Actions, resources, and condition keys for Amazon Lex V2

Amazon Lex V2 (service prefix: lex) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Actions defined by Amazon Lex V2

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys	Dependent actions
BatchCreateCustomVocabularyItem	Grants permission to create new items in an existing custom vocabulary	Write	bot*
BatchDeleteCustomVocabularyItem	Grants permission to delete existing items in an existing custom vocabulary	Write	bot*
BatchUpdateCustomVocabularyItem	Grants permission to update existing items in an existing custom vocabulary	Write	bot*
BuildBotLocale	Grants permission to build an existing bot locale in a bot	Write	bot*
CreateBot	Grants permission to create a new bot and a test bot alias pointing to the DRAFT bot version	Write	bot*
			bot alias*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateBotAlias	Grants permission to create a new bot alias in a bot	Write	bot alias*
CreateBotAlias	Grants permission to create a new bot alias in a bot	Write		aws:TagKeys aws:RequestTag/${TagKey}
CreateBotChannel [permission only]	Grants permission to create a bot channel in an existing bot	Write	bot*
CreateBotLocale	Grants permission to create a new bot locale in an existing bot	Write	bot*
CreateBotReplica	Grants permission to create bot replica for a bot	Write	bot*
CreateBotVersion	Grants permission to create a new version of an existing bot	Write	bot*
CreateCustomVocabulary [permission only]	Grants permission to create a new custom vocabulary in an existing bot locale	Write	bot*
CreateExport	Grants permission to create an export for an existing resource	Write	bot
CreateExport		Write	test set
CreateIntent	Grants permission to create a new intent in an existing bot locale	Write	bot*
CreateResourcePolicy	Grants permission to create a new resource policy for a Lex resource	Write	bot
CreateResourcePolicy		Write	bot alias
CreateSlot	Grants permission to create a new slot in an intent	Write	bot*
CreateSlotType	Grants permission to create a new slot type in an existing bot locale	Write	bot*
CreateTestSet [permission only]	Grants permission to import a new test-set	Write
CreateTestSetDiscrepancyReport	Grants permission to create a test set discrepancy report	Write	test set*
CreateUploadUrl	Grants permission to create an upload url for import file	Write
DeleteBot	Grants permission to delete an existing bot	Write	bot*		lex:DeleteBotAlias lex:DeleteBotChannel lex:DeleteBotLocale lex:DeleteBotVersion lex:DeleteIntent lex:DeleteSlot lex:DeleteSlotType
DeleteBot	Grants permission to delete an existing bot	Write	bot alias*
DeleteBotAlias	Grants permission to delete an existing bot alias in a bot	Write	bot alias*
DeleteBotChannel [permission only]	Grants permission to delete an existing bot channel	Write	bot*
DeleteBotLocale	Grants permission to delete an existing bot locale in a bot	Write	bot*		lex:DeleteIntent lex:DeleteSlot lex:DeleteSlotType
DeleteBotReplica	Grants permission to delete an existing bot replica	Write	bot*
DeleteBotVersion	Grants permission to delete an existing bot version	Write	bot*
DeleteCustomVocabulary	Grants permission to delete an existing custom vocabulary in a bot locale	Write	bot*
DeleteExport	Grants permission to delete an existing export	Write	bot
DeleteExport	Grants permission to delete an existing export	Write	test set
DeleteImport	Grants permission to delete an existing import	Write	bot
DeleteImport	Grants permission to delete an existing import	Write	test set
DeleteIntent	Grants permission to delete an existing intent in a bot locale	Write	bot*
DeleteResourcePolicy	Grants permission to delete an existing resource policy for a Lex resource	Write	bot
DeleteResourcePolicy		Write	bot alias
DeleteSession	Grants permission to delete session information for a bot alias and user ID	Write	bot alias*
DeleteSlot	Grants permission to delete an existing slot in an intent	Write	bot*
DeleteSlotType	Grants permission to delete an existing slot type in a bot locale	Write	bot*
DeleteTestSet	Grants permission to delete an existing test set	Write	test set*
DeleteUtterances	Grants permission to delete utterance data for a bot	Write	bot*
DescribeBot	Grants permission to retrieve an existing bot	Read	bot*
DescribeBotAlias	Grants permission to retrieve an existing bot alias	Read	bot alias*
DescribeBotChannel [permission only]	Grants permission to retrieve an existing bot channel	Read	bot*
DescribeBotLocale	Grants permission to retrieve an existing bot locale	Read	bot*
DescribeBotRecommendation	Grants permission to retrieve metadata information about a bot recommendation	Read	bot*
DescribeBotReplica	Grants permission to retrieve an existing bot replica	Read	bot*
DescribeBotResourceGeneration	Grants permission to retrieve metadata information for a bot resource generation	Read	bot*
DescribeBotVersion	Grants permission to retrieve an existing bot version	Read	bot*
DescribeCustomVocabulary [permission only]	Grants permission to retrieve an existing custom vocabulary	Read	bot*
DescribeCustomVocabularyMetadata	Grants permission to retrieve metadata of an existing custom vocabulary	Read	bot*
DescribeExport	Grants permission to retrieve an existing export	Read	bot		lex:DescribeBot lex:DescribeBotLocale lex:DescribeIntent lex:DescribeSlot lex:DescribeSlotType lex:ListBotLocales lex:ListIntents lex:ListSlotTypes lex:ListSlots
DescribeExport	Grants permission to retrieve an existing export	Read	test set
DescribeImport	Grants permission to retrieve an existing import	Read	bot
DescribeImport	Grants permission to retrieve an existing import	Read	test set
DescribeIntent	Grants permission to retrieve an existing intent	Read	bot*
DescribeResourcePolicy	Grants permission to retrieve an existing resource policy for a Lex resource	Read	bot
DescribeResourcePolicy		Read	bot alias
DescribeSlot	Grants permission to retrieve an existing slot	Read	bot*
DescribeSlotType	Grants permission to retrieve an existing slot type	Read	bot*
DescribeTestExecution	Grants permission to retrieve test execution metadata	Read	test set*
DescribeTestSet	Grants permission to retrieve an existing test set	Read	test set*
DescribeTestSetDiscrepancyReport	Grants permission to retrieve test set discrepancy report metadata	Read	test set*
DescribeTestSetGeneration	Grants permission to retrieve test set generation metadata	Read	test set
GenerateBotElement	Grants permission to generate supported fields or elements for a bot	Read	bot*
GetSession	Grants permission to retrieve session information for a bot alias and user ID	Read	bot alias*
GetTestExecutionArtifactsUrl	Grants permission to retrieve artifacts URL for a test execution	Read	test set*
ListAggregatedUtterances	Grants permission to list utterances and statistics for a bot	List	bot*
ListBotAliasReplicas	Grants permission to list alias replicas in a bot replica	List	bot*
ListBotAliases	Grants permission to list bot aliases in an bot	List	bot*
ListBotChannels [permission only]	Grants permission to list bot channels	List	bot*
ListBotLocales	Grants permission to list bot locales in a bot	List	bot*
ListBotRecommendations	Grants permission to get a list of bot recommendations that meet the specified criteria	List	bot*
ListBotReplicas	Grants permission to list replicas of a bot	List	bot*
ListBotResourceGenerations	Grants permission to list the resource generations for a bot	List	bot*
ListBotVersionReplicas	Grants permission to list version replicas in a bot replica	List	bot*
ListBotVersions	Grants permission to list existing bot versions	List	bot*
ListBots	Grants permission to list existing bots	List
ListBuiltInIntents	Grants permission to list built-in intents	List
ListBuiltInSlotTypes	Grants permission to list built-in slot types	List
ListCustomVocabularyItems	Grants permission to list items of an existing custom vocabulary	List	bot*
ListExports	Grants permission to list existing exports	List
ListImports	Grants permission to list existing imports	List
ListIntentMetrics	Grants permission to list intent analytics metrics for a bot	List	bot*
ListIntentPaths	Grants permission to list intent path analytics for a bot	List	bot*
ListIntentStageMetrics	Grants permission to list intentStage analytics metrics for a bot	List	bot*
ListIntents	Grants permission to list intents in a bot	List	bot*
ListRecommendedIntents	Grants permission to get a list of recommended intents provided by the bot recommendation	List	bot*
ListSessionAnalyticsData	Grants permission to list session analytics data for a bot	List	bot*
ListSessionMetrics	Grants permission to list session analytics metrics for a bot	List	bot*
ListSlotTypes	Grants permission to list slot types in a bot	List	bot*
ListSlots	Grants permission to list slots in an intent	List	bot*
ListTagsForResource	Grants permission to lists tags for a Lex resource	Read	bot
			bot alias
			test set
ListTestExecutionResultItems	Grants permission to retrieve test results data for a test execution	Read	test set*		lex:ListTestSetRecords
ListTestExecutions	Grants permission to list test executions	List
ListTestSetRecords	Grants permission to retrieve records inside an existing test set	Read	test set*
ListTestSets	Grants permission to list test sets	List
PutSession	Grants permission to create a new session or modify an existing session for a bot alias and user ID	Write	bot alias*
RecognizeText	Grants permission to send user input (text-only) to an bot alias	Write	bot alias*
RecognizeUtterance	Grants permission to send user input (text or speech) to an bot alias	Write	bot alias*
SearchAssociatedTranscripts	Grants permission to search for associated transcripts that meet the specified criteria	List	bot*
StartBotRecommendation	Grants permission to start a bot recommendation for an existing bot locale	Write	bot*
StartBotResourceGeneration	Grants permission to start a resource generation for an existing bot locale	Write	bot*
StartConversation	Grants permission to stream user input (speech/text/DTMF) to a bot alias	Write	bot alias*
StartImport	Grants permission to start a new import with the uploaded import file	Write	bot		lex:CreateBot lex:CreateBotLocale lex:CreateCustomVocabulary lex:CreateIntent lex:CreateSlot lex:CreateSlotType lex:CreateTestSet lex:DeleteBotLocale lex:DeleteCustomVocabulary lex:DeleteIntent lex:DeleteSlot lex:DeleteSlotType lex:UpdateBot lex:UpdateBotLocale lex:UpdateCustomVocabulary lex:UpdateIntent lex:UpdateSlot lex:UpdateSlotType lex:UpdateTestSet
			bot alias
			test set
				aws:TagKeys aws:RequestTag/${TagKey}
StartTestExecution	Grants permission to start a test execution using a test set	Write	test set*
StartTestSetGeneration	Grants permission to generate a test set	Write	test set
StopBotRecommendation	Grants permission to stop a bot recommendation for an existing bot locale	Write	bot*
TagResource	Grants permission to add or overwrite tags of a Lex resource	Tagging	bot
			bot alias
			test set
				aws:TagKeys aws:RequestTag/${TagKey}
UntagResource	Grants permission to remove tags from a Lex resource	Tagging	bot
			bot alias
			test set
				aws:TagKeys
UpdateBot	Grants permission to update an existing bot	Write	bot*
UpdateBotAlias	Grants permission to update an existing bot alias	Write	bot alias*
UpdateBotLocale	Grants permission to update an existing bot locale	Write	bot*
UpdateBotRecommendation	Grants permission to update an existing bot recommendation request	Write	bot*
UpdateCustomVocabulary [permission only]	Grants permission to update an existing custom vocabulary	Write	bot*
UpdateExport	Grants permission to update an existing export	Write	bot*
UpdateIntent	Grants permission to update an existing intent	Write	bot*
UpdateResourcePolicy	Grants permission to update an existing resource policy for a Lex resource	Write	bot
UpdateResourcePolicy		Write	bot alias
UpdateSlot	Grants permission to update an existing slot	Write	bot*
UpdateSlotType	Grants permission to update an existing slot type	Write	bot*
UpdateTestSet	Grants permission to update an existing test set	Write	test set*

Resource types defined by Amazon Lex V2

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
bot	`arn:${Partition}:lex:${Region}:${Account}:bot/${BotId}`	aws:ResourceTag/${TagKey}
bot alias	`arn:${Partition}:lex:${Region}:${Account}:bot-alias/${BotId}/${BotAliasId}`	aws:ResourceTag/${TagKey}
test set	`arn:${Partition}:lex:${Region}:${Account}:test-set/${TestSetId}`	aws:ResourceTag/${TagKey}

Condition keys for Amazon Lex V2

Amazon Lex V2 defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags attached to a Lex resource	String
aws:TagKeys	Filters access by the set of tag keys in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Lex

AWS License Manager