Amazon Kinesis Data Analytics API Permissions: Actions, Permissions, and Resources Reference - Amazon Kinesis Data Analytics for SQL Applications Developer Guide

Amazon Kinesis Data Analytics API Permissions: Actions, Permissions, and Resources Reference

When you are setting up Access Control and writing a permissions policy that you can attach to an IAM identity (identity-based policies), you can use the following table as a reference. The table lists each Amazon Kinesis Data Analytics API operation, the corresponding actions for which you can grant permissions to perform the action, and the AWS resource for which you can grant the permissions. You specify the actions in the policy's Action field, and you specify the resource value in the policy's Resource field.

You can use AWS-wide condition keys in your Amazon Kinesis Data Analytics policies to express conditions. For a complete list of AWS-wide keys, see Available Keys in the IAM User Guide.

Note

To specify an action, use the kinesisanalytics prefix followed by the API operation name (for example, kinesisanalytics:AddApplicationInput).

Use the scroll bars to see the rest of the table.

Amazon Kinesis Data Analytics API and Required Permissions for Actions
Amazon Kinesis Data Analytics API Operations Required Permissions (API Actions) Resources

AddApplicationInput

kinesisanalytics:AddApplicationInput

arn:aws:kinesisanalytics: region:accountId:application/application-name

AddApplicationOutput

kinesisanalytics:AddApplicationOutput

arn:aws:kinesisanalytics: region:accountId:application/application-name

AddApplicationReferenceDataSource

kinesisanalytics:AddApplicationReferenceDataSource

arn:aws:kinesisanalytics: region:accountId:application/application-name

CreateApplication

kinesisanalytics:CreateApplication

arn:aws:kinesisanalytics: region:accountId:application/application-name

DeleteApplication

kinesisanalytics:DeleteApplication

arn:aws:kinesisanalytics: region:accountId:application/application-name

DeleteApplicationOutput

kinesisanalytics:DeleteApplicationOutput

arn:aws:kinesisanalytics: region:accountId:application/application-name

DeleteApplicationReferenceDataSource

kinesisanalytics:DeleteApplicationReferenceDataSource

arn:aws:kinesisanalytics: region:accountId:application/application-name

DescribeApplication

kinesisanalytics:DescribeApplication

arn:aws:kinesisanalytics: region:accountId:application/application-name

DiscoverInputSchema

kinesisanalytics:DiscoverInputSchema

*

ListApplications

kinesisanalytics:ListApplications

*

StartApplication

kinesisanalytics:StartApplication

arn:aws:kinesisanalytics: region:accountId:application/application-name

StopApplication

kinesisanalytics:StopApplication

arn:aws:kinesisanalytics: region:accountId:application/application-name

UpdateApplication

kinesisanalytics:UpdateApplication

arn:aws:kinesisanalytics: region:accountId:application/application-name

Access or sample data in the console

kinesisanalytics:GetApplicationState

arn:aws:kinesisanalytics: region:accountId:application/application-name

GetApplicationState

The console uses an internal method called GetApplicationState to sample or access application data. Your Kinesis Data Analytics service application needs to have permissions for the internal kinesisanalytics:GetApplicationState API to sample or access application data through the AWS Management Console.