Actions, resources, and condition keys for Amazon Pinpoint - Service Authorization Reference

Actions, resources, and condition keys for Amazon Pinpoint

Amazon Pinpoint (service prefix: mobiletargeting) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Actions defined by Amazon Pinpoint

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see Actions table.

Actions Description Access level Resource types (*required) Condition keys Dependent actions
CreateApp Grants permission to create an app Write

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreateCampaign Grants permission to create a campaign for an app Write

apps*

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreateEmailTemplate Grants permission to create an email template Write

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreateExportJob Grants permission to create an export job that exports endpoint definitions to Amazon S3 Write

apps*

CreateImportJob Grants permission to import endpoint definitions from to create a segment Write

apps*

CreateInAppTemplate Grants permission to create an in-app message template Write

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreateJourney Grants permission to create a Journey for an app Write

apps*

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreatePushTemplate Grants permission to create a push notification template Write

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreateRecommenderConfiguration Grants permission to create an Amazon Pinpoint configuration for a recommender model Write
CreateSegment Grants permission to create a segment that is based on endpoint data reported to Pinpoint by your app. To allow a user to create a segment by importing endpoint data from outside of Pinpoint, allow the mobiletargeting:CreateImportJob action Write

apps*

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreateSmsTemplate Grants permission to create an sms message template Write

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

CreateVoiceTemplate Grants permission to create a voice message template Write

aws:RequestTag/${TagKey}

aws:TagKeys

aws:ResourceTag/${TagKey}

DeleteAdmChannel Grants permission to delete the ADM channel for an app Write

apps*

DeleteApnsChannel Grants permission to delete the APNs channel for an app Write

apps*

DeleteApnsSandboxChannel Grants permission to delete the APNs sandbox channel for an app Write

apps*

DeleteApnsVoipChannel Grants permission to delete the APNs VoIP channel for an app Write

apps*

DeleteApnsVoipSandboxChannel Grants permission to delete the APNs VoIP sandbox channel for an app Write

apps*

DeleteApp Grants permission to delete a specific campaign Write

apps*

DeleteBaiduChannel Grants permission to delete the Baidu channel for an app Write

apps*

DeleteCampaign Grants permission to delete a specific campaign Write

apps*

campaigns*

DeleteEmailChannel Grants permission to delete the email channel for an app Write

apps*

DeleteEmailTemplate Grants permission to delete an email template or an email template version Write

templates*

DeleteEndpoint Grants permission to delete an endpoint Write

apps*

DeleteEventStream Grants permission to delete the event stream for an app Write

apps*

DeleteGcmChannel Grants permission to delete the GCM channel for an app Write

apps*

DeleteInAppTemplate Grants permission to delete an in-app message template or an in-app message template version Write

templates*

DeleteJourney Grants permission to delete a specific journey Write

apps*

journeys*

DeletePushTemplate Grants permission to delete a push notification template or a push notification template version Write

templates*

DeleteRecommenderConfiguration Grants permission to delete an Amazon Pinpoint configuration for a recommender model Write

recommenders*

DeleteSegment Grants permission to delete a specific segment Write

apps*

segments*

DeleteSmsChannel Grants permission to delete the SMS channel for an app Write

apps*

DeleteSmsTemplate Grants permission to delete an sms message template or an sms message template version Write

templates*

DeleteUserEndpoints Grants permission to delete all of the endpoints that are associated with a user ID Write

apps*

DeleteVoiceChannel Grants permission to delete the Voice channel for an app Write

apps*

DeleteVoiceTemplate Grants permission to delete a voice message template or a voice message template version Write

templates*

GetAdmChannel Grants permission to retrieve information about the Amazon Device Messaging (ADM) channel for an app Read

apps*

GetApnsChannel Grants permission to retrieve information about the APNs channel for an app Read

apps*

GetApnsSandboxChannel Grants permission to retrieve information about the APNs sandbox channel for an app Read

apps*

GetApnsVoipChannel Grants permission to retrieve information about the APNs VoIP channel for an app Read

apps*

GetApnsVoipSandboxChannel Grants permission to retrieve information about the APNs VoIP sandbox channel for an app Read

apps*

GetApp Grants permission to retrieve information about a specific app in your Amazon Pinpoint account Read

apps*

GetApplicationDateRangeKpi Grants permission to retrieve (queries) pre-aggregated data for a standard metric that applies to an application Read

apps*

GetApplicationSettings Grants permission to retrieve the default settings for an app List

apps*

GetApps Grants permission to retrieve a list of apps in your Amazon Pinpoint account Read

apps*

GetBaiduChannel Grants permission to retrieve information about the Baidu channel for an app Read

apps*

GetCampaign Grants permission to retrieve information about a specific campaign Read

apps*

campaigns*

GetCampaignActivities Grants permission to retrieve information about the activities performed by a campaign List

apps*

campaigns*

GetCampaignDateRangeKpi Grants permission to retrieve (queries) pre-aggregated data for a standard metric that applies to a campaign Read

apps*

campaigns*

GetCampaignVersion Grants permission to retrieve information about a specific campaign version Read

apps*

campaigns*

GetCampaignVersions Grants permission to retrieve information about the current and prior versions of a campaign List

apps*

campaigns*

GetCampaigns Grants permission to retrieve information about all campaigns for an app List

apps*

GetChannels Grants permission to get all channels information for your app List

apps*

GetEmailChannel Grants permission to obtain information about the email channel in an app Read

apps*

GetEmailTemplate Grants permission to retrieve information about a specific or the active version of an email template Read

templates*

GetEndpoint Grants permission to retrieve information about a specific endpoint Read

apps*

GetEventStream Grants permission to retrieve information about the event stream for an app Read

apps*

GetExportJob Grants permission to obtain information about a specific export job Read

apps*

GetExportJobs Grants permission to retrieve a list of all of the export jobs for an app List

apps*

GetGcmChannel Grants permission to retrieve information about the GCM channel for an app Read

apps*

GetImportJob Grants permission to retrieve information about a specific import job Read

apps*

GetImportJobs Grants permission to retrieve information about all import jobs for an app List

apps*

GetInAppMessages Grants permission to retrive in-app messages for the given endpoint id Read

apps*

GetInAppTemplate Grants permission to retrieve information about a specific or the active version of an in-app message template Read

templates*

GetJourney Grants permission to retrieve information about a specific journey Read

apps*

journeys*

GetJourneyDateRangeKpi Grants permission to retrieve (queries) pre-aggregated data for a standard engagement metric that applies to a journey Read

apps*

journeys*

GetJourneyExecutionActivityMetrics Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey activity Read

apps*

journeys*

GetJourneyExecutionMetrics Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey Read

apps*

journeys*

GetPushTemplate Grants permission to retrieve information about a specific or the active version of an push notification template Read

templates*

GetRecommenderConfiguration Grants permission to retrieve information about an Amazon Pinpoint configuration for a recommender model Read

recommenders*

GetRecommenderConfigurations Grants permission to retrieve information about all the recommender model configurations that are associated with an Amazon Pinpoint account List
GetReports Grants permission to mobiletargeting:GetReports Read
GetSegment Grants permission to retrieve information about a specific segment Read

apps*

segments*

GetSegmentExportJobs Grants permission to retrieve information about jobs that export endpoint definitions from segments to Amazon S3 List

apps*

segments*

GetSegmentImportJobs Grants permission to retrieve information about jobs that create segments by importing endpoint definitions from List

apps*

segments*

GetSegmentVersion Grants permission to retrieve information about a specific segment version Read

apps*

segments*

GetSegmentVersions Grants permission to retrieve information about the current and prior versions of a segment List

apps*

segments*

GetSegments Grants permission to retrieve information about the segments for an app List

apps*

GetSmsChannel Grants permission to obtain information about the SMS channel in an app Read

apps*

GetSmsTemplate Grants permission to retrieve information about a specific or the active version of an sms message template Read

templates*

GetUserEndpoints Grants permission to retrieve information about the endpoints that are associated with a user ID Read

apps*

GetVoiceChannel Grants permission to obtain information about the Voice channel in an app Read

apps*

GetVoiceTemplate Grants permission to retrieve information about a specific or the active version of a voice message template Read

templates*

ListJourneys Grants permission to retrieve information about all journeys for an app List

apps*

ListTagsForResource Grants permission to list tags for a resource Read

apps

campaigns

segments

ListTemplateVersions Grants permission to retrieve all versions about a specific template List

templates*

ListTemplates Grants permission to retrieve metadata about the queried templates List

templates*

PhoneNumberValidate Grants permission to obtain metadata for a phone number, such as the number type (mobile, landline, or VoIP), location, and provider Read

phone-number-validate*

PutEventStream Grants permission to create or update an event stream for an app Write

apps*

PutEvents Grants permission to create or update events for an app Write

apps*

RemoveAttributes Grants permission to remove the attributes for an app Write

apps*

SendMessages Grants permission to send an SMS message or push notification to specific endpoints Write

apps*

SendOTPMessage Grants permission to send an OTP code to a user of your application Write

apps*

SendUsersMessages Grants permission to send an SMS message or push notification to all endpoints that are associated with a specific user ID Write

apps*

TagResource Grants permission to add tags to a resource Tagging

apps

campaigns

segments

aws:RequestTag/${TagKey}

aws:TagKeys

UntagResource Grants permission to remove tags from a resource Tagging

apps

campaigns

segments

aws:RequestTag/${TagKey}

aws:TagKeys

UpdateAdmChannel Grants permission to update the Amazon Device Messaging (ADM) channel for an app Write

apps*

UpdateApnsChannel Grants permission to update the Apple Push Notification service (APNs) channel for an app Write

apps*

UpdateApnsSandboxChannel Grants permission to update the Apple Push Notification service (APNs) sandbox channel for an app Write

apps*

UpdateApnsVoipChannel Grants permission to update the Apple Push Notification service (APNs) VoIP channel for an app Write

apps*

UpdateApnsVoipSandboxChannel Grants permission to update the Apple Push Notification service (APNs) VoIP sandbox channel for an app Write

apps*

UpdateApplicationSettings Grants permission to update the default settings for an app Write

apps*

UpdateBaiduChannel Grants permission to update the Baidu channel for an app Write

apps*

UpdateCampaign Grants permission to update a specific campaign Write

apps*

campaigns*

aws:RequestTag/${TagKey}

aws:TagKeys

UpdateEmailChannel Grants permission to update the email channel for an app Write

apps*

UpdateEmailTemplate Grants permission to update a specific email template under the same version or generate a new version Write

templates*

aws:RequestTag/${TagKey}

aws:TagKeys

UpdateEndpoint Grants permission to create an endpoint or update the information for an endpoint Write

apps*

UpdateEndpointsBatch Grants permission to create or update endpoints as a batch operation Write

apps*

UpdateGcmChannel Grants permission to update the Firebase Cloud Messaging (FCM) or Google Cloud Messaging (GCM) API key that allows to send push notifications to your Android app Write

apps*

UpdateInAppTemplate Grants permission to update a specific in-app message template under the same version or generate a new version Write

templates*

aws:RequestTag/${TagKey}

aws:TagKeys

UpdateJourney Grants permission to update a specific journey Write

apps*

journeys*

aws:RequestTag/${TagKey}

aws:TagKeys

UpdateJourneyState Grants permission to update a specific journey state Write

apps*

journeys*

aws:RequestTag/${TagKey}

aws:TagKeys

UpdatePushTemplate Grants permission to update a specific push notification template under the same version or generate a new version Write

templates*

aws:RequestTag/${TagKey}

aws:TagKeys

UpdateRecommenderConfiguration Grants permission to update an Amazon Pinpoint configuration for a recommender model Write

recommenders*

UpdateSegment Grants permission to update a specific segment Write

apps*

segments*

aws:RequestTag/${TagKey}

aws:TagKeys

UpdateSmsChannel Grants permission to update the SMS channel for an app Write

apps*

UpdateSmsTemplate Grants permission to update a specific sms message template under the same version or generate a new version Write

templates*

aws:RequestTag/${TagKey}

aws:TagKeys

UpdateTemplateActiveVersion Grants permission to update the active version parameter of a specific template Write

templates*

UpdateVoiceChannel Grants permission to update the Voice channel for an app Write

apps*

UpdateVoiceTemplate Grants permission to update a specific voice message template under the same version or generate a new version Write

templates*

aws:RequestTag/${TagKey}

aws:TagKeys

VerifyOTPMessage Grants permission to check the validity of One-Time Passwords (OTPs) Write

apps*

Resource types defined by Amazon Pinpoint

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see Resource types table.

Resource types ARN Condition keys
apps arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}

aws:ResourceTag/${TagKey}

campaigns arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/campaigns/${CampaignId}

aws:ResourceTag/${TagKey}

journeys arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/journeys/${JourneyId}

aws:ResourceTag/${TagKey}

segments arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/segments/${SegmentId}

aws:ResourceTag/${TagKey}

templates arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/${ChannelType}

aws:ResourceTag/${TagKey}

recommenders arn:${Partition}:mobiletargeting:${Region}:${Account}:recommenders/${RecommenderId}
phone-number-validate arn:${Partition}:mobiletargeting:${Region}:${Account}:phone/number/validate

Condition keys for Amazon Pinpoint

Amazon Pinpoint defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys Description Type
aws:RequestTag/${TagKey} Filters access by a key that is present in the request the user makes to the pinpoint service String
aws:ResourceTag/${TagKey} Filters access by a tag key and value pair String
aws:TagKeys Filters access by the list of all the tag key names present in the request the user makes to the pinpoint service ArrayOfString