Actions, resources, and condition keys for Amazon Kendra

Amazon Kendra (service prefix: kendra) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Actions defined by Amazon Kendra

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys
AssociateEntitiesToExperience	Grants permission to put principal mapping in index	Write	experience*
AssociateEntitiesToExperience	Grants permission to put principal mapping in index	Write	index*
AssociatePersonasToEntities	Defines the specific permissions of users or groups in your AWS SSO identity source with access to your Amazon Kendra experience	Write	experience*
AssociatePersonasToEntities		Write	index*
BatchDeleteDocument	Grants permission to batch delete document	Write	index*
BatchDeleteFeaturedResultsSet	Grants permission to delete a featured results set	Write	featured-results-set*
BatchDeleteFeaturedResultsSet	Grants permission to delete a featured results set	Write	index*
BatchGetDocumentStatus	Grants permission to do batch get document status	Read	index*
BatchPutDocument	Grants permission to batch put document	Write	index*
ClearQuerySuggestions	Grants permission to clear out the suggestions for a given index, generated so far	Write	index*
CreateAccessControlConfiguration	Grants permission to create an access control configuration	Write	index*
CreateDataSource	Grants permission to create a data source	Write	index*
CreateDataSource	Grants permission to create a data source	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateExperience	Creates an Amazon Kendra experience such as a search application	Write	index*
CreateFaq	Grants permission to create an Faq	Write	index*
CreateFaq	Grants permission to create an Faq	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateFeaturedResultsSet	Grants permission to create a featured results set	Write	index*
CreateFeaturedResultsSet	Grants permission to create a featured results set	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateIndex	Grants permission to create an Index	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateQuerySuggestionsBlockList	Grants permission to create a QuerySuggestions BlockList	Write	index*
CreateQuerySuggestionsBlockList	Grants permission to create a QuerySuggestions BlockList	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateThesaurus	Grants permission to create a Thesaurus	Write	index*
CreateThesaurus	Grants permission to create a Thesaurus	Write		aws:RequestTag/${TagKey} aws:TagKeys
DeleteAccessControlConfiguration	Grants permission to delete an access control configuration	Write	access-control-configuration*
DeleteAccessControlConfiguration	Grants permission to delete an access control configuration	Write	index*
DeleteDataSource	Grants permission to delete a data source	Write	data-source*
DeleteDataSource	Grants permission to delete a data source	Write	index*
DeleteExperience	Deletes your Amazon Kendra experience such as a search application	Write	experience*
DeleteExperience		Write	index*
DeleteFaq	Grants permission to delete an Faq	Write	faq*
DeleteFaq	Grants permission to delete an Faq	Write	index*
DeleteIndex	Grants permission to delete an Index	Write	index*
DeletePrincipalMapping	Grants permission to delete principal mapping from index	Write	index*
DeletePrincipalMapping	Grants permission to delete principal mapping from index	Write	data-source
DeleteQuerySuggestionsBlockList	Grants permission to delete a QuerySuggestions BlockList	Write	index*
DeleteQuerySuggestionsBlockList	Grants permission to delete a QuerySuggestions BlockList	Write	query-suggestions-block-list*
DeleteThesaurus	Grants permission to delete a Thesaurus	Write	index*
DeleteThesaurus	Grants permission to delete a Thesaurus	Write	thesaurus*
DescribeAccessControlConfiguration	Grants permission to describe an access control configuration	Read	access-control-configuration*
DescribeAccessControlConfiguration		Read	index*
DescribeDataSource	Grants permission to describe a data source	Read	data-source*
DescribeDataSource	Grants permission to describe a data source	Read	index*
DescribeExperience	Gets information about your Amazon Kendra experience such as a search application	Read	experience*
DescribeExperience		Read	index*
DescribeFaq	Grants permission to describe an Faq	Read	faq*
DescribeFaq	Grants permission to describe an Faq	Read	index*
DescribeFeaturedResultsSet	Grants permission to describe a featured results set	Read	featured-results-set*
DescribeFeaturedResultsSet	Grants permission to describe a featured results set	Read	index*
DescribeIndex	Grants permission to describe an Index	Read	index*
DescribePrincipalMapping	Grants permission to describe principal mapping from index	Read	index*
DescribePrincipalMapping	Grants permission to describe principal mapping from index	Read	data-source
DescribeQuerySuggestionsBlockList	Grants permission to describe a QuerySuggestions BlockList	Read	index*
DescribeQuerySuggestionsBlockList	Grants permission to describe a QuerySuggestions BlockList	Read	query-suggestions-block-list*
DescribeQuerySuggestionsConfig	Grants permission to describe the query suggestions configuration for an index	Read	index*
DescribeThesaurus	Grants permission to describe a Thesaurus	Read	index*
DescribeThesaurus	Grants permission to describe a Thesaurus	Read	thesaurus*
DisassociateEntitiesFromExperience	Prevents users or groups in your AWS SSO identity source from accessing your Amazon Kendra experience	Write	experience*
DisassociateEntitiesFromExperience		Write	index*
DisassociatePersonasFromEntities	Removes the specific permissions of users or groups in your AWS SSO identity source with access to your Amazon Kendra experience	Write	experience*
DisassociatePersonasFromEntities		Write	index*
GetQuerySuggestions	Grants permission to get suggestions for a query prefix	Read	index*
GetSnapshots	Retrieves search metrics data	Read	index*
ListAccessControlConfigurations	Grants permission to list the access control configurations	List	index*
ListDataSourceSyncJobs	Grants permission to get Data Source sync job history	List	data-source*
ListDataSourceSyncJobs	Grants permission to get Data Source sync job history	List	index*
ListDataSources	Grants permission to list the data sources	List	index*
ListEntityPersonas	Lists specific permissions of users and groups with access to your Amazon Kendra experience	List	experience*
ListEntityPersonas		List	index*
ListExperienceEntities	Lists users or groups in your AWS SSO identity source that are granted access to your Amazon Kendra experience	List	experience*
ListExperienceEntities		List	index*
ListExperiences	Lists one or more Amazon Kendra experiences. You can create an Amazon Kendra experience such as a search application	List	index*
ListFaqs	Grants permission to list the Faqs	List	index*
ListFeaturedResultsSets	Grants permission to list the featured results sets	List	index*
ListGroupsOlderThanOrderingId	Grants permission to list groups that are older than an ordering id	List	index*
ListGroupsOlderThanOrderingId		List	data-source
ListIndices	Grants permission to list the indexes	List
ListQuerySuggestionsBlockLists	Grants permission to list the QuerySuggestions BlockLists	List	index*
ListTagsForResource	Grants permission to list tags for a resource	Read	data-source
			faq
			featured-results-set
			index
			query-suggestions-block-list
			thesaurus
ListThesauri	Grants permission to list the Thesauri	List	index*
PutPrincipalMapping	Grants permission to put principal mapping in index	Write	index*
PutPrincipalMapping	Grants permission to put principal mapping in index	Write	data-source
Query	Grants permission to query documents and faqs	Read	index*
Retrieve	Grants permission to retrieve relevant content from an index	Read	index*
StartDataSourceSyncJob	Grants permission to start Data Source sync job	Write	data-source*
StartDataSourceSyncJob	Grants permission to start Data Source sync job	Write	index*
StopDataSourceSyncJob	Grants permission to stop Data Source sync job	Write	data-source*
StopDataSourceSyncJob	Grants permission to stop Data Source sync job	Write	index*
SubmitFeedback	Grants permission to send feedback about a query results	Write	index*
TagResource	Grants permission to tag a resource with given key value pairs	Tagging	data-source
			faq
			featured-results-set
			index
			query-suggestions-block-list
			thesaurus
				aws:RequestTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove the tag with the given key from a resource	Tagging	data-source
			faq
			featured-results-set
			index
			query-suggestions-block-list
			thesaurus
				aws:TagKeys
UpdateAccessControlConfiguration	Grants permission to update an access control configuration	Write	access-control-configuration*
UpdateAccessControlConfiguration	Grants permission to update an access control configuration	Write	index*
UpdateDataSource	Grants permission to update a data source	Write	data-source*
UpdateDataSource	Grants permission to update a data source	Write	index*
UpdateExperience	Updates your Amazon Kendra experience such as a search application	Write	index*
UpdateFeaturedResultsSet	Grants permission to update a featured results set	Write	featured-results-set*
UpdateFeaturedResultsSet	Grants permission to update a featured results set	Write	index*
UpdateIndex	Grants permission to update an Index	Write	index*
UpdateQuerySuggestionsBlockList	Grants permission to update a QuerySuggestions BlockList	Write	index*
UpdateQuerySuggestionsBlockList	Grants permission to update a QuerySuggestions BlockList	Write	query-suggestions-block-list*
UpdateQuerySuggestionsConfig	Grants permission to update the query suggestions configuration for an index	Write	index*
UpdateThesaurus	Grants permission to update a thesaurus	Write	index*
UpdateThesaurus	Grants permission to update a thesaurus	Write	thesaurus*

Resource types defined by Amazon Kendra

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
index	`arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}`	aws:ResourceTag/${TagKey}
data-source	`arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/data-source/${DataSourceId}`	aws:ResourceTag/${TagKey}
faq	`arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/faq/${FaqId}`	aws:ResourceTag/${TagKey}
experience	`arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/experience/${ExperienceId}`
thesaurus	`arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/thesaurus/${ThesaurusId}`	aws:ResourceTag/${TagKey}
query-suggestions-block-list	`arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/query-suggestions-block-list/${QuerySuggestionsBlockListId}`	aws:ResourceTag/${TagKey}
featured-results-set	`arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/featured-results-set/${FeaturedResultsSetId}`	aws:ResourceTag/${TagKey}
access-control-configuration	`arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/access-control-configuration/${AccessControlConfigurationId}`

Condition keys for Amazon Kendra

Amazon Kendra defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS IQ Permissions

Amazon Kendra Intelligent Ranking