Actions, resources, and condition keys for Amazon Pinpoint

Amazon Pinpoint (service prefix: mobiletargeting) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Topics

Actions defined by Amazon Pinpoint
Resource types defined by Amazon Pinpoint
Condition keys for Amazon Pinpoint

Actions defined by Amazon Pinpoint

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see The actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys
CreateApp	Create an app.	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateCampaign	Create a campaign for an app.	Write	apps*
CreateCampaign	Create a campaign for an app.	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateEmailTemplate	Create an email template.	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateExportJob	Create an export job that exports endpoint definitions to Amazon S3.	Write	apps*
CreateImportJob	Import endpoint definitions from to create a segment.	Write	apps*
CreateJourney	Create a Journey for an app.	Write	apps*
CreateJourney	Create a Journey for an app.	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreatePushTemplate	Create a push notification template.	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateRecommenderConfiguration	Create an Amazon Pinpoint configuration for a recommender model.	Write
CreateSegment	Create a segment that is based on endpoint data reported to Pinpoint by your app. To allow a user to create a segment by importing endpoint data from outside of Pinpoint, allow the mobiletargeting:CreateImportJob action.	Write	apps*
CreateSegment		Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateSmsTemplate	Create an sms message template.	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
CreateVoiceTemplate	Create a voice message template.	Write		aws:RequestTag/${TagKey} aws:TagKeys aws:ResourceTag/${TagKey}
DeleteAdmChannel	Delete the ADM channel for an app.	Write	apps*
DeleteApnsChannel	Delete the APNs channel for an app.	Write	apps*
DeleteApnsSandboxChannel	Delete the APNs sandbox channel for an app.	Write	apps*
DeleteApnsVoipChannel	Delete the APNs VoIP channel for an app.	Write	apps*
DeleteApnsVoipSandboxChannel	Delete the APNs VoIP sandbox channel for an app.	Write	apps*
DeleteApp	Delete a specific campaign.	Write	apps*
DeleteBaiduChannel	Delete the Baidu channel for an app.	Write	apps*
DeleteCampaign	Delete a specific campaign.	Write	apps*
DeleteCampaign	Delete a specific campaign.	Write	campaigns*
DeleteEmailChannel	Delete the email channel for an app.	Write	apps*
DeleteEmailTemplate	Delete an email template or an email template version.	Write	templates*
DeleteEndpoint	Delete an endpoint.	Write	apps*
DeleteEventStream	Delete the event stream for an app.	Write	apps*
DeleteGcmChannel	Delete the GCM channel for an app.	Write	apps*
DeleteJourney	Delete a specific journey.	Write	apps*
DeleteJourney	Delete a specific journey.	Write	journeys*
DeletePushTemplate	Delete a push notification template or a push notification template version.	Write	templates*
DeleteRecommenderConfiguration	Delete an Amazon Pinpoint configuration for a recommender model.	Write	recommenders*
DeleteSegment	Delete a specific segment.	Write	apps*
DeleteSegment	Delete a specific segment.	Write	segments*
DeleteSmsChannel	Delete the SMS channel for an app.	Write	apps*
DeleteSmsTemplate	Delete an sms message template or an sms message template version.	Write	templates*
DeleteUserEndpoints	Delete all of the endpoints that are associated with a user ID.	Write	apps*
DeleteVoiceChannel	Delete the Voice channel for an app.	Write	apps*
DeleteVoiceTemplate	Delete a voice message template or a voice message template version.	Write	templates*
GetAdmChannel	Retrieve information about the Amazon Device Messaging (ADM) channel for an app.	Read	apps*
GetApnsChannel	Retrieve information about the APNs channel for an app.	Read	apps*
GetApnsSandboxChannel	Retrieve information about the APNs sandbox channel for an app.	Read	apps*
GetApnsVoipChannel	Retrieve information about the APNs VoIP channel for an app.	Read	apps*
GetApnsVoipSandboxChannel	Retrieve information about the APNs VoIP sandbox channel for an app.	Read	apps*
GetApp	Retrieve information about a specific app in your Amazon Pinpoint account.	Read	apps*
GetApplicationSettings	Retrieve the default settings for an app.	List	apps*
GetApps	Retrieve a list of apps in your Amazon Pinpoint account.	List	apps*
GetBaiduChannel	Retrieve information about the Baidu channel for an app.	Read	apps*
GetCampaign	Retrieve information about a specific campaign.	Read	apps*
GetCampaign	Retrieve information about a specific campaign.	Read	campaigns*
GetCampaignActivities	Retrieve information about the activities performed by a campaign.	List	apps*
GetCampaignActivities		List	campaigns*
GetCampaignVersion	Retrieve information about a specific campaign version.	Read	apps*
GetCampaignVersion	Retrieve information about a specific campaign version.	Read	campaigns*
GetCampaignVersions	Retrieve information about the current and prior versions of a campaign.	List	apps*
GetCampaignVersions		List	campaigns*
GetCampaigns	Retrieve information about all campaigns for an app.	List	apps*
GetChannels	Get all channels information for your app.	List	apps*
GetEmailChannel	Obtain information about the email channel in an app.	Read	apps*
GetEmailTemplate	Retrieve information about a specific or the active version of an email template.	Read	templates*
GetEndpoint	Retrieve information about a specific endpoint.	Read	apps*
GetEventStream	Retrieve information about the event stream for an app.	Read	apps*
GetExportJob	Obtain information about a specific export job.	Read	apps*
GetExportJobs	Retrieve a list of all of the export jobs for an app.	List	apps*
GetGcmChannel	Retrieve information about the GCM channel for an app.	Read	apps*
GetImportJob	Retrieve information about a specific import job.	Read	apps*
GetImportJobs	Retrieve information about all import jobs for an app.	List	apps*
GetJourney	Retrieve information about a specific journey.	Read	apps*
GetJourney	Retrieve information about a specific journey.	Read	journeys*
GetPushTemplate	Retrieve information about a specific or the active version of an push notification template.	Read	templates*
GetRecommenderConfiguration	Retrieve information about an Amazon Pinpoint configuration for a recommender model.	Read	recommenders*
GetRecommenderConfigurations	Retrieve information about all the recommender model configurations that are associated with an Amazon Pinpoint account.	List
GetSegment	Retrieve information about a specific segment.	Read	apps*
GetSegment	Retrieve information about a specific segment.	Read	segments*
GetSegmentExportJobs	Retrieve information about jobs that export endpoint definitions from segments to Amazon S3.	List	apps*
GetSegmentExportJobs		List	segments*
GetSegmentImportJobs	Retrieve information about jobs that create segments by importing endpoint definitions from .	List	apps*
GetSegmentImportJobs		List	segments*
GetSegmentVersion	Retrieve information about a specific segment version.	Read	apps*
GetSegmentVersion	Retrieve information about a specific segment version.	Read	segments*
GetSegmentVersions	Retrieve information about the current and prior versions of a segment.	List	apps*
GetSegmentVersions		List	segments*
GetSegments	Retrieve information about the segments for an app.	List	apps*
GetSmsChannel	Obtain information about the SMS channel in an app.	Read	apps*
GetSmsTemplate	Retrieve information about a specific or the active version of an sms message template.	Read	templates*
GetUserEndpoints	Retrieve information about the endpoints that are associated with a user ID.	Read	apps*
GetVoiceChannel	Obtain information about the Voice channel in an app.	Read	apps*
GetVoiceTemplate	Retrieve information about a specific or the active version of a voice message template.	Read	templates*
ListJourneys	Retrieve information about all journeys for an app.	List	apps*
ListTagsForResource	List tags for a resource.	List	apps
			campaigns
			segments
ListTemplateVersions	Retrieve all versions about a specific template.	List	templates*
ListTemplates	Retrieve metadata about the queried templates.	List	templates*
PhoneNumberValidate	Obtain metadata for a phone number, such as the number type (mobile, landline, or VoIP), location, and provider.	Read	apps*
PutEventStream	Create or update an event stream for an app.	Write	apps*
PutEvents	Create or update events for an app.	Write	apps*
RemoveAttributes	Used to remove the attributes for an app.	Write	apps*
SendMessages	Send an SMS message or push notification to specific endpoints.	Write	apps*
SendUsersMessages	Send an SMS message or push notification to all endpoints that are associated with a specific user ID.	Write	apps*
TagResource	Adds tags to a resource.	Tagging	apps
			campaigns
			segments
				aws:RequestTag/${TagKey} aws:TagKeys
UntagResource	Removes tags from a resource.	Tagging	apps
			campaigns
			segments
				aws:RequestTag/${TagKey} aws:TagKeys
UpdateAdmChannel	Update the Amazon Device Messaging (ADM) channel for an app.	Write	apps*
UpdateApnsChannel	Update the Apple Push Notification service (APNs) channel for an app.	Write	apps*
UpdateApnsSandboxChannel	Update the Apple Push Notification service (APNs) sandbox channel for an app.	Write	apps*
UpdateApnsVoipChannel	Update the Apple Push Notification service (APNs) VoIP channel for an app.	Write	apps*
UpdateApnsVoipSandboxChannel	Update the Apple Push Notification service (APNs) VoIP sandbox channel for an app.	Write	apps*
UpdateApplicationSettings	Update the default settings for an app.	Write	apps*
UpdateBaiduChannel	Update the Baidu channel for an app.	Write	apps*
UpdateCampaign	Update a specific campaign.	Write	apps*
			campaigns*
				aws:RequestTag/${TagKey} aws:TagKeys
UpdateEmailChannel	Update the email channel for an app.	Write	apps*
UpdateEmailTemplate	Update a specific email template under the same version or generate a new version.	Write	templates*
UpdateEmailTemplate		Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateEndpoint	Create an endpoint or update the information for an endpoint.	Write	apps*
UpdateEndpointsBatch	Create or update endpoints as a batch operation.	Write	apps*
UpdateGcmChannel	Update the Firebase Cloud Messaging (FCM) or Google Cloud Messaging (GCM) API key that allows to send push notifications to your Android app.	Write	apps*
UpdateJourney	Update a specific journey.	Write	apps*
			journeys*
				aws:RequestTag/${TagKey} aws:TagKeys
UpdateJourneyState	Update a specific journey state.	Write	apps*
			journeys*
				aws:RequestTag/${TagKey} aws:TagKeys
UpdatePushTemplate	Update a specific push notification template under the same version or generate a new version.	Write	templates*
UpdatePushTemplate		Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateRecommenderConfiguration	Update an Amazon Pinpoint configuration for a recommender model.	Write	recommenders*
UpdateSegment	Update a specific segment.	Write	apps*
			segments*
				aws:RequestTag/${TagKey} aws:TagKeys
UpdateSmsChannel	Update the SMS channel for an app.	Write	apps*
UpdateSmsTemplate	Update a specific sms message template under the same version or generate a new version.	Write	templates*
UpdateSmsTemplate		Write		aws:RequestTag/${TagKey} aws:TagKeys
UpdateTemplateActiveVersion	Upate the active version parameter of a specific template.	Write	templates*
UpdateVoiceChannel	Update the Voice channel for an app.	Write	apps*
UpdateVoiceTemplate	Update a specific voice message template under the same version or generate a new version.	Write	templates*
UpdateVoiceTemplate		Write		aws:RequestTag/${TagKey} aws:TagKeys

Resource types defined by Amazon Pinpoint

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see The resource types table.

Resource types	ARN	Condition keys
apps	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}`	aws:ResourceTag/${TagKey}
campaigns	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/campaigns/${CampaignId}`	aws:ResourceTag/${TagKey}
journeys	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/journeys/${JourneyId}`	aws:ResourceTag/${TagKey}
segments	`arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/segments/${SegmentId}`	aws:ResourceTag/${TagKey}
templates	`arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/${ChannelType}`	aws:ResourceTag/${TagKey}
recommenders	`arn:${Partition}:mobiletargeting:${Region}:${Account}:recommenders/${RecommenderId}`

Condition keys for Amazon Pinpoint

Amazon Pinpoint defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see The condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a key that is present in the request the user makes to the pinpoint service.	String
aws:ResourceTag/${TagKey}	Filters access by a tag key and value pair.	String
aws:TagKeys	Filters access by the list of all the tag key names present in the request the user makes to the pinpoint service.	String

Warning Javascript is disabled or is unavailable in your browser.

To use the AWS Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Personalize

Amazon Pinpoint Email Service