Actions, resources, and condition keys for AWS IoT SiteWise

AWS IoT SiteWise (service prefix: iotsitewise) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

• Learn how to configure this service.

• View a list of the API operations available for this service.

• Learn how to secure this service and its resources by using IAM permission policies.

• View the programmatic service authorization reference for this service.

API operations defined by AWS IoT SiteWise

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateAssets	iotsitewise:AssociateAssets			Write
AssociateTimeSeriesToAssetProperty	iotsitewise:AssociateTimeSeriesToAssetProperty			Write
BatchAssociateDataSegmentsToDataset	iotsitewise:BatchAssociateDataSegmentsToDataset			Write
BatchAssociateProjectAssets	iotsitewise:BatchAssociateProjectAssets			Write
BatchDeleteDatasetDataSegments	iotsitewise:BatchDeleteDatasetDataSegments			Write
BatchDisassociateDataSegmentsFromDataset	iotsitewise:BatchDisassociateDataSegmentsFromDataset			Write
BatchDisassociateProjectAssets	iotsitewise:BatchDisassociateProjectAssets			Write
BatchGetAssetPropertyAggregates	iotsitewise:BatchGetAssetPropertyAggregates			Read
BatchGetAssetPropertyValue	iotsitewise:BatchGetAssetPropertyValue			Read
BatchGetAssetPropertyValueHistory	iotsitewise:BatchGetAssetPropertyValueHistory			Read
BatchPutAssetPropertyValue	iotsitewise:BatchPutAssetPropertyValue			Write
CancelEnrichmentJob	iotsitewise:CancelEnrichmentJob			Write
CancelPipelineExecution	iotsitewise:CancelPipelineExecution			Write
CancelQuery	iotsitewise:CancelQuery			Write
CreateAccessPolicy	iotsitewise:CreateAccessPolicy			Write
CreateApplication	iotsitewise:CreateApplication			Write
	iotsitewise:TagResource			Tagging, Write
CreateAsset	iotsitewise:CreateAsset			Write
	iotsitewise:TagResource			Tagging, Write
CreateAssetModel	iotsitewise:CreateAssetModel			Write
	iotsitewise:TagResource			Tagging, Write
CreateAssetModelCompositeModel	iotsitewise:CreateAssetModelCompositeModel			Write
	iam:PassRole	iam:PassedToService	iotsitewise.amazonaws.com	Write
CreateBulkImportJob	iotsitewise:CreateBulkImportJob			Write
	iam:PassRole	iam:PassedToService	iotsitewise.amazonaws.com	Write
CreateComputationModel	iotsitewise:CreateComputationModel			Write
	iotsitewise:TagResource			Tagging, Write
CreateDashboard	iotsitewise:CreateDashboard			Write
	iotsitewise:TagResource			Tagging, Write
CreateDataset	iotsitewise:CreateDataset			Write
	iotsitewise:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	iotsitewise.amazonaws.com	Write
CreateDatasetExportJob	iotsitewise:CreateDatasetExportJob			Write
CreateEnrichmentJob	iotsitewise:CreateEnrichmentJob			Write
CreateGateway	iotsitewise:CreateGateway			Write
	iotsitewise:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	iotsitewise.amazonaws.com	Write
CreatePipeline	iotsitewise:CreatePipeline			Write
	iotsitewise:TagResource			Tagging, Write
CreatePortal	iotsitewise:CreatePortal			Write
	iotsitewise:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	iotsitewise.amazonaws.com	Write
CreateProject	iotsitewise:CreateProject			Write
	iotsitewise:TagResource			Tagging, Write
CreateTask	iotsitewise:CreateTask			Write
	iotsitewise:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	iotsitewise.amazonaws.com	Write
CreateWorkspace	iotsitewise:CreateWorkspace			Write
	iotsitewise:TagResource			Tagging, Write
DeleteAccessPolicy	iotsitewise:DeleteAccessPolicy			Write
DeleteApplication	iotsitewise:DeleteApplication			Write
DeleteAsset	iotsitewise:DeleteAsset			Write
DeleteAssetModel	iotsitewise:DeleteAssetModel			Write
DeleteAssetModelCompositeModel	iotsitewise:DeleteAssetModelCompositeModel			Write
DeleteAssetModelInterfaceRelationship	iotsitewise:DeleteAssetModelInterfaceRelationship			Write
DeleteComputationModel	iotsitewise:DeleteComputationModel			Write
DeleteDashboard	iotsitewise:DeleteDashboard			Write
DeleteDataset	iotsitewise:DeleteDataset			Write
DeleteGateway	iotsitewise:DeleteGateway			Write
DeletePipeline	iotsitewise:DeletePipeline			Write
DeletePortal	iotsitewise:DeletePortal			Write
DeleteProject	iotsitewise:DeleteProject			Write
DeleteTask	iotsitewise:DeleteTask			Write
DeleteTimeSeries	iotsitewise:DeleteTimeSeries			Write
DeleteWorkspace	iotsitewise:DeleteWorkspace			Write
DescribeAccessPolicy	iotsitewise:DescribeAccessPolicy			Read
DescribeAction	iotsitewise:DescribeAction			Read
DescribeApplication	iotsitewise:DescribeApplication			Read
DescribeAsset	iotsitewise:DescribeAsset			Read
DescribeAssetCompositeModel	iotsitewise:DescribeAssetCompositeModel			Read
DescribeAssetModel	iotsitewise:DescribeAssetModel			Read
DescribeAssetModelCompositeModel	iotsitewise:DescribeAssetModelCompositeModel			Read
DescribeAssetModelInterfaceRelationship	iotsitewise:DescribeAssetModelInterfaceRelationship			Read
DescribeAssetProperty	iotsitewise:DescribeAssetProperty			Read
DescribeBulkImportJob	iotsitewise:DescribeBulkImportJob			Read
DescribeComputationModel	iotsitewise:DescribeComputationModel			Read
DescribeComputationModelExecutionSummary	iotsitewise:DescribeComputationModelExecutionSummary			Read
DescribeDashboard	iotsitewise:DescribeDashboard			Read
DescribeDataset	iotsitewise:DescribeDataset			Read
DescribeDatasetExportJob	iotsitewise:DescribeDatasetExportJob			Read
DescribeDefaultEncryptionConfiguration	iotsitewise:DescribeDefaultEncryptionConfiguration			Read
DescribeEnrichmentJob	iotsitewise:DescribeEnrichmentJob			Read
DescribeExecution	iotsitewise:DescribeExecution			Read
DescribeGateway	iotsitewise:DescribeGateway			Read
DescribeGatewayCapabilityConfiguration	iotsitewise:DescribeGatewayCapabilityConfiguration			Read
DescribeLoggingOptions	iotsitewise:DescribeLoggingOptions			Read
DescribePipeline	iotsitewise:DescribePipeline			Read
DescribePipelineExecution	iotsitewise:DescribePipelineExecution			Read
DescribePortal	iotsitewise:DescribePortal			Read
DescribeProject	iotsitewise:DescribeProject			Read
DescribeQuery	iotsitewise:DescribeQuery			Read
DescribeSearch	iotsitewise:DescribeSearch			Read
DescribeStorageConfiguration	iotsitewise:DescribeStorageConfiguration			Read
DescribeTask	iotsitewise:DescribeTask			Read
DescribeTimeSeries	iotsitewise:DescribeTimeSeries			Read
DescribeWorkspace	iotsitewise:DescribeWorkspace			Read
DisassociateAssets	iotsitewise:DisassociateAssets			Write
DisassociateTimeSeriesFromAssetProperty	iotsitewise:DisassociateTimeSeriesFromAssetProperty			Write
ExecuteAction	iotsitewise:ExecuteAction			Write
ExecuteQuery	iotsitewise:ExecuteQuery			Read
GetAssetPropertyAggregates	iotsitewise:GetAssetPropertyAggregates			Read
GetAssetPropertyValue	iotsitewise:GetAssetPropertyValue			Read
GetAssetPropertyValueHistory	iotsitewise:GetAssetPropertyValueHistory			Read
GetCaptureData	iotsitewise:GetCaptureData			Read
GetInterpolatedAssetPropertyValues	iotsitewise:GetInterpolatedAssetPropertyValues			Read
GetQueryResults	iotsitewise:GetQueryResults			Read
GetSearchResults	iotsitewise:GetSearchResults			Read
InvokeAssistant	iotsitewise:InvokeAssistant			Read
ListAccessPolicies	iotsitewise:ListAccessPolicies			List
ListActions	iotsitewise:ListActions			List
ListApplications	iotsitewise:ListApplications			List
ListAssetModelCompositeModels	iotsitewise:ListAssetModelCompositeModels			List
ListAssetModelProperties	iotsitewise:ListAssetModelProperties			List
ListAssetModels	iotsitewise:ListAssetModels			List
ListAssetProperties	iotsitewise:ListAssetProperties			List
ListAssetRelationships	iotsitewise:ListAssetRelationships			List
ListAssets	iotsitewise:ListAssets			List
ListAssociatedAssets	iotsitewise:ListAssociatedAssets			List
ListBulkImportJobs	iotsitewise:ListBulkImportJobs			List
ListCompositionRelationships	iotsitewise:ListCompositionRelationships			List
ListComputationModelDataBindingUsages	iotsitewise:ListComputationModelDataBindingUsages			List
ListComputationModelResolveToResources	iotsitewise:ListComputationModelResolveToResources			List
ListComputationModels	iotsitewise:ListComputationModels			List
ListDashboards	iotsitewise:ListDashboards			List
ListDatasetDataSegmentRelationships	iotsitewise:ListDatasetDataSegmentRelationships			List
ListDatasetDataSegments	iotsitewise:ListDatasetDataSegments			List
ListDatasetExportJobs	iotsitewise:ListDatasetExportJobs			List
ListDatasets	iotsitewise:ListDatasets			List
ListEnrichmentJobs	iotsitewise:ListEnrichmentJobs			List
ListExecutions	iotsitewise:ListExecutions			List
ListGateways	iotsitewise:ListGateways			List
ListInterfaceRelationships	iotsitewise:ListInterfaceRelationships			List
ListPipelineExecutions	iotsitewise:ListPipelineExecutions			List
ListPipelines	iotsitewise:ListPipelines			List
ListPortals	iotsitewise:ListPortals			List
ListProjectAssets	iotsitewise:ListProjectAssets			List
ListProjects	iotsitewise:ListProjects			List
ListQueries	iotsitewise:ListQueries			List
ListSearches	iotsitewise:ListSearches			List
ListTagsForResource	iotsitewise:ListTagsForResource			Read
ListTasks	iotsitewise:ListTasks			List
ListTimeSeries	iotsitewise:ListTimeSeries			List
ListWorkspaces	iotsitewise:ListWorkspaces			List
PutAssetModelInterfaceRelationship	iotsitewise:PutAssetModelInterfaceRelationship			Write
PutDefaultEncryptionConfiguration	iotsitewise:PutDefaultEncryptionConfiguration			Write
PutLoggingOptions	iotsitewise:PutLoggingOptions			Write
PutStorageConfiguration	iotsitewise:PutStorageConfiguration			Write
	iam:PassRole	iam:PassedToService	iotsitewise.amazonaws.com	Write
StartPipelineExecution	iotsitewise:StartPipelineExecution			Write
StartQuery	iotsitewise:StartQuery			Write
StartSearch	iotsitewise:StartSearch			Write
TagResource	iotsitewise:TagResource			Tagging, Write
UntagResource	iotsitewise:UntagResource			Tagging, Write
UpdateAccessPolicy	iotsitewise:UpdateAccessPolicy			Write
UpdateAsset	iotsitewise:UpdateAsset			Write
UpdateAssetModel	iotsitewise:UpdateAssetModel			Write
UpdateAssetModelCompositeModel	iotsitewise:UpdateAssetModelCompositeModel			Write
	iam:PassRole	iam:PassedToService	iotsitewise.amazonaws.com	Write
UpdateAssetProperty	iotsitewise:UpdateAssetProperty			Write
UpdateComputationModel	iotsitewise:UpdateComputationModel			Write
UpdateDashboard	iotsitewise:UpdateDashboard			Write
UpdateDataset	iotsitewise:UpdateDataset			Write
	iam:PassRole	iam:PassedToService	iotsitewise.amazonaws.com	Write
UpdateGateway	iotsitewise:UpdateGateway			Write
UpdateGatewayCapabilityConfiguration	iotsitewise:UpdateGatewayCapabilityConfiguration			Write
UpdatePipeline	iotsitewise:UpdatePipeline			Write
UpdatePortal	iotsitewise:UpdatePortal			Write
	iam:PassRole	iam:PassedToService	iotsitewise.amazonaws.com	Write
UpdateProject	iotsitewise:UpdateProject			Write
UpdateTask	iotsitewise:UpdateTask			Write
	iam:PassRole	iam:PassedToService	iotsitewise.amazonaws.com	Write
UpdateWorkspace	iotsitewise:UpdateWorkspace			Write

Actions defined by AWS IoT SiteWise

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateAssets	Grants permission to associate a child asset with a parent asset through a hierarchy	asset*	aws:ResourceTag/${TagKey}	Write
AssociateTimeSeriesToAssetProperty	Grants permission to associate a time series with an asset property	asset*	aws:ResourceTag/${TagKey}	Write
		time-series*	aws:ResourceTag/${TagKey}
BatchAssociateDataSegmentsToDataset	Grants permission to associate data segments to a dataset	dataset*	aws:ResourceTag/${TagKey}	Write
		workspace	aws:ResourceTag/${TagKey}
BatchAssociateProjectAssets	Grants permission to associate assets to a project	project*	aws:ResourceTag/${TagKey}	Write
BatchDeleteDatasetDataSegments	Grants permission to batch delete data segments from a dataset	dataset*	aws:ResourceTag/${TagKey}	Write
		workspace	aws:ResourceTag/${TagKey}
BatchDisassociateDataSegmentsFromDataset	Grants permission to disassociate data segments from a dataset	dataset*	aws:ResourceTag/${TagKey}	Write
		workspace	aws:ResourceTag/${TagKey}
BatchDisassociateProjectAssets	Grants permission to disassociate assets from a project	project*	aws:ResourceTag/${TagKey}	Write
BatchGetAssetPropertyAggregates	Grants permission to retrieve computed aggregates for multiple asset properties	asset	aws:ResourceTag/${TagKey}	Read
		time-series	aws:ResourceTag/${TagKey}
BatchGetAssetPropertyValue	Grants permission to retrieve the latest value for multiple asset properties	asset	aws:ResourceTag/${TagKey}	Read
		time-series	aws:ResourceTag/${TagKey}
BatchGetAssetPropertyValueHistory	Grants permission to retrieve the value history for multiple asset properties	asset	aws:ResourceTag/${TagKey}	Read
		time-series	aws:ResourceTag/${TagKey}
BatchPutAssetPropertyValue	Grants permission to put property values for asset properties	asset	aws:ResourceTag/${TagKey}	Write
		time-series	aws:ResourceTag/${TagKey}
CancelEnrichmentJob	Grants permission to cancel an enrichment job	workspace*	aws:ResourceTag/${TagKey}	Write
CancelPipelineExecution	Grants permission to cancel a pipeline execution in a workspace	pipeline*	aws:ResourceTag/${TagKey}	Write
CancelQuery	Grants permission to cancel a query	workspace*	aws:ResourceTag/${TagKey}	Write
CreateAccessPolicy	Grants permission to create an access policy for a portal or a project	portal	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		project	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateApplication	Grants permission to create an application		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateAsset	Grants permission to create an asset from an asset model	asset-model*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAssetModel	Grants permission to create an asset model		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateAssetModelCompositeModel	Grants permission to create an asset model composite model inside an asset model	asset-model*	aws:ResourceTag/${TagKey}	Write
CreateBulkImportJob	Grants permission to create bulk import job	dataset	aws:ResourceTag/${TagKey}	Write
		workspace	aws:ResourceTag/${TagKey}
CreateComputationModel	Grants permission to create a computation model	asset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		asset-model	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateDashboard	Grants permission to create a dashboard in a project	project*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDataset	Grants permission to create a dataset	workspace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDatasetExportJob	Grants permission to create a dataset export job	dataset	aws:ResourceTag/${TagKey}	Write
		time-series	aws:ResourceTag/${TagKey}
		workspace*	aws:ResourceTag/${TagKey}
CreateEnrichmentJob	Grants permission to create an enrichment job	dataset	aws:ResourceTag/${TagKey}	Write
		workspace*	aws:ResourceTag/${TagKey}
CreateGateway	Grants permission to create a gateway		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreatePipeline	Grants permission to create a new pipeline definition in a workspace		aws:RequestTag/${TagKey} aws:TagKeys iotsitewise:taskArns	Write
CreatePortal	Grants permission to create a portal		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateProject	Grants permission to create a project in a portal	portal*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTask	Grants permission to create a new task definition in a workspace		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateWorkspace	Grants permission to create a workspace		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteAccessPolicy	Grants permission to delete an access policy	access-policy*	aws:ResourceTag/${TagKey}	Write
DeleteApplication	Grants permission to delete an application	application*	aws:ResourceTag/${TagKey}	Write
DeleteAsset	Grants permission to delete an asset	asset*	aws:ResourceTag/${TagKey}	Write
DeleteAssetModel	Grants permission to delete an asset model	asset-model*	aws:ResourceTag/${TagKey}	Write
DeleteAssetModelCompositeModel	Grants permission to delete an asset model composite model	asset-model*	aws:ResourceTag/${TagKey}	Write
DeleteAssetModelInterfaceRelationship	Grants permission to delete a relationship between asset model and interface	asset-model*	aws:ResourceTag/${TagKey}	Write
DeleteComputationModel	Grants permission to delete a computation model	computation-model*	aws:ResourceTag/${TagKey}	Write
DeleteDashboard	Grants permission to delete a dashboard	dashboard*	aws:ResourceTag/${TagKey}	Write
DeleteDataset	Grants permission to delete a dataset	dataset*	aws:ResourceTag/${TagKey}	Write
		workspace	aws:ResourceTag/${TagKey}
DeleteGateway	Grants permission to delete a gateway	gateway*	aws:ResourceTag/${TagKey}	Write
DeletePipeline	Grants permission to delete a pipeline definition from a workspace	pipeline*	aws:ResourceTag/${TagKey}	Write
DeletePortal	Grants permission to delete a portal	portal*	aws:ResourceTag/${TagKey}	Write
DeleteProject	Grants permission to delete a project	project*	aws:ResourceTag/${TagKey}	Write
DeleteTask	Grants permission to delete a task definition from a workspace	task*	aws:ResourceTag/${TagKey}	Write
DeleteTimeSeries	Grants permission to delete a time series	asset	aws:ResourceTag/${TagKey}	Write
		time-series	aws:ResourceTag/${TagKey}
		workspace	aws:ResourceTag/${TagKey}
DeleteWorkspace	Grants permission to delete a workspace	workspace*	aws:ResourceTag/${TagKey}	Write
DescribeAccessPolicy	Grants permission to describe an access policy	access-policy*	aws:ResourceTag/${TagKey}	Read
DescribeAction	Grants permission to describe actions	asset	aws:ResourceTag/${TagKey}	Read
		computation-model	aws:ResourceTag/${TagKey}
DescribeApplication	Grants permission to describe an application	application*	aws:ResourceTag/${TagKey}	Read
DescribeAsset	Grants permission to describe an asset	asset*	aws:ResourceTag/${TagKey}	Read
DescribeAssetCompositeModel	Grants permission to describe an asset composite model	asset*	aws:ResourceTag/${TagKey}	Read
DescribeAssetModel	Grants permission to describe an asset model	asset-model*	aws:ResourceTag/${TagKey}	Read
DescribeAssetModelCompositeModel	Grants permission to describe an asset model composite model	asset-model*	aws:ResourceTag/${TagKey}	Read
DescribeAssetModelInterfaceRelationship	Grants permission to describe a relationship between asset model and interface	asset-model*	aws:ResourceTag/${TagKey}	Read
DescribeAssetProperty	Grants permission to describe an asset property	asset*	aws:ResourceTag/${TagKey}	Read
DescribeBulkImportJob	Grants permission to describe bulk import job	dataset	aws:ResourceTag/${TagKey}	Read
		workspace	aws:ResourceTag/${TagKey}
DescribeComputationModel	Grants permission to describe a computation model	computation-model*	aws:ResourceTag/${TagKey}	Read
DescribeComputationModelExecutionSummary	Grants permission to describe computation model execution summary	asset	aws:ResourceTag/${TagKey}	Read
		computation-model*	aws:ResourceTag/${TagKey}
DescribeDashboard	Grants permission to describe a dashboard	dashboard*	aws:ResourceTag/${TagKey}	Read
DescribeDataset	Grants permission to describe dataset	dataset*	aws:ResourceTag/${TagKey}	Read
		workspace	aws:ResourceTag/${TagKey}
DescribeDatasetExportJob	Grants permission to describe a dataset export job	workspace*	aws:ResourceTag/${TagKey}	Read
DescribeDefaultEncryptionConfiguration	Grants permission to describe the default encryption configuration for the AWS account			Read
DescribeEnrichmentJob	Grants permission to describe an enrichment job	workspace*	aws:ResourceTag/${TagKey}	Read
DescribeExecution	Grants permission to describe an execution			Read
DescribeGateway	Grants permission to describe a gateway	gateway*	aws:ResourceTag/${TagKey}	Read
DescribeGatewayCapabilityConfiguration	Grants permission to describe a capability configuration for a gateway	gateway*	aws:ResourceTag/${TagKey}	Read
DescribeLoggingOptions	Grants permission to describe logging options for the AWS account			Read
DescribePipeline	Grants permission to retrieve detailed information about a pipeline in a workspace	pipeline*	aws:ResourceTag/${TagKey}	Read
DescribePipelineExecution	Grants permission to retrieve detailed information about a pipeline execution	pipeline*	aws:ResourceTag/${TagKey}	Read
DescribePortal	Grants permission to describe a portal	portal*	aws:ResourceTag/${TagKey}	Read
DescribeProject	Grants permission to describe a project	project*	aws:ResourceTag/${TagKey}	Read
DescribeQuery	Grants permission to describe a query	workspace*	aws:ResourceTag/${TagKey}	Read
DescribeSearch	Grants permission to describe a search	workspace*	aws:ResourceTag/${TagKey}	Read
DescribeStorageConfiguration	Grants permission to describe the storage configuration for the AWS account			Read
DescribeTask	Grants permission to retrieve detailed information about a task in a workspace	task*	aws:ResourceTag/${TagKey}	Read
DescribeTimeSeries	Grants permission to describe a time series	asset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
		time-series	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workspace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
DescribeWorkspace	Grants permission to describe a workspace	workspace*	aws:ResourceTag/${TagKey}	Read
DisassociateAssets	Grants permission to disassociate a child asset from a parent asset by a hierarchy	asset*	aws:ResourceTag/${TagKey}	Write
DisassociateTimeSeriesFromAssetProperty	Grants permission to disassociate a time series from an asset property	asset*	aws:ResourceTag/${TagKey}	Write
		time-series*	aws:ResourceTag/${TagKey}
ExecuteAction	Grants permission to execute actions	asset	aws:ResourceTag/${TagKey}	Write
		computation-model	aws:ResourceTag/${TagKey}
ExecuteQuery	Grants permission to execute query			Read
GetAssetPropertyAggregates	Grants permission to retrieve computed aggregates for an asset property	asset	aws:ResourceTag/${TagKey}	Read
		time-series	aws:ResourceTag/${TagKey}
GetAssetPropertyValue	Grants permission to retrieve the latest value for an asset property	asset	aws:ResourceTag/${TagKey}	Read
		time-series	aws:ResourceTag/${TagKey}
GetAssetPropertyValueHistory	Grants permission to retrieve the value history for an asset property	asset	aws:ResourceTag/${TagKey}	Read
		time-series	aws:ResourceTag/${TagKey}
GetCaptureData	Grants permission to retrieve captured data	time-series*	aws:ResourceTag/${TagKey}	Read
		workspace*	aws:ResourceTag/${TagKey}
GetInterpolatedAssetPropertyValues	Grants permission to retrieve interpolated values for an asset property	asset	aws:ResourceTag/${TagKey}	Read
		time-series	aws:ResourceTag/${TagKey}
GetQueryResults	Grants permission to retrieve query results	workspace*	aws:ResourceTag/${TagKey}	Read
GetSearchResults	Grants permission to retrieve search results	workspace*	aws:ResourceTag/${TagKey}	Read
InvokeAssistant	Grants permission to invoke an assistant			Read
ListAccessPolicies	Grants permission to list all access policies for an identity or a resource	portal	aws:ResourceTag/${TagKey}	List
		project	aws:ResourceTag/${TagKey}
ListActions	Grants permission to list all actions	asset	aws:ResourceTag/${TagKey}	List
		computation-model	aws:ResourceTag/${TagKey}
ListApplications	Grants permission to list all applications			List
ListAssetModelCompositeModels	Grants permission to list all asset model composite models	asset-model*	aws:ResourceTag/${TagKey}	List
ListAssetModelProperties	Grants permission to list asset model properties	asset-model*	aws:ResourceTag/${TagKey}	List
ListAssetModels	Grants permission to list all asset models			List
ListAssetProperties	Grants permission to list asset properties	asset*	aws:ResourceTag/${TagKey}	List
ListAssetRelationships	Grants permission to list the asset relationship graph for an asset	asset*	aws:ResourceTag/${TagKey}	List
ListAssets	Grants permission to list all assets	asset-model	aws:ResourceTag/${TagKey}	List
ListAssociatedAssets	Grants permission to list all assets associated with an asset through a hierarchy	asset*	aws:ResourceTag/${TagKey}	List
ListBulkImportJobs	Grants permission to list bulk import jobs	workspace	aws:ResourceTag/${TagKey}	List
ListCompositionRelationships	Grants permission to list all asset model composition relationships	asset-model*	aws:ResourceTag/${TagKey}	List
ListComputationModelDataBindingUsages	Grants permission to list computation model data binding usages	asset	aws:ResourceTag/${TagKey}	List
		asset-model	aws:ResourceTag/${TagKey}
ListComputationModelResolveToResources	Grants permission to list computation model resolve to resources	computation-model*	aws:ResourceTag/${TagKey}	List
ListComputationModels	Grants permission to list all computation models			List
ListDashboards	Grants permission to list all dashboards in a project	project*	aws:ResourceTag/${TagKey}	List
ListDatasetDataSegmentRelationships	Grants permission to list dataset data segment relationships	dataset*	aws:ResourceTag/${TagKey}	List
		workspace	aws:ResourceTag/${TagKey}
ListDatasetDataSegments	Grants permission to list data segments for a dataset	dataset*	aws:ResourceTag/${TagKey}	List
		workspace	aws:ResourceTag/${TagKey}
ListDatasetExportJobs	Grants permission to list dataset export jobs	workspace*	aws:ResourceTag/${TagKey}	List
ListDatasets	Grants permission to list all datasets	workspace	aws:ResourceTag/${TagKey}	List
ListEnrichmentJobs	Grants permission to list enrichment jobs	dataset	aws:ResourceTag/${TagKey}	List
		workspace*	aws:ResourceTag/${TagKey}
ListExecutions	Grants permission to list executions	asset	aws:ResourceTag/${TagKey}	List
		computation-model	aws:ResourceTag/${TagKey}
ListGateways	Grants permission to list all gateways			List
ListInterfaceRelationships	Grants permission to list all asset models that are enforced by an interface	asset-model*	aws:ResourceTag/${TagKey}	List
ListPipelineExecutions	Grants permission to list pipeline executions for a pipeline in a workspace	pipeline*	aws:ResourceTag/${TagKey}	List
ListPipelines	Grants permission to list pipeline definitions in a workspace			List
ListPortals	Grants permission to list all portals			List
ListProjectAssets	Grants permission to list all assets associated with a project	project*	aws:ResourceTag/${TagKey}	List
ListProjects	Grants permission to list all projects in a portal	portal*	aws:ResourceTag/${TagKey}	List
ListQueries	Grants permission to list queries	workspace*	aws:ResourceTag/${TagKey}	List
ListSearches	Grants permission to list searches	workspace*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list all tags for a resource	access-policy	aws:ResourceTag/${TagKey}	Read
		application	aws:ResourceTag/${TagKey}
		asset	aws:ResourceTag/${TagKey}
		asset-model	aws:ResourceTag/${TagKey}
		computation-model	aws:ResourceTag/${TagKey}
		dashboard	aws:ResourceTag/${TagKey}
		dataset	aws:ResourceTag/${TagKey}
		gateway	aws:ResourceTag/${TagKey}
		pipeline	aws:ResourceTag/${TagKey}
		portal	aws:ResourceTag/${TagKey}
		project	aws:ResourceTag/${TagKey}
		task	aws:ResourceTag/${TagKey}
		time-series	aws:ResourceTag/${TagKey}
		workspace	aws:ResourceTag/${TagKey}
ListTasks	Grants permission to list task definitions in a workspace			List
ListTimeSeries	Grants permission to list time series	asset	aws:ResourceTag/${TagKey}	List
		workspace	aws:ResourceTag/${TagKey}
ListWorkspaces	Grants permission to list all workspaces			List
PutAssetModelInterfaceRelationship	Grants permission to create a relationship between asset model and interface	asset-model*	aws:ResourceTag/${TagKey}	Write
PutDefaultEncryptionConfiguration	Grants permission to set the default encryption configuration for the AWS account			Write
PutLoggingOptions	Grants permission to set logging options for the AWS account			Write
PutStorageConfiguration	Grants permission to configure storage settings for the AWS account			Write
StartPipelineExecution	Grants permission to start execution of a pipeline in a workspace	pipeline*	aws:ResourceTag/${TagKey}	Write
StartQuery	Grants permission to start a query on sensor data	workspace*	aws:ResourceTag/${TagKey}	Write
StartSearch	Grants permission to start a search	workspace*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag a resource	access-policy	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		application	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		asset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		asset-model	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		computation-model	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		dashboard	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		dataset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		gateway	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		pipeline	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		portal	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		project	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		task	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		time-series	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workspace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag a resource	access-policy	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		application	aws:ResourceTag/${TagKey} aws:TagKeys
		asset	aws:ResourceTag/${TagKey} aws:TagKeys
		asset-model	aws:ResourceTag/${TagKey} aws:TagKeys
		computation-model	aws:ResourceTag/${TagKey} aws:TagKeys
		dashboard	aws:ResourceTag/${TagKey} aws:TagKeys
		dataset	aws:ResourceTag/${TagKey} aws:TagKeys
		gateway	aws:ResourceTag/${TagKey} aws:TagKeys
		pipeline	aws:ResourceTag/${TagKey} aws:TagKeys
		portal	aws:ResourceTag/${TagKey} aws:TagKeys
		project	aws:ResourceTag/${TagKey} aws:TagKeys
		task	aws:ResourceTag/${TagKey} aws:TagKeys
		time-series	aws:ResourceTag/${TagKey} aws:TagKeys
		workspace	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAccessPolicy	Grants permission to update an access policy	access-policy*	aws:ResourceTag/${TagKey}	Write
UpdateAsset	Grants permission to update an asset	asset*	aws:ResourceTag/${TagKey}	Write
UpdateAssetModel	Grants permission to update an asset model	asset-model*	aws:ResourceTag/${TagKey}	Write
UpdateAssetModelCompositeModel	Grants permission to update asset model composite model	asset-model*	aws:ResourceTag/${TagKey}	Write
UpdateAssetProperty	Grants permission to update an asset property	asset*	aws:ResourceTag/${TagKey}	Write
UpdateComputationModel	Grants permission to update a computation model	asset	aws:ResourceTag/${TagKey}	Write
		asset-model	aws:ResourceTag/${TagKey}
		computation-model*	aws:ResourceTag/${TagKey}
UpdateDashboard	Grants permission to update a dashboard	dashboard*	aws:ResourceTag/${TagKey}	Write
UpdateDataset	Grants permission to update a dataset	dataset*	aws:ResourceTag/${TagKey}	Write
		workspace	aws:ResourceTag/${TagKey}
UpdateGateway	Grants permission to update a gateway	gateway*	aws:ResourceTag/${TagKey}	Write
UpdateGatewayCapabilityConfiguration	Grants permission to update a capability configuration for a gateway	gateway*	aws:ResourceTag/${TagKey}	Write
UpdatePipeline	Grants permission to update an existing pipeline definition in a workspace	pipeline*	aws:ResourceTag/${TagKey} iotsitewise:taskArns	Write
UpdatePortal	Grants permission to update a portal	portal*	aws:ResourceTag/${TagKey}	Write
UpdateProject	Grants permission to update a project	project*	aws:ResourceTag/${TagKey}	Write
UpdateTask	Grants permission to update an existing task definition in a workspace	task*	aws:ResourceTag/${TagKey}	Write
UpdateWorkspace	Grants permission to update a workspace	workspace*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for AWS IoT SiteWise

The following actions are defined by AWS IoT SiteWise but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
EnableSiteWiseIntegration	Grants permission to allow IoT SiteWise integrate with other services			Write
UpdateAssetModelPropertyRouting	Grants permission to update an AssetModel property routing	asset-model*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS IoT SiteWise

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
access-policy	arn:${Partition}:iotsitewise:${Region}:${Account}:access-policy/${AccessPolicyId}	aws:ResourceTag/${TagKey}
application	arn:${Partition}:iotsitewise:${Region}:${Account}:workspace/${WorkspaceName}/application/${ApplicationId}	aws:ResourceTag/${TagKey}
asset	arn:${Partition}:iotsitewise:${Region}:${Account}:asset/${AssetId}	aws:ResourceTag/${TagKey}
asset-model	arn:${Partition}:iotsitewise:${Region}:${Account}:asset-model/${AssetModelId}	aws:ResourceTag/${TagKey}
computation-model	arn:${Partition}:iotsitewise:${Region}:${Account}:computation-model/${ComputationModelId}	aws:ResourceTag/${TagKey}
dashboard	arn:${Partition}:iotsitewise:${Region}:${Account}:dashboard/${DashboardId}	aws:ResourceTag/${TagKey}
dataset	arn:${Partition}:iotsitewise:${Region}:${Account}:dataset/${DatasetId}	aws:ResourceTag/${TagKey}
gateway	arn:${Partition}:iotsitewise:${Region}:${Account}:gateway/${GatewayId}	aws:ResourceTag/${TagKey}
pipeline	arn:${Partition}:iotsitewise:${Region}:${Account}:workspace/${WorkspaceName}/pipeline/${PipelineName}	aws:ResourceTag/${TagKey}
portal	arn:${Partition}:iotsitewise:${Region}:${Account}:portal/${PortalId}	aws:ResourceTag/${TagKey}
project	arn:${Partition}:iotsitewise:${Region}:${Account}:project/${ProjectId}	aws:ResourceTag/${TagKey}
task	arn:${Partition}:iotsitewise:${Region}:${Account}:workspace/${WorkspaceName}/task/${TaskName}	aws:ResourceTag/${TagKey}
time-series	arn:${Partition}:iotsitewise:${Region}:${Account}:time-series/${TimeSeriesId}	aws:ResourceTag/${TagKey}
workspace	arn:${Partition}:iotsitewise:${Region}:${Account}:workspace/${WorkspaceName}	aws:ResourceTag/${TagKey}

Condition keys for AWS IoT SiteWise

AWS IoT SiteWise defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags attached to the resource	String
aws:TagKeys	Filters access by the tag keys in the request	ArrayOfString
iotsitewise:assetHierarchyPath	Filters access by an asset hierarchy path, which is the string of asset IDs in the asset's hierarchy, each separated by a forward slash	String
iotsitewise:childAssetId	Filters access by the ID of a child asset being associated whith a parent asset	String
iotsitewise:group	Filters access by the ID of an AWS Single Sign-On group	String
iotsitewise:iam	Filters access by the ID of an AWS IAM identity	String
iotsitewise:isAssociatedWithAssetProperty	Filters access by data streams associated with or not associated with asset properties	String
iotsitewise:portal	Filters access by the ID of a portal	String
iotsitewise:project	Filters access by the ID of a project	String
iotsitewise:propertyAlias	Filters access by the property alias	String
iotsitewise:propertyId	Filters access by the ID of an asset property	String
iotsitewise:taskArns	Filters access by the task ARNs specified in the pipeline request	ArrayOfARN
iotsitewise:user	Filters access by the ID of an AWS Single Sign-On user	String