Die vorliegende Übersetzung wurde maschinell erstellt. Im Falle eines Konflikts oder eines Widerspruchs zwischen dieser übersetzten Fassung und der englischen Fassung (einschließlich infolge von Verzögerungen bei der Übersetzung) ist die englische Fassung maßgeblich.

# Directory Service API-Berechtigungen: Referenz zu Aktionen, Ressourcen und Bedingungen
<a name="UsingWithDS_IAM_ResourcePermissions"></a>

Wenn Sie [Zugriffskontrolle](iam_auth_access.md#access_control) einrichten und Berechtigungsrichtlinien schreiben, die Sie an eine IAM-Identität anhängen können (identitätsbasierte Richtlinien), können Sie die [Directory Service API-Berechtigungen: Referenz zu Aktionen, Ressourcen und Bedingungen](#UsingWithDS_IAM_ResourcePermissions)-Tabelle als Referenz verwenden. Jeder API-Eintrag in der Tabelle enthält Folgendes:
+ Der Name jedes API-Vorgangs
+ Die entsprechenden Aktionen für jeden API-Vorgang, für die Sie Berechtigungen zum Ausführen der Aktion gewähren können
+ Die AWS Ressource, in der Sie die Berechtigungen gewähren können

 Die Aktionen geben Sie im Feld `Action` und den Wert für die Ressource im Feld `Resource` der Richtlinie an. Um eine Aktion anzugeben, verwenden Sie das Präfix `ds:` gefolgt vom Namen der API-Operation (z. B. `ds:CreateDirectory`). Einige AWS Anwendungen erfordern möglicherweise die Verwendung nichtöffentlicher Directory Service API-Operationen wie`ds:AuthorizeApplication`,`ds:CheckAlias`,`ds:CreateIdentityPoolDirectory`, `ds:GetAuthorizedApplicationDetails``ds:UpdateAuthorizedApplication`, und `ds:UnauthorizeApplication` in ihren Richtlinien. 

Einige Directory Service APIs können nur über die AWS-Managementkonsole aufgerufen werden. Sie sind keine öffentlichen APIs, in dem Sinne, dass sie nicht programmgesteuert aufgerufen werden können, und sie werden von keinem SDK bereitgestellt. Sie akzeptieren Benutzeranmeldeinformationen. Zu diesen API-Vorgängen gehören `ds:DisableRoleAccess``ds:EnableRoleAccess`, und`ds:UpdateDirectory`.

 Sie können AWS globale Bedingungsschlüssel in Ihren Richtlinien Directory Service und Directory Service Data-Richtlinien verwenden, um Bedingungen auszudrücken. Eine vollständige Liste der AWS Schlüssel finden Sie [ im * IAM-Benutzerhandbuch * unter ](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#AvailableKeys) Verfügbare globale Bedingungsschlüssel. 

## Directory Service API und erforderliche Berechtigungen für Aktionen
<a name="actions-related-to-objects-table"></a>


| Directory Service API-Operationen | Erforderliche Berechtigungen (API-Aktionen) | Ressourcen | 
| --- | --- | --- | 
| [AcceptSharedDirectory](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_AcceptSharedDirectory.html)  | ds:AcceptSharedDirectory | \* | 
| [AddIpRoutes](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_AddIpRoutes.html)  | `ds:AddIpRoutes`<br />`ec2:DescribeSecurityGroup`<br />`ec2:AuthorizeSecurityGroupIngress`<br />`ec2:AuthorizeSecurityGroupEgress` | \* | 
| [AddTagsToResource](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_AddTagsToResource.html)  | ds:AddTagsToResource`ec2:CreateTags` | \* | 
| [CancelSchemaExtension](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CancelSchemaExtension.html)  | ds:CancelSchemaExtension | \* | 
|  [ConnectDirectory](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ConnectDirectory.html)  | `ds:ConnectDirectory`<br />`ec2:DescribeSubnets`<br />`ec2:DescribeVpcs`<br />`ec2:CreateSecurityGroup`<br />`ec2:CreateNetworkInterface`<br />`ec2:DescribeNetworkInterfaces`<br />`ec2:AuthorizeSecurityGroupIngress`<br />`ec2:AuthorizeSecurityGroupEgress`<br />`ec2:CreateTags` | \* | 
|  [CreateAlias](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateAlias.html)  | `ds:CreateAlias` | \* | 
|  [CreateComputer](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateComputer.html)  | `ds:CreateComputer` | \* | 
|  [CreateConditionalForwarder](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateConditionalForwarder.html)  | `ds:CreateConditionalForwarder` | \* | 
|  [CreateDirectory](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateDirectory.html)  | `ds:CreateDirectory`<br />`ec2:DescribeSubnets`<br />`ec2:DescribeVpcs`<br />`ec2:CreateSecurityGroup`<br />`ec2:CreateNetworkInterface`<br />`ec2:DescribeNetworkInterfaces`<br />`ec2:AuthorizeSecurityGroupIngress`<br />`ec2:AuthorizeSecurityGroupEgress`<br />`ec2:CreateTags` | \* | 
| [CreateLogSubscription](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateLogSubscription.html)  | ds:CreateLogSubscription | \* | 
|  [CreateMicrosoftUND ](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateMicrosoftAD.html)  | `ds:CreateMicrosoftAD`<br />`ec2:DescribeSubnets`<br />`ec2:DescribeVpcs`<br />`ec2:CreateSecurityGroup`<br />`ec2:CreateNetworkInterface`<br />`ec2:DescribeNetworkInterfaces`<br />`ec2:AuthorizeSecurityGroupIngress`<br />`ec2:AuthorizeSecurityGroupEgress`<br />`ec2:RevokeSecurityGroupEgress`<br />`ec2:CreateTags` | \* | 
|  [CreateSnapshot](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateSnapshot.html)  | `ds:CreateSnapshot` | \* | 
|  [CreateTrust](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateTrust.html)  | `ds:CreateTrust` | \* | 
|  [DeleteConditionalForwarder](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteConditionalForwarder.html)  | `ds:DeleteConditionalForwarder` | \* | 
|  [DeleteDirectory](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteDirectory.html)  | `ds:DeleteDirectory`<br />`ec2:DescribeNetworkInterfaces`<br />`ec2:DeleteSecurityGroup`<br />`ec2:DeleteNetworkInterface`<br />`ec2:RevokeSecurityGroupIngress`<br />`ec2:RevokeSecurityGroupEgress`<br />`ec2:DeleteTags` | \* | 
| [DeleteLogSubscription](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteLogSubscription.html)  | ds:DeleteLogSubscription | \* | 
|  [DeleteSnapshot](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteSnapshot.html)  | `ds:DeleteSnapshot` | \* | 
|  [DeleteTrust](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteTrust.html)  | `ds:DeleteTrust` | \* | 
|  [DeregisterEventTopic](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeregisterEventTopic.html)  | `ds:DeregisterEventTopic` | \* | 
|  [DescribeConditionalForwarders](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeConditionalForwarders.html)  | `ds:DescribeConditionalForwarders` | \* | 
|  [DescribeDirectories](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeDirectories.html)  | `ds:DescribeDirectories` | \* | 
| [DescribeDomainControllers](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeDomainControllers.html)  | ds:DescribeDomainControllers | \* | 
|  [DescribeEventTopics](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeEventTopics.html)  | `ds:DescribeEventTopics` | \* | 
| [DescribeSharedDirectories](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeSharedDirectories.html)  | ds:DescribeSharedDirectories | \* | 
|  [DescribeSnapshots](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeSnapshots.html)  | `ds:DescribeSnapshots` | \* | 
|  [DescribeTrusts](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeTrusts.html)  | `ds:DescribeTrusts` | \* | 
|  [DisableRadius](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DisableRadius.html)  | `ds:DisableRadius` | \* | 
|  [DisableSso](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DisableSso.html)  | `ds:DisableSso` | \* | 
|  [EnableRadius](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_EnableRadius.html)  | `ds:EnableRadius` | \* | 
|  [EnableSso](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_EnableSso.html)  | `ds:EnableSso` | \* | 
|  [GetDirectoryLimits](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_GetDirectoryLimits.html)  | `ds:GetDirectoryLimits` | \* | 
|  [GetSnapshotLimits](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_GetSnapshotLimits.html)  | `ds:GetSnapshotLimits` | \* | 
| [ListIpRoutes](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListIpRoutes.html) | `ds:ListIpRoutes` | \* | 
| [ListLogSubscriptions](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListLogSubscriptions.html)  | ds:ListLogSubscriptions | \* | 
| [ListSchemaExtensions](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListSchemaExtensions.html) | `ds:ListSchemaExtensions` | \* | 
| [ListTagsForResource](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListTagsForResource.html) | `ds:ListTagsForResource` | \* | 
|  [RegisterEventTopic](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RegisterEventTopic.html)  | `ds:RegisterEventTopic`<br />`sns:GetTopicAttributes` | \* | 
| [RejectSharedDirectory](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RejectSharedDirectory.html)  | ds:RejectSharedDirectory | \* | 
| [RemoveIpRoutes](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RemoveIpRoutes.html) | `ds:RemoveIpRoutes` | \* | 
| [RemoveTagsFromResource](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RemoveTagsFromResource.html) | `ds:RemoveTagsFromResource`<br />`ec2:DeleteTags` | \* | 
| [ResetUserPassword](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ResetUserPassword.html)  | ds:ResetUserPassword | \* | 
|  [RestoreFromSnapshot](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RestoreFromSnapshot.html)  | `ds:RestoreFromSnapshot` | \* | 
| [ShareDirectory](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ShareDirectory.html)  | `ds:ShareDirectory`<br />`organizations:DescribeAccount`<br />`organizations:DescribeOrganization`<br />`organizations:ListAWSServiceAccessForOrganization` | \* | 
| [StartSchemaExtension](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_StartSchemaExtension.html) | `ds:StartSchemaExtension` | \* | 
| [UnshareDirectory](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UnshareDirectory.html)  | ds:UnshareDirectory | \* | 
|  [UpdateConditionalForwarder](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateConditionalForwarder.html)  | `ds:UpdateConditionalForwarder` | \* | 
| [UpdateNumberOfDomainControllers](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateNumberOfDomainControllers.html)  | `ds:UpdateNumberOfDomainControllers`<br />`ec2:DescribeSubnets`<br />`ec2:DescribeVpcs`<br />`ec2:CreateNetworkInterface`<br />`ec2:DescribeNetworkInterfaces`<br />`ec2:DeleteNetworkInterface` | \* | 
|  [UpdateRadius](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateRadius.html)  | `ds:UpdateRadius` | \* | 
| [UpdateTrust](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateTrust.html)  | ds:UpdateTrust | \* | 
|  [VerifyTrust](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_VerifyTrust.html)  | `ds:VerifyTrust` | \* | 

## AWS Verzeichnisdienst-Daten-API und erforderliche Berechtigungen für Aktionen
<a name="DSData_ResourcePermissions"></a>

**Anmerkung**  
 Um eine Aktion anzugeben, verwenden Sie das `ds-data:` Präfix, gefolgt vom Namen des API-Vorgangs (z. B.`ds-data:AddGroupMember`). 


| API-Operationen für Verzeichnisdienst-Daten | Erforderliche Berechtigungen (API-Aktionen) | Ressourcen | 
| --- | --- | --- | 
|  [AddGroupMember](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_AddGroupMember.html)  | `ds-data:AddGroupMember` | \* | 
|  [CreateGroup](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_CreateGroup.html)  | `ds-data:CreateGroup` | \* | 
|  [CreateUser](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_CreateUser.html)  | `ds-data:CreateUser` | \* | 
|  [DeleteGroup](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_DeleteGroup.html)  | `ds-data:DeleteGroup` | \* | 
|  [DeleteUser](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/DeleteUser.html)  | `ds-data:DeleteUser` | \* | 
|  [DescribeGroup](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_DescribeGroup.html)  | `ds-data:DescribeGroup` | \* | 
|  [DescribeUser](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_DescribeUser.html)  | `ds-data:DescribeUser` | \* | 
|  [DisableUser](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_DisableUser.html)  | `ds-data:DisableUser` | \* | 
|  [ListGroups](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_ListGroups.html)  | `ds-data:ListGroups` | \* | 
|  [ListGroupMembers](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_ListGroupMembers.html)  | `ds-data:ListGroupMembers` | \* | 
|  [ListGroupsForMember](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_ListGroupsForMember.html)  | `ds-data:ListGroupsForMember` | \* | 
|  [ListUsers](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_ListUsers.html)  | `ds-data:ListUsers` | \* | 
|  [RemoveGroupMember](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_RemoveGroupMember.html)  | `ds-data:RemoveGroupMember` | \* | 
|  [SearchGroups](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_SearchGroups.html)  | `ds-data:DescribeGroup`<br />`ds-data:SearchGroups` | \* | 
| [SearchUsers](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_SearchUsers.html) | `ds-data:DescribeUser`<br />`ds-data:SearchUsers` | \* | 
| [UpdateGroup](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_UpdateGroup.html) | `ds-data:UpdateGroup` | \* | 
| [UpdateUser](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_UpdateUser.html) | `ds-data:UpdateUser` | \* | 

## Verwandte Themen
<a name="iam2_related"></a>
+ [Zugriffskontrolle](iam_auth_access.md#access_control)