How AWS Ground Station Works with IAM - AWS Ground Station

How AWS Ground Station Works with IAM

Before you use IAM to control access to AWS Ground Station, you should understand what IAM features are available to use with AWS Ground Station. To get a high-level view of how AWS Ground Station and other AWS services work with IAM, see AWS Services That Work with IAM in the IAM User Guide.

AWS Ground Station Identity-Based Policies

With IAM identity-based policies, you can specify allowed or denied actions and resources as well as the conditions under which actions are allowed or denied. AWS Ground Station supports specific actions, resources, and condition keys. To learn about all of the elements that you use in a JSON policy, see IAM JSON Policy Elements Reference in the IAM User Guide.

AWS Ground Station Actions

The Action element of an IAM identity-based policy describes the specific action or actions that will be allowed or denied by the policy. Policy actions in AWS Ground Station use the following prefix before the action: groundstation. For example: groundstation:Get*, groundstation:List*, groundstation:Describe* (for all AWS Ground Station actions). For a list of the actions, see the Actions Defined by AWS Ground Station.

You can specify multiple actions using wildcards (*). For example, to specify all actions that begin with the word Describe, include the following action:

"Action": "groundstation:Describe*"

The following table describes actions which are common for console access:

Action Description


Grants permission to cancel a contact


Grants permission to describe a contact


Grants permission to return a list of contacts


Grants permission to reserve a contact

To see a list of AWS Ground Station actions, see the AWS Ground Station API Reference.


The Resource element specifies the object or objects to which the action applies. Statements must include either a Resource or a NotResource element. You can specify a resource using an ARN or using the wildcard (*) to indicate that the statement applies to all resources. For more information about the format of ARNs, see Amazon Resource Names (ARNs) and AWS Service Namespaces.

The AWS Ground Station Config resource has the following ARN format:


To specify the example 11111111-2222-3333-4444-555555555555 Config in your statement, you would use the following ARN:

"Resource": "arn:aws:groundstation:us-east-2:123456789012:config/antenna-downlink-demod-decode/11111111-2222-3333-4444-555555555555"

To specify all Config objects that belong to a specific account, use the wildcard (*) in the following format:

"Resource": "arn:aws:groundstation:us-east-2:123456789012:config/*"

Some AWS Ground Station actions, such as those for creating resources, cannot be performed on a specific resource. In those cases, you must use the wildcard (*) in the following format:

"Resource": "*"

Many AWS Ground Station API actions involve multiple resources. For example, CreateConfig can create an AWS Ground Station Config across multiple satellites, so an IAM user must have permissions to use the Config and the contact. To specify multiple resources in a single statement, separate their ARNs with commas in the following format:

"Resource": [ "arn:aws:groundstation:us-west-2:123456789012:config/satellite/11111111-2222-3333-4444-555555555555", "arn:aws:groundstation:us-west-2:123456789012:config/satellite/21111111-2222-3333-4444-555555555555"

The following table summarizes how to create resources with AWS Ground Station:

Action Description


Grants permission to create a Config


Grants permission to create a dataflow endpoint group


Grants permission to create a mission profile

A Contact is another common resource in AWS Ground Station, which has a resource ARN. See the following example:


The following table summarizes how to update other resources:

Action Description


Grants permission to update a Config


Grants permission to update a mission profile

To see a list of AWS Ground Station resource types and their ARNs, see Resources Defined by AWS Ground Station in the IAM User Guide. To learn with which actions you can specify the ARN of each resource, see Actions Defined by AWS Ground Station.

Condition Keys

The Condition element (or Condition block) lets you specify conditions in which a statement is in effect. The Condition element is optional. You can build conditional expressions that use condition operators, such as equals or less than, to match the condition in the policy with values in the request. AWS Ground Station defines its own set of condition keys and also supports using some global condition keys. To see all AWS global condition keys, see AWS Global Condition Context Keys in the IAM User Guide.


Do not use the aws:SourceIp AWS global condition key with AWS CloudFormation. AWS CloudFormation provisions resources by using its own IP address, not the IP address of the originating request. For example, AWS CloudFormation makes requests from its IP address to launch an Amazon EC2 instance or to create an Amazon S3 bucket. It does not use the IP address from the CreateStack operation or the aws cloudformation create-stack command, nor does it use the IP address of the person who makes the call.

If you specify multiple Condition elements in a statement, or multiple keys in a single Condition element, AWS evaluates them using a logical AND operation. If you specify multiple values for a single condition key, AWS evaluates the condition using a logical OR operation. All of the conditions must be met before the statement's permissions are granted.

You can also use placeholder variables when you specify conditions. For example, you can grant an IAM user permission to access a resource only if it is tagged with their IAM user name. For more information, see Policy Variables in the IAM User Guide.

All AWS Ground Station actions support the aws:RequestedRegion and groundstation:Region condition keys. For more information, see Example: Restricting Access to a Specific Region.

To see a list of AWS Ground Station condition keys, see Condition Keys for AWS Ground Station in the IAM User Guide. To learn with which actions and resources you can use a condition key, see Actions Defined by AWS Ground Station.


To view examples of AWS Ground Station identity-based policies, see AWS Ground Station Identity-Based Policy Examples.

AWS Ground Station Resource-Based Policies

AWS Ground Station does not support resource-based policies. To view an example of a detailed resource-based policy page, see Using Resource-based Policies for AWS Lambda .

Authorization Based on AWS Ground Station Tags

You can attach tags to AWS Ground Station resources or pass tags in a request to AWS Ground Station. To control access based on tags, you provide tag information in the condition element of a policy using the groundstation:ResourceTag/key-name, aws:RequestTag/key-name, or aws:TagKeys condition keys.

To view an example identity-based policy for limiting access to a resource based on the tags on that resource, see Viewing AWS Ground Station ConfigIds Based on Tags.

AWS Ground Station IAM Roles

An IAM role is an entity within your AWS account that has specific permissions.

AWS Ground Station currently does not support service-linked roles.

Using Temporary Credentials with AWS Ground Station

You can use temporary credentials to sign in with federation, assume an IAM role, or to assume a cross-account role. You obtain temporary security credentials by calling AWS STS API operations such as AssumeRole or GetFederationToken.

AWS Ground Station supports using temporary credentials.