Amazon Chime SDK identity-based policy examples

By default, IAM users and roles don't have permission to create or modify Amazon Chime SDK resources. They also can't perform tasks using the AWS Management Console, AWS CLI, or AWS API. An IAM administrator must create IAM policies that grant users and roles permission to perform specific API operations on the specified resources they need. The administrator must then attach those policies to the IAM users or groups that require those permissions.

To learn how to create an IAM identity-based policy using these example JSON policy documents, see Creating policies on the JSON tab in the IAM User Guide.

Policy best practices

Identity-based policies are very powerful. They determine whether someone can create, access, or delete Amazon Chime SDK resources in your account. These actions can incur costs for your AWS account. When you create or edit identity-based policies, follow these guidelines and recommendations:

• Get started using AWS managed policies – To start using the Amazon Chime SDK quickly, use AWS managed policies to give your employees the permissions they need. These policies are already available in your account and are maintained and updated by AWS. For more information, see Get started using permissions with AWS managed policies in the IAM User Guide.

• Grant least privilege – When you create custom policies, grant only the permissions required to perform a task. Start with a minimum set of permissions and grant additional permissions as necessary. Doing so is more secure than starting with permissions that are too lenient and then trying to tighten them later. For more information, see Grant least privilege in the IAM User Guide.

• Enable MFA for sensitive operations – For extra security, require IAM users to use multi-factor authentication (MFA) to access sensitive resources or API operations. For more information, see Using multi-factor authentication (MFA) in AWS in the IAM User Guide.

• Use policy conditions for extra security – To the extent that it's practical, define the conditions under which your identity-based policies allow access to a resource. For example, you can write conditions to specify a range of allowable IP addresses that a request must come from. You can also write conditions to allow requests only within a specified date or time range, or to require the use of SSL or MFA. For more information, see IAM JSON policy elements: Condition in the IAM User Guide.

AWS managed Amazon Chime SDK policy

You use the AWS managed AmazonChimeVoiceConnectorServiceLinkedRolePolicy to grant users access to Amazon Chime SDK actions. For more information, see Example IAM roles in the Amazon Chime SDK Developer GUide, and Actions, resources, and condition keys for Amazon Chime in the Service Authorization Reference.

// Policy ARN: arn:aws:iam::aws:policy/AmazonChimeSDK 
// Description: Provides access to Amazon Chime SDK operations
{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "chime:CreateMediaCapturePipeline",
                "chime:CreateMediaConcatenationPipeline",
                "chime:CreateMediaLiveConnectorPipeline",
                "chime:CreateMeeting",
                "chime:CreateMeetingWithAttendees",
                "chime:DeleteMediaCapturePipeline",
                "chime:DeleteMediaPipeline",
                "chime:DeleteMeeting",
                "chime:GetMeeting",
                "chime:ListMeetings",
                "chime:CreateAttendee",
                "chime:BatchCreateAttendee",
                "chime:DeleteAttendee",
                "chime:GetAttendee",
                "chime:GetMediaCapturePipeline",
                "chime:GetMediaPipeline",
                "chime:ListAttendees",
                "chime:ListAttendeeTags",
                "chime:ListMediaCapturePipelines",
                "chime:ListMediaPipelines",
                "chime:ListMeetingTags",
                "chime:ListTagsForResource",
                "chime:StartMeetingTranscription",
                "chime:StopMeetingTranscription",
                "chime:TagAttendee",
                "chime:TagMeeting",
                "chime:TagResource",
                "chime:UntagAttendee",
                "chime:UntagMeeting",
                "chime:UntagResource"
            ],
            "Effect": "Allow",
            "Resource": "*"
        }
    ]
}

AWS managed policy: AmazonChimeVoiceConnectorServiceLinkedRolePolicy

The AmazonChimeVoiceConnectorServiceLinkedRolePolicy enables Amazon Chime SDK Voice Connectors to stream media to Amazon Kinesis Video Streams, provide streaming notifications, and synthesize speech using Amazon Polly. This policy grants the Amazon Chime SDK Voice Connector service permissions to access customer’s Amazon Kinesis Video Streams, send notification events to the Amazon Simple Notification Service (SNS) and Amazon Simple Queue Service (SQS), and use Amazon Polly to synthesize speech when using the Amazon Chime SDK Voice Applications Speak and SpeakAndGetDigits actions. For more information, see Using the Amazon Chime SDK Voice Connector service linked role policy.

AWS managed policy: AmazonChimeSDKMediaPipelinesServiceLinkedRolePolicy

You can't attach AmazonChimeSDKMediaPipelinesServiceLinkedRolePolicy to your IAM entities. This policy allows Amazon Chime SDK media pipelines to access Amazon Chime SDK meetings on your behalf. For more information, see Using roles with Amazon Chime SDK media pipelines in this guide.

Permissions details

This policy includes the following permissions.

• chime – Grants permissions to get meetings, create attendees, and delete attendees.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Effect": "Allow",
            "Action": [
	       "chime:GetMeeting",
	       "chime:CreateAttendee",
                "chime:DeleteAttendee"
	      ],
	     "Resource": "*"
        }
    ]
}

Amazon Chime updates to AWS managed policies

The following table lists and describes the updates made to the Amazon Chime SDK IAM policy.

Change	Description	Date
New and updated service linked roles	Developers can use the AmazonChimeSDKEvents service linked role to access streaming services such as Kinesis Firehose. For more information, see Using the AmazonChimeSDKEvents service-linked role. We also added the AmazonChimeVoiceConnectorServiceLinkedRolePolicy name to Using service linked roles. For more information, see Using the AmazonChimeVoiceConnectorServiceLinkedRolePolicy.	March 27, 2023
Amazon Chime SDK identity-based policy examples – Update to an existing policy.	The AWS managed Amazon Chime SDK policy added new permissions that allow you to use Amazon Chime SDK Media Pipeline APIs to create, read and delete media pipelines.	January 5, 2023
Added the AmazonChimeSDKMediaPipelinesServiceLinkedRolePolicy – new managed policy.	The Amazon Chime SDK added a service-linked role that allows you to use media capture pipelines in Amazon Chime SDK meetings.	April 27, 2022
AWS managed policy: AmazonChimeVoiceConnectorServiceLinkedRolePolicy – Update to an existing policy.	Amazon Chime SDK Voice Connectors added new permissions to allow you to use Amazon Polly to synthesize speech.These permissions are required to use the Speak and SpeakAndGetDigits actions in Amazon Chime SDK Voice Applications.	March 15, 2022
AmazonChimeVoiceConnectorServiceLinkedRolePolicy – Update to an existing policy	Amazon Chime SDK Voice Connector added new permissions to allow access to Amazon Kinesis Video Streams and send notification events to Amazon Simple Notification Service (Amazon SNS) and Amazon Simple Query Service (Amazon SQS). These permissions are required for Amazon Chime SDK Voice Connectors to stream media to Amazon Kinesis Video Streams and provide streaming notifications.	December 20, 2021
Change to existing policy. Creating IAM users or roles with the Chime SDK policy.	The Amazon Chime SDK added new actions to support expanded validation. A number of actions were added to allow listing and tagging of attendees and meeting resources, and for starting and stopping meeting transcription.	September 23, 2021
The Amazon Chime SDK started tracking changes	The Amazon Chime SDK started tracking changes for its AWS managed policies.	September 23, 2021