AWS Identity and Access Management
User Guide

Actions, Resources, and Condition Keys for AWS IoT SiteWise

AWS IoT SiteWise (service prefix: iotsitewise) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Actions Defined by AWS IoT SiteWise

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see The Actions Table.

Actions Description Access Level Resource Types (*required) Condition Keys Dependent Actions
AssociateGatewaySink Associates the specified sink with the specified gateway. Write

gateway*

AssociateGatewaySource Associates the specified source with the specified gateway. Write

gateway*

AssociateViewEntities Associates the specified entities within a view for the specified group. Write

group*

view*

asset

CreateAsset Creates an asset. Write
CreateAssetTemplate Creates an asset template. Write
CreateGateway Creates a gateway. Write
CreateGroup Creates a group. Write
CreateMeasurementDataStore Registers a measurement data store. Write
CreateMetricType Creates a metric type. Write
CreateView Creates a view. Write
DeleteAsset Deletes the specified asset. Write

asset*

DeleteAssetTemplate Deletes the specified asset template. Write

asset-template*

DeleteGateway Deletes the specified gateway. Write

gateway*

DeleteGroup Deletes the specified group. Write

group*

DeleteMeasurementDataStore Deregisters the specified measurement data store. Write

measurement-data-store*

DeleteMetricType Deletes the specified metric type. Write

metric-type*

DeleteView Deletes the specified view. Write

view*

DeregisterViewEntities Deregisters the specified assets and groups from the specified view. Write

view*

asset

group

DescribeAssetTemplates Describes the specified asset templates. Read

asset-template*

DescribeAssets Describes the specified assets. Read

asset*

DescribeGateways Describes the gateways for the account. Read

gateway*

DescribeGroups Describes the groups for the account. Read

group*

DescribeMeasurementDataStores Describes the specified measurement data stores. Read

measurement-data-store*

DescribeMetricTypes Describes the metric types for the account. Read

metric-type*

DescribeViews Describes the specified views. Read

view*

DisassociateGatewaySink Disassociates the specified sink from the specified gateway. Write

gateway*

DisassociateGatewaySource Disassociates the specified source from the specified gateway. Write

gateway*

DisassociateViewEntities Disassociates the specified entities within a view for the specified group. Write

group*

view*

asset

GetMeasurementData Fetches the measurement data for the specified measurement and time interval. Read

measurement*

GetMetricData Fetches the metric data for the specified metric and time interval. Read

metric*

ListAssetTemplates Lists the asset templates for the account. List
ListAssets Lists the assets for the account. List
ListGateways Lists the gateways for the account. List
ListGroups Lists the groups for the account. List
ListMeasurementDataStores Lists the measurement data stores for the account. List
ListMeasurementDataStreams Lists the measurement data streams for the specified measurement data store. List

measurement-data-store*

ListMetricTypes Lists the metric types for the account. List
ListViewEntities Lists the assets and groups for the specified view. List

view*

asset

group

ListViews Lists the views for the account. List
RegisterViewEntities Registers the specified assets and groups with the specified view. Write

view*

asset

group

UpdateAsset Updates the specified asset. Write

asset*

UpdateAssetTemplate Updates the specified asset template. Write

asset-template*

UpdateGateway Updates the specified gateway. Write

gateway*

UpdateGroup Updates the specified group. Write

group*

UpdateMeasurementDataStore Updates metadata about the measurement data store. Write

measurement-data-store*

UpdateView Updates the specified view. Write

view*

Resources Defined by AWS IoT SiteWise

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The Resource Types Table.

Resource Types ARN Condition Keys
asset arn:${Partition}:iotsitewise:${Region}:${Account}:asset/${AssetId}
asset-template arn:${Partition}:iotsitewise:${Region}:${Account}:asset-template/${AssetTemplateId}
gateway arn:${Partition}:iotsitewise:${Region}:${Account}:gateway/${GatewayId}
group arn:${Partition}:iotsitewise:${Region}:${Account}:group/${GroupId}
measurement arn:${Partition}:iotsitewise:${Region}:${Account}:measurement/${MeasurementId}
measurement-data-store arn:${Partition}:iotsitewise:${Region}:${Account}:measurement-data-store/${MeasurementDataStoreId}
metric arn:${Partition}:iotsitewise:${Region}:${Account}:metric/${MetricId}
metric-type arn:${Partition}:iotsitewise:${Region}:${Account}:metric-type/${MetricTypeId}
view arn:${Partition}:iotsitewise:${Region}:${Account}:view/${ViewId}

Condition Keys for AWS IoT SiteWise

IoT SiteWise has no service-specific context keys that can be used in the Condition element of policy statements. For the list of the global context keys that are available to all services, see Available Keys for Conditions in the IAM Policy Reference.