How AWS Ground Station Works with IAM
Before you use IAM to control access to AWS Ground Station, you should understand what IAM features are available to use with AWS Ground Station. To get a high-level view of how AWS Ground Station and other AWS services work with IAM, see AWS Services That Work with IAM in the IAM User Guide.
Topics
AWS Ground Station Identity-Based Policies
With IAM identity-based policies, you can specify allowed or denied actions and resources as well as the conditions under which actions are allowed or denied. AWS Ground Station supports specific actions, resources, and condition keys. To learn about all of the elements that you use in a JSON policy, see IAM JSON Policy Elements Reference in the IAM User Guide.
AWS Ground Station Actions
The Action element of an IAM identity-based policy describes the
specific action or actions that will be allowed or denied by the policy. Policy
actions in AWS Ground Station use the following prefix before the action:
groundstation. For example:
groundstation:Get*, groundstation:List*,
groundstation:Describe* (for all AWS Ground Station actions). For
a list of the actions, see the Actions Defined by AWS Ground Station.
You can specify multiple actions using wildcards (*). For example, to specify all
actions that begin with the word Describe, include the following
action:
"Action": "groundstation:Describe*"
The following table describes actions which are common for console access:
| Action | Description |
|---|---|
|
|
Grants permission to cancel a contact |
|
|
Grants permission to describe a contact |
|
|
Grants permission to return a list of contacts |
|
|
Grants permission to reserve a contact |
To see a list of AWS Ground Station actions, see the AWS Ground Station API Reference.
Resources
The Resource element specifies the object or objects to which the
action applies. Statements must include either a Resource or a
NotResource element. You can specify a resource using an ARN or using the
wildcard (*) to indicate that the statement applies to all resources. For more information
about the format of ARNs, see
Amazon Resource Names (ARNs) and AWS Service Namespaces.
The AWS Ground Station Config resource has the following ARN format:
arn:${Partition}:groundstation:${Region}:${AccountID}:config/${configType}/${configId}
To specify the example 11111111-2222-3333-4444-555555555555 Config in your
statement, you would use the following ARN:
"Resource": "arn:aws:groundstation:us-east-2:123456789012:config/antenna-downlink-demod-decode/11111111-2222-3333-4444-555555555555"
To specify all Config objects that belong to a specific account, use the wildcard
(*) in the following format:
"Resource": "arn:aws:groundstation:us-east-2:123456789012:config/*"
Some AWS Ground Station actions, such as those for creating resources, cannot be performed on a specific resource. In those cases, you must use the wildcard (*) in the following format:
"Resource": "*"
Many AWS Ground Station API actions involve multiple resources. For example,
CreateConfig can create an AWS Ground Station Config across
multiple satellites, so an IAM user must have permissions to use the Config
and the contact. To specify multiple resources in a single statement, separate their
ARNs with commas in the following format:
"Resource": [ "arn:aws:groundstation:us-west-2:123456789012:config/satellite/11111111-2222-3333-4444-555555555555", "arn:aws:groundstation:us-west-2:123456789012:config/satellite/21111111-2222-3333-4444-555555555555"
The following table summarizes how to create resources with AWS Ground Station:
| Action | Description |
|---|---|
|
|
Grants permission to create a Config |
|
|
Grants permission to create a dataflow endpoint group |
|
|
Grants permission to create a mission profile |
A Contact is another common resource in AWS Ground Station, which has a resource ARN. See the
following example:
"arn:aws:groundstation:us-west-2:123456789012:contact/11111111-2222-3333-4444-555555555555"
The following table summarizes how to update other resources:
| Action | Description |
|---|---|
|
|
Grants permission to update a Config |
|
|
Grants permission to update a mission profile |
To see a list of AWS Ground Station resource types and their ARNs, see Resources Defined by AWS Ground Station in the IAM User Guide. To learn with which actions you can specify the ARN of each resource, see Actions Defined by AWS Ground Station.
Condition Keys
The Condition element (or Condition
block) lets you specify conditions in which a
statement is in effect. The Condition element is optional. You can build
conditional expressions that use condition
operators, such as equals or less than, to match the condition in the
policy with values in the request. AWS Ground Station defines its own set of condition
keys and also supports using some global condition keys. To see all AWS global
condition keys, see AWS Global Condition Context Keys in the
IAM User Guide.
Do not use the aws:SourceIp AWS global condition key with
AWS CloudFormation. AWS CloudFormation provisions resources by using its own IP address,
not the IP
address of the originating request. For example, AWS CloudFormation makes requests
from its IP
address to launch an Amazon EC2 instance or to create an Amazon S3 bucket. It does
not use
the IP address from the CreateStack operation or the aws
cloudformation create-stack command, nor does it use the IP address of
the person who makes the call.
If you specify multiple Condition elements in a statement, or
multiple keys in a single Condition element, AWS evaluates them using
a logical AND operation. If you specify multiple values for a single
condition key, AWS evaluates the condition using a logical OR
operation. All of the conditions must be met before the statement's permissions are
granted.
You can also use placeholder variables when you specify conditions. For example, you can grant an IAM user permission to access a resource only if it is tagged with their IAM user name. For more information, see Policy Variables in the IAM User Guide.
All AWS Ground Station actions support the aws:RequestedRegion and
groundstation:Region condition keys. For more information, see Example:
Restricting Access to a Specific Region.
To see a list of AWS Ground Station condition keys, see Condition Keys for AWS Ground Station in the IAM User Guide. To learn with which actions and resources you can use a condition key, see Actions Defined by AWS Ground Station.
Examples
To view examples of AWS Ground Station identity-based policies, see AWS Ground Station Identity-Based Policy Examples.
AWS Ground Station Resource-Based Policies
AWS Ground Station does not support resource-based policies. To view an example of a detailed resource-based policy page, see Using Resource-based Policies for AWS Lambda .
Authorization Based on AWS Ground Station Tags
You can attach tags to AWS Ground Station resources or pass tags in a request to
AWS Ground Station. To control access based on tags, you provide tag information in
the
condition
element of a policy using the
groundstation:ResourceTag/key-name,
aws:RequestTag/key-name, or
aws:TagKeys condition keys.
To view an example identity-based policy for limiting access to a resource based on the tags on that resource, see Viewing AWS Ground Station ConfigIds Based on Tags.
AWS Ground Station IAM Roles
An IAM role is an entity within your AWS account that has specific permissions.
AWS Ground Station currently does not support service-linked roles.
Using Temporary Credentials with AWS Ground Station
You can use temporary credentials to sign in with federation, assume an IAM role, or to assume a cross-account role. You obtain temporary security credentials by calling AWS STS API operations such as AssumeRole or GetFederationToken.
AWS Ground Station supports using temporary credentials.
