Actions, resources, and condition keys for AWS Assurance

AWS Assurance (service prefix: assurance) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

• Learn how to configure this service.

• View a list of the API operations available for this service.

• Learn how to secure this service and its resources by using IAM permission policies.

• View the programmatic service authorization reference for this service.

Actions defined by AWS Assurance

You can specify the following actions in the Action element of an IAM policy statement. For each action, the table lists the resource types and condition keys supported by that action. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptInvitation	Grants permission to accept an invitation to connect an account to an environment	environment*	aws:ResourceTag/${TagKey}	Write
AssignPermissionSet	Grants permission to assign a permission set to a principal	environment*	aws:ResourceTag/${TagKey}	Write
BatchGetComment	Grants permission to retrieve multiple comments in a single request	environment*	aws:ResourceTag/${TagKey}	Read
BatchGetControl	Grants permission to retrieve multiple controls in a single request	environment*	aws:ResourceTag/${TagKey}	Read
BatchGetTask	Grants permission to retrieve multiple tasks in a single request	environment*	aws:ResourceTag/${TagKey}	Read
Chat	Grants permission to start a streaming chat session with the AWS Assurance agent	environment*	aws:ResourceTag/${TagKey}	Write
CreateComment	Grants permission to add a new comment to a specific control	environment*	aws:ResourceTag/${TagKey}	Write
CreateControl	Grants permission to create a leaf control within a custom framework	environment*	aws:ResourceTag/${TagKey}	Write
CreateControlGroup	Grants permission to create a control group within a custom framework	environment*	aws:ResourceTag/${TagKey}	Write
CreateEnvironment	Grants permission to create a new governance environment		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateEnvironmentConnection	Grants permission to create an environment connection			Write
CreateFramework	Grants permission to create a custom customer-owned framework	environment*	aws:ResourceTag/${TagKey}	Write
CreateInvitation	Grants permission to invite an account to connect to an environment	environment*	aws:ResourceTag/${TagKey}	Write
CreatePermissionSet	Grants permission to create a permission set in an environment	environment*	aws:ResourceTag/${TagKey}	Write
CreateProject	Grants permission to create a project	environment*	aws:ResourceTag/${TagKey}	Write
DeleteComment	Grants permission to delete a specific comment by its identifying fields	environment*	aws:ResourceTag/${TagKey}	Write
DeleteControl	Grants permission to delete a custom control	environment*	aws:ResourceTag/${TagKey}	Write
DeleteControlGroup	Grants permission to delete a control group	environment*	aws:ResourceTag/${TagKey}	Write
DeleteEnvironment	Grants permission to delete a governance environment	environment*	aws:ResourceTag/${TagKey}	Write
DeleteEnvironmentConnection	Grants permission to delete an environment connection			Write
DeleteEvidence	Grants permission to remove an evidence item	environment*	aws:ResourceTag/${TagKey}	Write
DeleteFramework	Grants permission to delete a custom framework	environment*	aws:ResourceTag/${TagKey}	Write
DeleteInvitation	Grants permission to delete an invitation or unlink a connected account	environment*	aws:ResourceTag/${TagKey}	Write
DeletePermissionSet	Grants permission to delete a permission set	environment*	aws:ResourceTag/${TagKey}	Write
DeleteProject	Grants permission to delete a project and all its associated resources	environment*	aws:ResourceTag/${TagKey}	Write
DeregisterOrganizationDelegatedAdmin	Grants permission to deregister the delegated administrator for AWS Assurance in the caller's organization			Write
DisableFramework	Grants permission to disable a previously enabled framework for a specific project	environment*	aws:ResourceTag/${TagKey}	Write
EnableFramework	Grants permission to enable a framework for a project	environment*	aws:ResourceTag/${TagKey}	Write
GetAnnotation	Grants permission to retrieve the annotation for a specific piece of evidence	environment*	aws:ResourceTag/${TagKey}	Read
GetAssessment	Grants permission to retrieve a single assessment	environment*	aws:ResourceTag/${TagKey}	Read
GetAssessmentReportContent	Grants permission to retrieve the content of a prepared assessment report	environment*	aws:ResourceTag/${TagKey}	Read
GetAssessmentReportExport	Grants permission to retrieve the state of an assessment report export	environment*	aws:ResourceTag/${TagKey}	Read
GetChatMessages	Grants permission to get messages for a chat session in chronological order	environment*	aws:ResourceTag/${TagKey}	Read
GetComment	Grants permission to retrieve a specific comment by its identifying fields	environment*	aws:ResourceTag/${TagKey}	Read
GetControl	Grants permission to retrieve a single leaf control within a framework version	environment*	aws:ResourceTag/${TagKey}	Read
GetControlGroup	Grants permission to retrieve a single control group within a framework version	environment*	aws:ResourceTag/${TagKey}	Read
GetControlStatus	Grants permission to retrieve the effective compliance status of a control	environment*	aws:ResourceTag/${TagKey}	Read
GetEnvironment	Grants permission to retrieve a governance environment by ARN or domain	environment*	aws:ResourceTag/${TagKey}	Read
GetEvidence	Grants permission to retrieve metadata for an evidence item	environment*	aws:ResourceTag/${TagKey}	Read
GetEvidenceContent	Grants permission to retrieve the content of an evidence item	environment*	aws:ResourceTag/${TagKey}	Read
GetFramework	Grants permission to retrieve a framework resource by type and key fields	environment*	aws:ResourceTag/${TagKey}	Read
GetInvitation	Grants permission to retrieve an invitation	environment*	aws:ResourceTag/${TagKey}	Read
GetPermissionSet	Grants permission to retrieve a permission set	environment*	aws:ResourceTag/${TagKey}	Read
GetProject	Grants permission to retrieve a project	environment*	aws:ResourceTag/${TagKey}	Read
GetResourceActivitiesQueryResults	Grants permission to retrieve results of an asynchronous resource-activities query for an AI agent	environment*	aws:ResourceTag/${TagKey}	Read
GetTask	Grants permission to retrieve a specific task by its identifying fields	environment*	aws:ResourceTag/${TagKey}	Read
ListAssessmentAnnotations	Grants permission to list the annotations on one assessment, paginated	environment*	aws:ResourceTag/${TagKey}	Read
ListAssessmentJournalRecords	Grants permission to list assessment journal records, paginated	environment*	aws:ResourceTag/${TagKey}	Read
ListAssessmentOutcomes	Grants permission to list a compliance score over time	environment*	aws:ResourceTag/${TagKey}	Read
ListAssessments	Grants permission to list assessments, paginated	environment*	aws:ResourceTag/${TagKey}	Read
ListChatSessions	Grants permission to list chat sessions for the calling user in a governance environment	environment*	aws:ResourceTag/${TagKey}	Read
ListComments	Grants permission to list comments in a governance environment	environment*	aws:ResourceTag/${TagKey}	Read
ListConnectionItems	Grants permission to list the contents of an environment connection	environment*	aws:ResourceTag/${TagKey}	Read
ListControlGroups	Grants permission to list control groups in a framework version	environment*	aws:ResourceTag/${TagKey}	Read
ListControlResources	Grants permission to list in-scope resources for a control	environment*	aws:ResourceTag/${TagKey}	Read
ListControls	Grants permission to list controls within a control group	environment*	aws:ResourceTag/${TagKey}	Read
ListDiscoveredResources	Grants permission to list the resources found by a discovery job (paginated)	environment*	aws:ResourceTag/${TagKey}	Read
ListEnabledFrameworks	Grants permission to list enabled frameworks for a governance environment	environment*	aws:ResourceTag/${TagKey}	Read
ListEnvironmentConnections	Grants permission to list environment connections in a governance environment			Read
ListEnvironments	Grants permission to list all governance environments with optional pagination			Read
ListEvidence	Grants permission to list evidence items (paginated)	environment*	aws:ResourceTag/${TagKey}	Read
ListEvidenceAnnotations	Grants permission to list the annotations on one version of a piece of evidence within a project, paginated	environment*	aws:ResourceTag/${TagKey}	Read
ListFrameworks	Grants permission to list frameworks	environment*	aws:ResourceTag/${TagKey}	Read
ListInboundInvitations	Grants permission to list invitations addressed to the caller's account			Read
ListOutboundInvitations	Grants permission to list invitations extended from an owned environment	environment*	aws:ResourceTag/${TagKey}	Read
ListPermissionSetAssignments	Grants permission to list permission set assignments in an environment	environment*	aws:ResourceTag/${TagKey}	Read
ListPermissionSets	Grants permission to list permission sets in an environment	environment*	aws:ResourceTag/${TagKey}	Read
ListProjects	Grants permission to list all projects within a governance environment	environment*	aws:ResourceTag/${TagKey}	Read
ListTagsForResource	Grants permission to list tags for a resource	environment*	aws:ResourceTag/${TagKey}	Read
ListTaskHistory	Grants permission to list task history for a task	environment*	aws:ResourceTag/${TagKey}	Read
ListTasks	Grants permission to list all tasks within a governance environment	environment*	aws:ResourceTag/${TagKey}	Read
PublishFramework	Grants permission to publish a custom framework	environment*	aws:ResourceTag/${TagKey}	Write
PutControlStatusOverride	Grants permission to declare or remove an applicability override on a control or requirement	environment*	aws:ResourceTag/${TagKey}	Write
PutEvidence	Grants permission to add evidence, or a new version of existing evidence, to support a compliance assessment	environment*	aws:ResourceTag/${TagKey}	Write
RegisterOrganizationDelegatedAdmin	Grants permission to register a delegated administrator for AWS Assurance in the caller's organization			Write
RejectInvitation	Grants permission to reject an invitation	environment*	aws:ResourceTag/${TagKey}	Write
RevokePermissionSet	Grants permission to revoke a permission set assignment	environment*	aws:ResourceTag/${TagKey}	Write
StartAssessment	Grants permission to begin a new assessment for a control or framework	environment*	aws:ResourceTag/${TagKey}	Write
StartAssessmentReportExport	Grants permission to start preparing an assessment report	environment*	aws:ResourceTag/${TagKey}	Write
StartResourceActivitiesQuery	Grants permission to start an asynchronous resource-activities query for an AI agent	environment*	aws:ResourceTag/${TagKey}	Read
TagResource	Grants permission to add or overwrite tags on a resource	environment*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from a resource	environment*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateComment	Grants permission to modify the content of an existing comment	environment*	aws:ResourceTag/${TagKey}	Write
UpdateControl	Grants permission to update a custom control	environment*	aws:ResourceTag/${TagKey}	Write
UpdateControlGroup	Grants permission to update a control group's mutable attributes	environment*	aws:ResourceTag/${TagKey}	Write
UpdateEnvironment	Grants permission to update a governance environment	environment*	aws:ResourceTag/${TagKey}	Write
UpdateEvidence	Grants permission to update evidence metadata and manage control links	environment*	aws:ResourceTag/${TagKey}	Write
UpdateFramework	Grants permission to update a custom framework	environment*	aws:ResourceTag/${TagKey}	Write
UpdatePermissionSet	Grants permission to update a permission set	environment*	aws:ResourceTag/${TagKey}	Write
UpdateProject	Grants permission to update a project	environment*	aws:ResourceTag/${TagKey}	Write
UpdateTask	Grants permission to update an existing task's mutable fields	environment*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for AWS Assurance

The following actions are defined by AWS Assurance but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateAnnotation	Grants permission to create an annotation on a piece of evidence	environment*	aws:ResourceTag/${TagKey}	Write
CreateTask	Grants permission to create a new task for a specific control and assessment	environment*	aws:ResourceTag/${TagKey}	Write
DeleteAnnotation	Grants permission to delete an annotation from a piece of evidence	environment*	aws:ResourceTag/${TagKey}	Write
UpdateAnnotation	Grants permission to update the reviewer notes on an existing annotation	environment*	aws:ResourceTag/${TagKey}	Write
UpdateAssessment	Grants permission to update an assessment's status and result	environment*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS Assurance

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
environment	arn:${Partition}:assurance:${Region}:${Account}:environment/${Environment}	aws:ResourceTag/${TagKey}

Condition keys for AWS Assurance

AWS Assurance defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by a tag key and value pair of a resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString