AWS IoT SiteWise identity-based policies
IAM policies let you control who can do what in AWS IoT SiteWise. You can decide what actions are allowed or not and set specific conditions for these actions. For example, you can make rules about who can see or change information in AWS IoT SiteWise. AWS IoT SiteWise supports specific actions, resources, and condition keys. To learn about all of the elements that you use in a JSON policy, see IAM JSON policy elements reference in the IAM User Guide.
Policy actions
Administrators can use AWS JSON policies to specify who has access to what. That is, which principal can perform actions on what resources, and under what conditions.
The Action element of a JSON policy describes the
actions that you can use to allow or deny access in a policy. Policy
actions usually have the same name as the associated AWS API operation. There are some exceptions, such as permission-only
actions that don't have a matching API operation. There are also some operations that require multiple actions in a policy.
These additional actions are called dependent actions.
Include actions in a policy to grant permissions to perform the associated operation.
Policy actions in AWS IoT SiteWise use the following prefix before the action:
iotsitewise:. For example, to grant someone permission to upload
asset property data to AWS IoT SiteWise with the BatchPutAssetPropertyValue API
operation, you include the iotsitewise:BatchPutAssetPropertyValue
action in their policy. Policy statements must include either an Action or
NotAction element. AWS IoT SiteWise defines its own set of actions that describe
tasks that you can perform with this service.
To specify multiple actions in a single statement, separate them with commas as follows.
"Action": [ "iotsitewise:action1", "iotsitewise:action2" ]
You can specify multiple actions using wildcards (*). For example, to specify all
actions that begin with the word Describe, include the following
action.
"Action": "iotsitewise:Describe*"
To see a list of AWS IoT SiteWise actions, see Actions Defined by AWS IoT SiteWise in the IAM User Guide.
BatchPutAssetPropertyValue authorization
AWS IoT SiteWise authorizes access to the BatchPutAssetPropertyValue action in an unusual way. For
most actions, when you allow or deny access, that action returns an error if permissions
aren't granted. With BatchPutAssetPropertyValue, you can send multiple data
entries to different assets and asset properties in a single API request. AWS IoT SiteWise
authorizes each data entry independently. For any individual entry that fails
authorization in the request, AWS IoT SiteWise includes an AccessDeniedException in
the returned list of errors. AWS IoT SiteWise receives the data for any entry that authorizes and
succeeds, even if another entry in the same request fails.
Important
Before you ingest data to a data stream, do the following:
-
Authorize the
time-seriesresource if you use a property alias to identify the data stream. -
Authorize the
assetresource if you use an asset ID to identify the asset that contains the associated asset property.
Policy resources
Administrators can use AWS JSON policies to specify who has access to what. That is, which principal can perform actions on what resources, and under what conditions.
The Resource JSON policy element specifies the object or objects to which the action applies. Statements must include either a
Resource or a NotResource element. As a best practice, specify a resource using its Amazon Resource Name (ARN). You can do this for actions that support a
specific resource type, known as resource-level permissions.
For actions that don't support resource-level permissions, such as listing operations, use a wildcard (*) to indicate that the statement applies to all resources.
"Resource": "*"
Each IAM policy statement applies to the resources that you specify using their ARNs. An ARN has the following general syntax.
arn:${Partition}:${Service}:${Region}:${Account}:${ResourceType}/${ResourcePath}
For more information about the format of ARNs, see Identify AWS resources with Amazon Resource Names (ARNs).
For example, to specify the asset with ID a1b2c3d4-5678-90ab-cdef-22222EXAMPLE in your statement, use
the following ARN.;
"Resource": "arn:aws:iotsitewise:region:123456789012:asset/a1b2c3d4-5678-90ab-cdef-22222EXAMPLE"
To specify all data streams that belong to a specific account, use the wildcard (*):
"Resource": "arn:aws:iotsitewise:region:123456789012:time-series/*"
To specify all assets that belong to a specific account, use the wildcard (*):
"Resource": "arn:aws:iotsitewise:region:123456789012:asset/*"
Some AWS IoT SiteWise actions, such as those for creating resources, can't be performed on a specific resource. In those cases, you must use the wildcard (*).
"Resource": "*"
To specify multiple resources in a single statement, separate the ARNs with commas.
"Resource": [ "resource1", "resource2" ]
To see a list of AWS IoT SiteWise resource types and their ARNs, see Resources Defined by AWS IoT SiteWise in the IAM User Guide. To learn with which actions you can specify the ARN of each resource, see Actions Defined by AWS IoT SiteWise.
Policy condition keys
Administrators can use AWS JSON policies to specify who has access to what. That is, which principal can perform actions on what resources, and under what conditions.
The Condition element (or Condition
block) lets you specify conditions in which a
statement is in effect. The Condition element is optional. You can create
conditional expressions that use condition
operators, such as equals or less than, to match the condition in the
policy with values in the request.
If you specify multiple Condition elements in a statement, or
multiple keys in a single Condition element, AWS evaluates them using
a logical AND operation. If you specify multiple values for a single
condition key, AWS evaluates the condition using a logical OR
operation. All of the conditions must be met before the statement's permissions are
granted.
You can also use placeholder variables when you specify conditions. For example, you can grant an IAM user permission to access a resource only if it is tagged with their IAM user name. For more information, see IAM policy elements: variables and tags in the IAM User Guide.
AWS supports global condition keys and service-specific condition keys. To see all AWS global condition keys, see AWS global condition context keys in the IAM User Guide.
Important
Many condition keys are specific to a resource, and some API actions use multiple
resources. If you write a policy statement with a condition key, use the
Resource element of the statement to specify the resource to which the
condition key applies. If you don't do so, the policy might prevent users from
performing the action at all, because the condition check fails for the resources to
which the condition key doesn't apply. If you don't want to specify a resource, or if
you've written the Action element of your policy to include multiple API
actions, then you must use the ...IfExists condition type to ensure that
the condition key is ignored for resources that don't use it. For more information, see
...IfExists conditions in the IAM User Guide.
AWS IoT SiteWise defines its own set of condition keys and also supports using some global condition keys. To see all AWS global condition keys, see AWS global condition context keys in the IAM User Guide.
| Condition key | Description | Types |
|---|---|---|
iotsitewise:isAssociatedWithAssetProperty |
Whether data streams are associated with an asset property. Use this condition key to define permissions based on the existence of an associated asset property for data streams. Example value: |
String |
iotsitewise:assetHierarchyPath |
The asset's hierarchy path, which is a string of asset IDs each separated by a forward slash. Use this condition key to define permissions based on a subset of your hierarchy of all assets in your account. Example value: |
String |
iotsitewise:propertyId |
The ID of an asset property. Use this condition key to define permissions based on a specified property of an asset model. This condition key applies to all assets of that model. Example value: |
String |
iotsitewise:childAssetId |
The ID of an asset being associated as a child to another asset. Use this condition key to define permissions based on child assets. To define permissions based on parent assets, use the resource section of a policy statement. Example value: |
String |
iotsitewise:iam |
The ARN of an IAM identity when listing access policies. Use this condition key to define access policy permissions for an IAM identity. Example value: |
String, Null |
iotsitewise:propertyAlias |
The alias that identifies an asset property or data stream. Use this condition key to define permissions based on the alias. |
String |
iotsitewise:user |
The ID of an IAM Identity Center user when listing access policies. Use this condition key to define access policy permissions for an IAM Identity Center user. Example value: |
String, Null |
iotsitewise:group |
The ID of an IAM Identity Center group when listing access policies. Use this condition key to define access policy permissions for an IAM Identity Center group. Example value: |
String, Null |
iotsitewise:portal |
The ID of a portal in an access policy. Use this condition key to define access policy permissions based on a portal. Example value: |
String, Null |
iotsitewise:project |
The ID of a project in an access policy, or the ID of a project for a dashboard. Use this condition key to define dashboard or access policy permissions based on a project. Example value: |
String, Null |
To learn with which actions and resources you can use a condition key, see Actions Defined by AWS IoT SiteWise.
Examples
To view examples of AWS IoT SiteWise identity-based policies, see AWS IoT SiteWise identity-based policy examples.
