Actions, resources, and condition keys for Amazon Pinpoint

Amazon Pinpoint (service prefix: mobiletargeting) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Topics

Actions defined by Amazon Pinpoint
Resource types defined by Amazon Pinpoint
Condition keys for Amazon Pinpoint

Actions defined by Amazon Pinpoint

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys
CreateApp	Grants permission to create an app	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateCampaign	Grants permission to create a campaign for an app	Write	apps*
CreateCampaign	Grants permission to create a campaign for an app	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateEmailTemplate	Grants permission to create an email template	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateExportJob	Grants permission to create an export job that exports endpoint definitions to Amazon S3	Write	apps*
CreateImportJob	Grants permission to import endpoint definitions from to create a segment	Write	apps*
CreateInAppTemplate	Grants permission to create an in-app message template	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateJourney	Grants permission to create a Journey for an app	Write	apps*
CreateJourney	Grants permission to create a Journey for an app	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreatePushTemplate	Grants permission to create a push notification template	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateRecommenderConfiguration	Grants permission to create an Amazon Pinpoint configuration for a recommender model	Write
CreateSegment	Grants permission to create a segment that is based on endpoint data reported to Pinpoint by your app. To allow a user to create a segment by importing endpoint data from outside of Pinpoint, allow the mobiletargeting:CreateImportJob action	Write	apps*
CreateSegment		Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateSmsTemplate	Grants permission to create an sms message template	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateVoiceTemplate	Grants permission to create a voice message template	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
DeleteAdmChannel	Grants permission to delete the ADM channel for an app	Write	apps*
DeleteApnsChannel	Grants permission to delete the APNs channel for an app	Write	apps*
DeleteApnsSandboxChannel	Grants permission to delete the APNs sandbox channel for an app	Write	apps*
DeleteApnsVoipChannel	Grants permission to delete the APNs VoIP channel for an app	Write	apps*
DeleteApnsVoipSandboxChannel	Grants permission to delete the APNs VoIP sandbox channel for an app	Write	apps*
DeleteApp	Grants permission to delete a specific campaign	Write	apps*
DeleteBaiduChannel	Grants permission to delete the Baidu channel for an app	Write	apps*
DeleteCampaign	Grants permission to delete a specific campaign	Write	apps*
DeleteCampaign	Grants permission to delete a specific campaign	Write	campaigns*
DeleteEmailChannel	Grants permission to delete the email channel for an app	Write	apps*
DeleteEmailTemplate	Grants permission to delete an email template or an email template version	Write	templates*
DeleteEndpoint	Grants permission to delete an endpoint	Write	apps*
DeleteEventStream	Grants permission to delete the event stream for an app	Write	apps*
DeleteGcmChannel	Grants permission to delete the GCM channel for an app	Write	apps*
DeleteInAppTemplate	Grants permission to delete an in-app message template or an in-app message template version	Write	templates*
DeleteJourney	Grants permission to delete a specific journey	Write	apps*
DeleteJourney	Grants permission to delete a specific journey	Write	journeys*
DeletePushTemplate	Grants permission to delete a push notification template or a push notification template version	Write	templates*
DeleteRecommenderConfiguration	Grants permission to delete an Amazon Pinpoint configuration for a recommender model	Write	recommenders*
DeleteSegment	Grants permission to delete a specific segment	Write	apps*
DeleteSegment	Grants permission to delete a specific segment	Write	segments*
DeleteSmsChannel	Grants permission to delete the SMS channel for an app	Write	apps*
DeleteSmsTemplate	Grants permission to delete an sms message template or an sms message template version	Write	templates*
DeleteUserEndpoints	Grants permission to delete all of the endpoints that are associated with a user ID	Write	apps*
DeleteVoiceChannel	Grants permission to delete the Voice channel for an app	Write	apps*
DeleteVoiceTemplate	Grants permission to delete a voice message template or a voice message template version	Write	templates*
GetAdmChannel	Grants permission to retrieve information about the Amazon Device Messaging (ADM) channel for an app	Read	apps*
GetApnsChannel	Grants permission to retrieve information about the APNs channel for an app	Read	apps*
GetApnsSandboxChannel	Grants permission to retrieve information about the APNs sandbox channel for an app	Read	apps*
GetApnsVoipChannel	Grants permission to retrieve information about the APNs VoIP channel for an app	Read	apps*
GetApnsVoipSandboxChannel	Grants permission to retrieve information about the APNs VoIP sandbox channel for an app	Read	apps*
GetApp	Grants permission to retrieve information about a specific app in your Amazon Pinpoint account	Read	apps*
GetApplicationDateRangeKpi	Grants permission to retrieve (queries) pre-aggregated data for a standard metric that applies to an application	Read	apps*
GetApplicationSettings	Grants permission to retrieve the default settings for an app	List	apps*
GetApps	Grants permission to retrieve a list of apps in your Amazon Pinpoint account	Read	apps*
GetBaiduChannel	Grants permission to retrieve information about the Baidu channel for an app	Read	apps*
GetCampaign	Grants permission to retrieve information about a specific campaign	Read	apps*
GetCampaign		Read	campaigns*
GetCampaignActivities	Grants permission to retrieve information about the activities performed by a campaign	List	apps*
GetCampaignActivities		List	campaigns*
GetCampaignDateRangeKpi	Grants permission to retrieve (queries) pre-aggregated data for a standard metric that applies to a campaign	Read	apps*
GetCampaignDateRangeKpi		Read	campaigns*
GetCampaignVersion	Grants permission to retrieve information about a specific campaign version	Read	apps*
GetCampaignVersion		Read	campaigns*
GetCampaignVersions	Grants permission to retrieve information about the current and prior versions of a campaign	List	apps*
GetCampaignVersions		List	campaigns*
GetCampaigns	Grants permission to retrieve information about all campaigns for an app	List	apps*
GetChannels	Grants permission to get all channels information for your app	List	apps*
GetEmailChannel	Grants permission to obtain information about the email channel in an app	Read	apps*
GetEmailTemplate	Grants permission to retrieve information about a specific or the active version of an email template	Read	templates*
GetEndpoint	Grants permission to retrieve information about a specific endpoint	Read	apps*
GetEventStream	Grants permission to retrieve information about the event stream for an app	Read	apps*
GetExportJob	Grants permission to obtain information about a specific export job	Read	apps*
GetExportJobs	Grants permission to retrieve a list of all of the export jobs for an app	List	apps*
GetGcmChannel	Grants permission to retrieve information about the GCM channel for an app	Read	apps*
GetImportJob	Grants permission to retrieve information about a specific import job	Read	apps*
GetImportJobs	Grants permission to retrieve information about all import jobs for an app	List	apps*
GetInAppMessages	Grants permission to retrive in-app messages for the given endpoint id	Read	apps*
GetInAppTemplate	Grants permission to retrieve information about a specific or the active version of an in-app message template	Read	templates*
GetJourney	Grants permission to retrieve information about a specific journey	Read	apps*
GetJourney		Read	journeys*
GetJourneyDateRangeKpi	Grants permission to retrieve (queries) pre-aggregated data for a standard engagement metric that applies to a journey	Read	apps*
GetJourneyDateRangeKpi		Read	journeys*
GetJourneyExecutionActivityMetrics	Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey activity	Read	apps*
GetJourneyExecutionActivityMetrics		Read	journeys*
GetJourneyExecutionMetrics	Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey	Read	apps*
GetJourneyExecutionMetrics		Read	journeys*
GetPushTemplate	Grants permission to retrieve information about a specific or the active version of an push notification template	Read	templates*
GetRecommenderConfiguration	Grants permission to retrieve information about an Amazon Pinpoint configuration for a recommender model	Read	recommenders*
GetRecommenderConfigurations	Grants permission to retrieve information about all the recommender model configurations that are associated with an Amazon Pinpoint account	List
GetReports	Grants permission to mobiletargeting:GetReports	Read
GetSegment	Grants permission to retrieve information about a specific segment	Read	apps*
GetSegment		Read	segments*
GetSegmentExportJobs	Grants permission to retrieve information about jobs that export endpoint definitions from segments to Amazon S3	List	apps*
GetSegmentExportJobs		List	segments*
GetSegmentImportJobs	Grants permission to retrieve information about jobs that create segments by importing endpoint definitions from	List	apps*
GetSegmentImportJobs		List	segments*
GetSegmentVersion	Grants permission to retrieve information about a specific segment version	Read	apps*
GetSegmentVersion		Read	segments*
GetSegmentVersions	Grants permission to retrieve information about the current and prior versions of a segment	List	apps*
GetSegmentVersions		List	segments*
GetSegments	Grants permission to retrieve information about the segments for an app	List	apps*
GetSmsChannel	Grants permission to obtain information about the SMS channel in an app	Read	apps*
GetSmsTemplate	Grants permission to retrieve information about a specific or the active version of an sms message template	Read	templates*
GetUserEndpoints	Grants permission to retrieve information about the endpoints that are associated with a user ID	Read	apps*
GetVoiceChannel	Grants permission to obtain information about the Voice channel in an app	Read	apps*
GetVoiceTemplate	Grants permission to retrieve information about a specific or the active version of a voice message template	Read	templates*
ListJourneys	Grants permission to retrieve information about all journeys for an app	List	apps*
ListTagsForResource	Grants permission to list tags for a resource	Read	apps
			campaigns
			segments
ListTemplateVersions	Grants permission to retrieve all versions about a specific template	List	templates*
ListTemplates	Grants permission to retrieve metadata about the queried templates	List	templates*
PhoneNumberValidate	Grants permission to obtain metadata for a phone number, such as the number type (mobile, landline, or VoIP), location, and provider	Read	phone-number-validate*
PutEventStream	Grants permission to create or update an event stream for an app	Write	apps*
PutEvents	Grants permission to create or update events for an app	Write	apps*
RemoveAttributes	Grants permission to remove the attributes for an app	Write	apps*
SendMessages	Grants permission to send an SMS message or push notification to specific endpoints	Write	apps*
SendOTPMessage	Grants permission to send an OTP code to a user of your application	Write	apps*
SendUsersMessages	Grants permission to send an SMS message or push notification to all endpoints that are associated with a specific user ID	Write	apps*
TagResource	Grants permission to add tags to a resource	Tagging	apps
			campaigns
			segments
				aws:RequestTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from a resource	Tagging	apps
			campaigns
			segments
				aws:RequestTag/${TagKey} aws:TagKeys
UpdateAdmChannel	Grants permission to update the Amazon Device Messaging (ADM) channel for an app	Write	apps*
UpdateApnsChannel	Grants permission to update the Apple Push Notification service (APNs) channel for an app	Write	apps*
UpdateApnsSandboxChannel	Grants permission to update the Apple Push Notification service (APNs) sandbox channel for an app	Write	apps*
UpdateApnsVoipChannel	Grants permission to update the Apple Push Notification service (APNs) VoIP channel for an app	Write	apps*
UpdateApnsVoipSandboxChannel	Grants permission to update the Apple Push Notification service (APNs) VoIP sandbox channel for an app	Write	apps*
UpdateApplicationSettings	Grants permission to update the default settings for an app	Write	apps*
UpdateBaiduChannel	Grants permission to update the Baidu channel for an app	Write	apps*
UpdateCampaign	Grants permission to update a specific campaign	Write	apps*
			campaigns*
				aws:RequestTag/${TagKey} aws:TagKeys
UpdateEmailChannel	Grants permission to update the email channel for an app	Write	apps*
UpdateEmailTemplate	Grants permission to update a specific email template under the same version or generate a new version	Write	templates*
UpdateEmailTemplate		Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateEndpoint	Grants permission to create an endpoint or update the information for an endpoint	Write	apps*
UpdateEndpointsBatch	Grants permission to create or update endpoints as a batch operation	Write	apps*
UpdateGcmChannel	Grants permission to update the Firebase Cloud Messaging (FCM) or Google Cloud Messaging (GCM) API key that allows to send push notifications to your Android app	Write	apps*
UpdateInAppTemplate	Grants permission to update a specific in-app message template under the same version or generate a new version	Write	templates*
UpdateInAppTemplate		Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateJourney	Grants permission to update a specific journey	Write	apps*
			journeys*
				aws:RequestTag/${TagKey} aws:TagKeys
UpdateJourneyState	Grants permission to update a specific journey state	Write	apps*
			journeys*
				aws:RequestTag/${TagKey} aws:TagKeys
UpdatePushTemplate	Grants permission to update a specific push notification template under the same version or generate a new version	Write	templates*
UpdatePushTemplate		Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateRecommenderConfiguration	Grants permission to update an Amazon Pinpoint configuration for a recommender model	Write	recommenders*
UpdateSegment	Grants permission to update a specific segment	Write	apps*
			segments*
				aws:RequestTag/${TagKey} aws:TagKeys
UpdateSmsChannel	Grants permission to update the SMS channel for an app	Write	apps*
UpdateSmsTemplate	Grants permission to update a specific sms message template under the same version or generate a new version	Write	templates*
UpdateSmsTemplate		Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateTemplateActiveVersion	Grants permission to update the active version parameter of a specific template	Write	templates*
UpdateVoiceChannel	Grants permission to update the Voice channel for an app	Write	apps*
UpdateVoiceTemplate	Grants permission to update a specific voice message template under the same version or generate a new version	Write	templates*
UpdateVoiceTemplate		Write		aws:RequestTag/${TagKey} aws:TagKeys
VerifyOTPMessage	Grants permission to check the validity of One-Time Passwords (OTPs)	Write	apps*

Resource types defined by Amazon Pinpoint

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
apps	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}`	aws:ResourceTag/${TagKey}
campaigns	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/campaigns/${CampaignId}`	aws:ResourceTag/${TagKey}
journeys	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/journeys/${JourneyId}`	aws:ResourceTag/${TagKey}
segments	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/segments/${SegmentId}`	aws:ResourceTag/${TagKey}
templates	`arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/${ChannelType}`	aws:ResourceTag/${TagKey}
recommenders	`arn:${Partition}:mobiletargeting:${Region}:${Account}:recommenders/${RecommenderId}`
phone-number-validate	`arn:${Partition}:mobiletargeting:${Region}:${Account}:phone/number/validate`

Condition keys for Amazon Pinpoint

Amazon Pinpoint defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a key that is present in the request the user makes to the pinpoint service	String
aws:ResourceTag/${TagKey}	Filters access by a tag key and value pair	String
aws:TagKeys	Filters access by the list of all the tag key names present in the request the user makes to the pinpoint service	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Personalize

Amazon Pinpoint Email Service