Actions, resources, and condition keys for Amazon Managed Service for Prometheus

Amazon Managed Service for Prometheus (service prefix: aps) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Topics

Actions defined by Amazon Managed Service for Prometheus
Resource types defined by Amazon Managed Service for Prometheus
Condition keys for Amazon Managed Service for Prometheus

Actions defined by Amazon Managed Service for Prometheus

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys	Dependent actions
CreateAlertManagerAlerts	Grants permission to create alerts	Write	workspace*
CreateAlertManagerAlerts	Grants permission to create alerts	Write		aws:ResourceTag/${TagKey}
CreateAlertManagerDefinition	Grants permission to create an alert manager definition	Write	workspace*
CreateAlertManagerDefinition	Grants permission to create an alert manager definition	Write		aws:ResourceTag/${TagKey}
CreateLoggingConfiguration	Grants permission to create a logging configuration	Write	workspace*
CreateLoggingConfiguration	Grants permission to create a logging configuration	Write		aws:ResourceTag/${TagKey}
CreateRuleGroupsNamespace	Grants permission to create a rule groups namespace	Write	rulegroupsnamespace*
CreateRuleGroupsNamespace	Grants permission to create a rule groups namespace	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateScraper	Grants permission to create a scraper	Write	cluster*		aps:TagResource ec2:DescribeSecurityGroups ec2:DescribeSubnets eks:DescribeCluster iam:CreateServiceLinkedRole
			workspace*
				aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateWorkspace	Grants permission to create a workspace	Write		aws:RequestTag/${TagKey} aws:TagKeys
DeleteAlertManagerDefinition	Grants permission to delete an alert manager definition	Write	workspace*
DeleteAlertManagerDefinition	Grants permission to delete an alert manager definition	Write		aws:ResourceTag/${TagKey}
DeleteAlertManagerSilence	Grants permission to delete a silence	Write	workspace*
DeleteAlertManagerSilence	Grants permission to delete a silence	Write		aws:ResourceTag/${TagKey}
DeleteLoggingConfiguration	Grants permission to delete a logging configuration	Write	workspace*
DeleteLoggingConfiguration	Grants permission to delete a logging configuration	Write		aws:ResourceTag/${TagKey}
DeleteRuleGroupsNamespace	Grants permission to delete a rule groups namespace	Write	rulegroupsnamespace*
DeleteRuleGroupsNamespace	Grants permission to delete a rule groups namespace	Write		aws:ResourceTag/${TagKey}
DeleteScraper	Grants permission to delete a scraper	Write	scraper*
DeleteScraper	Grants permission to delete a scraper	Write		aws:ResourceTag/${TagKey}
DeleteWorkspace	Grants permission to delete a workspace	Write	workspace*
DeleteWorkspace	Grants permission to delete a workspace	Write		aws:ResourceTag/${TagKey}
DescribeAlertManagerDefinition	Grants permission to describe an alert manager definition	Read	workspace*
DescribeAlertManagerDefinition	Grants permission to describe an alert manager definition	Read		aws:ResourceTag/${TagKey}
DescribeLoggingConfiguration	Grants permission to describe a logging configuration	Read	workspace*
DescribeLoggingConfiguration	Grants permission to describe a logging configuration	Read		aws:ResourceTag/${TagKey}
DescribeRuleGroupsNamespace	Grants permission to describe a rule groups namespace	Read	rulegroupsnamespace*
DescribeRuleGroupsNamespace	Grants permission to describe a rule groups namespace	Read		aws:ResourceTag/${TagKey}
DescribeScraper	Grants permission to describe a scraper	Read	scraper*
DescribeScraper	Grants permission to describe a scraper	Read		aws:ResourceTag/${TagKey}
DescribeWorkspace	Grants permission to describe a workspace	Read	workspace*
DescribeWorkspace	Grants permission to describe a workspace	Read		aws:ResourceTag/${TagKey}
GetAlertManagerSilence	Grants permission to get a silence	Read	workspace*
GetAlertManagerSilence	Grants permission to get a silence	Read		aws:ResourceTag/${TagKey}
GetAlertManagerStatus	Grants permission to get current status of an alertmanager	Read	workspace*
GetAlertManagerStatus	Grants permission to get current status of an alertmanager	Read		aws:ResourceTag/${TagKey}
GetDefaultScraperConfiguration	Grants permission to get default scraper configuration	Read
GetLabels	Grants permission to retrieve AMP workspace labels	Read	workspace*
GetLabels	Grants permission to retrieve AMP workspace labels	Read		aws:ResourceTag/${TagKey}
GetMetricMetadata	Grants permission to retrieve the metadata for AMP workspace metrics	Read	workspace*
GetMetricMetadata		Read		aws:ResourceTag/${TagKey}
GetSeries	Grants permission to retrieve AMP workspace time series data	Read	workspace*
GetSeries		Read		aws:ResourceTag/${TagKey}
ListAlertManagerAlertGroups	Grants permission to list groups	Read	workspace*
ListAlertManagerAlertGroups	Grants permission to list groups	Read		aws:ResourceTag/${TagKey}
ListAlertManagerAlerts	Grants permission to list alerts	Read	workspace*
ListAlertManagerAlerts	Grants permission to list alerts	Read		aws:ResourceTag/${TagKey}
ListAlertManagerReceivers	Grants permission to list receivers	Read	workspace*
ListAlertManagerReceivers	Grants permission to list receivers	Read		aws:ResourceTag/${TagKey}
ListAlertManagerSilences	Grants permission to list silences	Read	workspace*
ListAlertManagerSilences	Grants permission to list silences	Read		aws:ResourceTag/${TagKey}
ListAlerts	Grants permission to list active alerts	Read	workspace*
ListAlerts	Grants permission to list active alerts	Read		aws:ResourceTag/${TagKey}
ListRuleGroupsNamespaces	Grants permission to list rule groups namespaces	List	workspace*
ListRuleGroupsNamespaces	Grants permission to list rule groups namespaces	List		aws:ResourceTag/${TagKey}
ListRules	Grants permission to list alerting and recording rules	Read	workspace*
ListRules	Grants permission to list alerting and recording rules	Read		aws:ResourceTag/${TagKey}
ListScrapers	Grants permission to list scrapers	List
ListTagsForResource	Grants permission to list tags on an AMP resource	Read	rulegroupsnamespace
			scraper
			workspace
				aws:TagKeys aws:RequestTag/${TagKey}
ListWorkspaces	Grants permission to list workspaces	List
PutAlertManagerDefinition	Grants permission to update an alert manager definition	Write	workspace*
PutAlertManagerDefinition	Grants permission to update an alert manager definition	Write		aws:ResourceTag/${TagKey}
PutAlertManagerSilences	Grants permission to create or update a silence	Write	workspace*
PutAlertManagerSilences	Grants permission to create or update a silence	Write		aws:ResourceTag/${TagKey}
PutRuleGroupsNamespace	Grants permission to update a rule groups namespace	Write	rulegroupsnamespace*
PutRuleGroupsNamespace	Grants permission to update a rule groups namespace	Write		aws:ResourceTag/${TagKey}
QueryMetrics	Grants permission to run a query on AMP workspace metrics	Read	workspace*
QueryMetrics	Grants permission to run a query on AMP workspace metrics	Read		aws:ResourceTag/${TagKey}
RemoteWrite	Grants permission to perform a remote write operation to initiate the streaming of metrics to AMP workspace	Write	workspace*
RemoteWrite		Write		aws:ResourceTag/${TagKey}
TagResource	Grants permission to tag an AMP resource	Tagging	rulegroupsnamespace
			scraper
			workspace
				aws:TagKeys aws:RequestTag/${TagKey}
UntagResource	Grants permission to untag an AMP resource	Tagging	rulegroupsnamespace
			scraper
			workspace
				aws:TagKeys
UpdateLoggingConfiguration	Grants permission to update a logging configuration	Write	workspace*
UpdateLoggingConfiguration	Grants permission to update a logging configuration	Write		aws:ResourceTag/${TagKey}
UpdateWorkspaceAlias	Grants permission to modify the alias of existing AMP workspace	Write	workspace*
UpdateWorkspaceAlias		Write		aws:ResourceTag/${TagKey}

Resource types defined by Amazon Managed Service for Prometheus

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
workspace	`arn:${Partition}:aps:${Region}:${Account}:workspace/${WorkspaceId}`	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
rulegroupsnamespace	`arn:${Partition}:aps:${Region}:${Account}:rulegroupsnamespace/${WorkspaceId}/${Namespace}`	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
scraper	`arn:${Partition}:aps:${Region}:${Account}:scraper/${ScraperId}`	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
cluster	`arn:${Partition}:eks:${Region}:${Account}:cluster/${ClusterName}`	aws:ResourceTag/${TagKey}

Condition keys for Amazon Managed Service for Prometheus

Amazon Managed Service for Prometheus defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access based on the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access based on the tags associated with the resource	String
aws:TagKeys	Filters access based on the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Managed Grafana

Amazon Managed Streaming for Apache Kafka