	Write	otp*
SendUsersMessages	Grants permission to send an SMS message or push notification to all endpoints that are associated with a specific user ID	Write	messages*
TagResource	Grants permission to add tags to a resource	Tagging	app
			campaign
			journey
			segment
			template
				aws:RequestTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from a resource	Tagging	app
			campaign
			journey
			segment
			template
				aws:RequestTag/${TagKey} aws:TagKeys
UpdateAdmChannel	Grants permission to update the Amazon Device Messaging (ADM) channel for an app	Write	channel*
UpdateApnsChannel	Grants permission to update the Apple Push Notification service (APNs) channel for an app	Write	channel*
UpdateApnsSandboxChannel	Grants permission to update the Apple Push Notification service (APNs) sandbox channel for an app	Write	channel*
UpdateApnsVoipChannel	Grants permission to update the Apple Push Notification service (APNs) VoIP channel for an app	Write	channel*
UpdateApnsVoipSandboxChannel	Grants permission to update the Apple Push Notification service (APNs) VoIP sandbox channel for an app	Write	channel*
UpdateApplicationSettings	Grants permission to update the default settings for an app	Write	app*
UpdateBaiduChannel	Grants permission to update the Baidu channel for an app	Write	channel*
UpdateCampaign	Grants permission to update a specific campaign	Write	campaign*
UpdateCampaign	Grants permission to update a specific campaign	Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateEmailChannel	Grants permission to update the email channel for an app	Write	channel*
UpdateEmailTemplate	Grants permission to update a specific email template under the same version or generate a new version	Write	template*
UpdateEmailTemplate		Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateEndpoint	Grants permission to create an endpoint or update the information for an endpoint	Write	endpoint*
UpdateEndpointsBatch	Grants permission to create or update endpoints as a batch operation	Write	app*
UpdateGcmChannel	Grants permission to update the Firebase Cloud Messaging (FCM) or Google Cloud Messaging (GCM) API key that allows to send push notifications to your Android app	Write	channel*
UpdateInAppTemplate	Grants permission to update a specific in-app message template under the same version or generate a new version	Write	template*
UpdateInAppTemplate		Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateJourney	Grants permission to update a specific journey	Write	journey*
UpdateJourney	Grants permission to update a specific journey	Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateJourneyState	Grants permission to update a specific journey state	Write	journey*
UpdateJourneyState	Grants permission to update a specific journey state	Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdatePushTemplate	Grants permission to update a specific push notification template under the same version or generate a new version	Write	template*
UpdatePushTemplate		Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateRecommenderConfiguration	Grants permission to update an Amazon Pinpoint configuration for a recommender model	Write	recommender*
UpdateSegment	Grants permission to update a specific segment	Write	segment*
UpdateSegment	Grants permission to update a specific segment	Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateSmsChannel	Grants permission to update the SMS channel for an app	Write	channel*
UpdateSmsTemplate	Grants permission to update a specific sms message template under the same version or generate a new version	Write	template*
UpdateSmsTemplate		Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateTemplateActiveVersion	Grants permission to update the active version parameter of a specific template	Write	template*
UpdateVoiceChannel	Grants permission to update the Voice channel for an app	Write	channel*
UpdateVoiceTemplate	Grants permission to update a specific voice message template under the same version or generate a new version	Write	template*
UpdateVoiceTemplate		Write		aws:RequestTag/${TagKey} aws:TagKeys
VerifyOTPMessage	Grants permission to check the validity of One-Time Passwords (OTPs)	Write	verify-otp*

Resource types defined by Amazon Pinpoint

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
app	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}`	aws:ResourceTag/${TagKey}
apps	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/*`
campaign	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/campaigns/${CampaignId}`	aws:ResourceTag/${TagKey}
journey	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/journeys/${JourneyId}`	aws:ResourceTag/${TagKey}
journeys	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/journeys`
segment	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/segments/${SegmentId}`	aws:ResourceTag/${TagKey}
template	`arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/${TemplateType}`	aws:ResourceTag/${TagKey}
templates	`arn:${Partition}:mobiletargeting:${Region}:${Account}:templates`
recommender	`arn:${Partition}:mobiletargeting:${Region}:${Account}:recommenders/${RecommenderId}`
recommenders	`arn:${Partition}:mobiletargeting:${Region}:${Account}:recommenders/*`
phone-number-validate	`arn:${Partition}:mobiletargeting:${Region}:${Account}:phone/number/validate`
channels	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/channels`
channel	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/channels/${ChannelType}`
event-stream	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/eventstream`
events	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/events`
messages	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/messages`
verify-otp	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/verify-otp`
otp	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/otp`
attribute	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/attributes/${AttributeType}`
user	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/users/${UserId}`
endpoint	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/endpoints/${EndpointId}`
import-job	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/jobs/import/${JobId}`
export-job	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/jobs/export/${JobId}`
application-metrics	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/kpis/daterange/${KpiName}`
campaign-metrics	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/campaigns/${CampaignId}/kpis/daterange/${KpiName}`
journey-metrics	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/journeys/${JourneyId}/kpis/daterange/${KpiName}`
journey-execution-metrics	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/journeys/${JourneyId}/execution-metrics`
journey-execution-activity-metrics	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/journeys/${JourneyId}/activities/${JourneyActivityId}/execution-metrics`
reports	`arn:${Partition}:mobiletargeting:${Region}:${Account}:reports`

Condition keys for Amazon Pinpoint

Amazon Pinpoint defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a key that is present in the request the user makes to the pinpoint service	String
aws:ResourceTag/${TagKey}	Filters access by a tag key and value pair	String
aws:TagKeys	Filters access by the list of all the tag key names present in the request the user makes to the pinpoint service	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Personalize

Amazon Pinpoint Email Service