Actions, resources, and condition keys for Amazon WorkSpaces

Amazon WorkSpaces (service prefix: workspaces) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

• Learn how to configure this service.

• View a list of the API operations available for this service.

• Learn how to secure this service and its resources by using IAM permission policies.

Actions defined by Amazon WorkSpaces

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys	Dependent actions
AssociateConnectionAlias	Grants permission to associate connection aliases with directories	Write	connectionalias*
			directoryid*
AssociateIpGroups	Grants permission to associate IP access control groups with directories	Write	directoryid*
			workspaceipgroup*
AuthorizeIpRules	Grants permission to add rules to IP access control groups	Write	workspaceipgroup*
CopyWorkspaceImage	Grants permission to copy a WorkSpace image	Write	workspaceimage*		workspaces:DescribeWorkspaceImages
				aws:RequestTag/${TagKey} aws:TagKeys
CreateConnectClientAddIn	Grants permission to create an Amazon Connect client add-in within a directory	Write	directoryid*
CreateConnectionAlias	Grants permission to create connection aliases for use with cross-Region redirection	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateIpGroup	Grants permission to create IP access control groups	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateStandbyWorkspaces	Grants permission to create one or more Standby WorkSpaces	Write	directoryid*
			workspaceid*
				aws:RequestTag/${TagKey} aws:TagKeys
CreateTags	Grants permission to create tags for WorkSpaces resources	Tagging		aws:RequestTag/${TagKey} aws:TagKeys
CreateUpdatedWorkspaceImage	Grants permission to create an updated WorkSpace image	Write	workspaceimage*
				aws:RequestTag/${TagKey} aws:TagKeys
CreateWorkspaceBundle	Grants permission to create a WorkSpace bundle	Write	workspacebundle*		workspaces:CreateTags
			workspaceimage*
				aws:RequestTag/${TagKey} aws:TagKeys
CreateWorkspaceImage	Grants permission to create a new WorkSpace image	Write	workspaceid*
				aws:RequestTag/${TagKey} aws:TagKeys
CreateWorkspaces	Grants permission to create one or more WorkSpaces	Write	directoryid*
			workspacebundle*
			workspaceid*
				aws:RequestTag/${TagKey} aws:TagKeys
DeleteClientBranding	Grants permission to delete AWS WorkSpaces Client branding data within a directory	Write	directoryid*
DeleteConnectClientAddIn	Grants permission to delete an Amazon Connect client add-in that is configured within a directory	Write	directoryid*
DeleteConnectionAlias	Grants permission to delete connection aliases	Write	connectionalias*
DeleteIpGroup	Grants permission to delete IP access control groups	Write	workspaceipgroup*
DeleteTags	Grants permission to delete tags from WorkSpaces resources	Tagging		aws:RequestTag/${TagKey} aws:TagKeys
DeleteWorkspaceBundle	Grants permission to delete WorkSpace bundles	Write	workspacebundle*
DeleteWorkspaceImage	Grants permission to delete WorkSpace images	Write	workspaceimage*
DeregisterWorkspaceDirectory	Grants permission to deregister directories from use with Amazon WorkSpaces	Write	directoryid*
DescribeAccount	Grants permission to retrieve the configuration of Bring Your Own License (BYOL) for WorkSpaces accounts	Read
DescribeAccountModifications	Grants permission to retrieve modifications to the configuration of Bring Your Own License (BYOL) for WorkSpaces accounts	Read
DescribeClientBranding	Grants permission to retrieve AWS WorkSpaces Client branding data within a directory	Read	directoryid*
DescribeClientProperties	Grants permission to retrieve information about WorkSpaces clients	List	directoryid*
DescribeConnectClientAddIns	Grants permission to retrieve a list of Amazon Connect client add-ins that have been created	List	directoryid*
DescribeConnectionAliasPermissions	Grants permission to retrieve the permissions that the owners of connection aliases have granted to other AWS accounts for connection aliases	Read	connectionalias*
DescribeConnectionAliases	Grants permission to retrieve a list that describes the connection aliases used for cross-Region redirection	Read
DescribeIpGroups	Grants permission to retrieve information about IP access control groups	Read	workspaceipgroup*
DescribeTags	Grants permission to describe the tags for WorkSpaces resources	Read
DescribeWorkspaceBundles	Grants permission to obtain information about WorkSpace bundles	List
DescribeWorkspaceDirectories	Grants permission to retrieve information about directories that are registered with WorkSpaces	Read
DescribeWorkspaceImagePermissions	Grants permission to retrieve information about WorkSpace image permissions	Read	workspaceimage*
DescribeWorkspaceImages	Grants permission to retrieve information about WorkSpace images	List
DescribeWorkspaceSnapshots	Grants permission to retrieve information about WorkSpace snapshots	List	workspaceid*
DescribeWorkspaces	Grants permission to obtain information about WorkSpaces	List
DescribeWorkspacesConnectionStatus	Grants permission to obtain the connection status of WorkSpaces	Read
DisassociateConnectionAlias	Grants permission to disassociate connection aliases from directories	Write	connectionalias*
DisassociateIpGroups	Grants permission to disassociate IP access control groups from directories	Write	directoryid*
			workspaceipgroup*
ImportClientBranding	Grants permission to import AWS WorkSpaces Client branding data within a directory	Write	directoryid*
ImportWorkspaceImage	Grants permission to import Bring Your Own License (BYOL) images into Amazon WorkSpaces	Write			ec2:DescribeImages ec2:ModifyImageAttribute
ListAvailableManagementCidrRanges	Grants permission to list the available CIDR ranges for enabling Bring Your Own License (BYOL) for WorkSpaces accounts	List
MigrateWorkspace	Grants permission to migrate WorkSpaces	Write	workspacebundle*
			workspaceid*
ModifyAccount	Grants permission to modify the configuration of Bring Your Own License (BYOL) for WorkSpaces accounts	Write
ModifyCertificateBasedAuthProperties	Grants permission to modify the certificate-based authorization properties of a directory	Write	directoryid*
ModifyClientProperties	Grants permission to modify the properties of WorkSpaces clients	Write	directoryid*
ModifySamlProperties	Grants permission to modify the SAML properties of a directory	Write	directoryid*
ModifySelfservicePermissions	Grants permission to modify the self-service WorkSpace management capabilities for your users	Permissions management	directoryid*
ModifyWorkspaceAccessProperties	Grants permission to specify which devices and operating systems users can use to access their WorkSpaces	Write	directoryid*
ModifyWorkspaceCreationProperties	Grants permission to modify the default properties used to create WorkSpaces	Write	directoryid*
ModifyWorkspaceProperties	Grants permission to modify WorkSpace properties, including the running mode and the AutoStop period	Write	workspaceid*
ModifyWorkspaceState	Grants permission to modify the state of WorkSpaces	Write	workspaceid*
RebootWorkspaces	Grants permission to reboot WorkSpaces	Write	workspaceid*
RebuildWorkspaces	Grants permission to rebuild WorkSpaces	Write	workspaceid*
RegisterWorkspaceDirectory	Grants permission to register directories for use with Amazon WorkSpaces	Write	directoryid*
				aws:RequestTag/${TagKey} aws:TagKeys
RestoreWorkspace	Grants permission to restore WorkSpaces	Write	workspaceid*
RevokeIpRules	Grants permission to remove rules from IP access control groups	Write	workspaceipgroup*
StartWorkspaces	Grants permission to start AutoStop WorkSpaces	Write	workspaceid*
StopWorkspaces	Grants permission to stop AutoStop WorkSpaces	Write	workspaceid*
Stream	Grants permission to federated users to sign in by using their existing credentials and stream their workspace	Write	directoryid*
				workspaces:userId
TerminateWorkspaces	Grants permission to terminate WorkSpaces	Write	workspaceid*
UpdateConnectClientAddIn	Grants permission to update an Amazon Connect client add-in. Use this action to update the name and endpoint URL of an Amazon Connect client add-in	Write	directoryid*
UpdateConnectionAliasPermission	Grants permission to share or unshare connection aliases with other accounts	Permissions management	connectionalias*
UpdateRulesOfIpGroup	Grants permission to replace rules for IP access control groups	Write	workspaceipgroup*
UpdateWorkspaceBundle	Grants permission to update the WorkSpace images used in WorkSpace bundles	Write	workspacebundle*
			workspaceimage*
UpdateWorkspaceImagePermission	Grants permission to share or unshare WorkSpace images with other accounts by specifying whether other accounts have permission to copy the image	Permissions management	workspaceimage*

Resource types defined by Amazon WorkSpaces

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
directoryid	arn:${Partition}:workspaces:${Region}:${Account}:directory/${DirectoryId}	aws:ResourceTag/${TagKey}
workspacebundle	arn:${Partition}:workspaces:${Region}:${Account}:workspacebundle/${BundleId}	aws:ResourceTag/${TagKey}
workspaceid	arn:${Partition}:workspaces:${Region}:${Account}:workspace/${WorkspaceId}	aws:ResourceTag/${TagKey}
workspaceimage	arn:${Partition}:workspaces:${Region}:${Account}:workspaceimage/${ImageId}	aws:ResourceTag/${TagKey}
workspaceipgroup	arn:${Partition}:workspaces:${Region}:${Account}:workspaceipgroup/${GroupId}	aws:ResourceTag/${TagKey}
connectionalias	arn:${Partition}:workspaces:${Region}:${Account}:connectionalias/${ConnectionAliasId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon WorkSpaces

Amazon WorkSpaces defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access based on the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access based on the tags associated with the resource	String
aws:TagKeys	Filters access based on the tag keys that are passed in the request	ArrayOfString
workspaces:userId	Filters access by the ID of the Workspaces user	String