Actions, resources, and condition keys for AWS Global Accelerator

AWS Global Accelerator (service prefix: globalaccelerator) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

• Learn how to configure this service.

• View a list of the API operations available for this service.

• Learn how to secure this service and its resources by using IAM permission policies.

Actions defined by AWS Global Accelerator

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys	Dependent actions
AddCustomRoutingEndpoints	Grants permission to add a virtual private cloud (VPC) subnet endpoint to a custom routing accelerator endpoint group	Write	endpointgroup*
AddEndpoints	Grants permission to add an endpoint to a standard accelerator endpoint group	Write	endpointgroup*		globalaccelerator:UpdateEndpointGroup
AdvertiseByoipCidr	Grants permission to advertises an IPv4 address range that is provisioned for use with your accelerator through bring your own IP addresses (BYOIP)	Write
AllowCustomRoutingTraffic	Grants permission to allows custom routing of user traffic to a private destination IP:PORT in a specific VPC subnet	Write	endpointgroup*
CreateAccelerator	Grants permission to create a standard accelerator	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateCrossAccountAttachment	Grants permission to create a CrossAccountAttachment	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateCustomRoutingAccelerator	Grants permission to create a Custom Routing accelerator	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateCustomRoutingEndpointGroup	Grants permission to create an endpoint group for the specified listener for a custom routing accelerator	Write	listener*
CreateCustomRoutingListener	Grants permission to create a listener to process inbound connections from clients to a custom routing accelerator	Write	accelerator*
CreateEndpointGroup	Grants permission to add an endpoint group to a standard accelerator listener	Write	listener*
CreateListener	Grants permission to add a listener to a standard accelerator	Write	accelerator*
DeleteAccelerator	Grants permission to delete a standard accelerator	Write	accelerator*
DeleteCrossAccountAttachment	Grants permission to delete a CrossAccountAttachment	Write	attachment*
DeleteCustomRoutingAccelerator	Grants permission to delete a custom routing accelerator	Write	accelerator*
DeleteCustomRoutingEndpointGroup	Grants permission to delete an endpoint group from a listener for a custom routing accelerator	Write	endpointgroup*
DeleteCustomRoutingListener	Grants permission to delete a listener for a custom routing accelerator	Write	listener*
DeleteEndpointGroup	Grants permission to delete an endpoint group associated with a standard accelerator listener	Write	endpointgroup*
DeleteListener	Grants permission to delete a listener from a standard accelerator	Write	listener*
DenyCustomRoutingTraffic	Grants permission to disallows custom routing of user traffic to a private destination IP:PORT in a specific VPC subnet	Write	endpointgroup*
DeprovisionByoipCidr	Grants permission to releases the specified address range that you provisioned for use with your accelerator through bring your own IP addresses (BYOIP)	Write
DescribeAccelerator	Grants permissions to describe a standard accelerator	Read	accelerator*
DescribeAcceleratorAttributes	Grants permission to describe a standard accelerator attributes	Read	accelerator*
DescribeCrossAccountAttachment	Grants permissions to describe a CrossAccountAttachment	Read	attachment*
DescribeCustomRoutingAccelerator	Grants permission to describe a custom routing accelerator	Read	accelerator*
DescribeCustomRoutingAcceleratorAttributes	Grants permission to describe the attributes of a custom routing accelerator	Read	accelerator*
DescribeCustomRoutingEndpointGroup	Grants permission to describe an endpoint group for a custom routing accelerator	Read	endpointgroup*
DescribeCustomRoutingListener	Grants permission to describe a listener for a custom routing accelerator	Read	listener*
DescribeEndpointGroup	Grants permission to describe a standard accelerator endpoint group	Read	endpointgroup*
DescribeListener	Grants permission to describe a standard accelerator listener	Read	listener*
ListAccelerators	Grants permission to list all standard accelerators	List
ListByoipCidrs	Grants permission to list the BYOIP cidrs	List
ListCrossAccountAttachments	Grants permission to list all CrossAccountAttachments	List
ListCrossAccountResourceAccounts	Grants permission to list accounts with CrossAccountAttachments listing caller as a principal	List
ListCrossAccountResources	Grants permission to list all CrossAccountAttachment resources usable by caller	List
ListCustomRoutingAccelerators	Grants permission to list the custom routing accelerators for an AWS account	List
ListCustomRoutingEndpointGroups	Grants permission to list the endpoint groups that are associated with a listener for a custom routing accelerator	List	listener*
ListCustomRoutingListeners	Grants permission to list the listeners for a custom routing accelerator	List	accelerator*
ListCustomRoutingPortMappings	Grants permission to list the port mappings for a custom routing accelerator	List	accelerator*
ListCustomRoutingPortMappingsByDestination	Grants permission to list the port mappings for a specific endpoint IP address (a destination address) in a subnet	List
ListEndpointGroups	Grants permission to list all endpoint groups associated with a standard accelerator listener	List	listener*
ListListeners	Grants permission to list all listeners associated with a standard accelerator	List	accelerator*
ListTagsForResource	Grants permission to list tags for a globalaccelerator resource	Read	accelerator
			attachment
ProvisionByoipCidr	Grants permission to provisions an address range for use with your accelerator through bring your own IP addresses (BYOIP)	Write
RemoveCustomRoutingEndpoints	Grants permission to remove virtual private cloud (VPC) subnet endpoints from a custom routing accelerator endpoint group	Write	endpointgroup*
RemoveEndpoints	Grants permission to remove an endpoint from a standard accelerator endpoint group	Write	endpointgroup*		globalaccelerator:UpdateEndpointGroup
TagResource	Grants permission to add tags to a globalaccelerator resource	Tagging	accelerator
			attachment
				aws:RequestTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from a globalaccelerator resource	Tagging	accelerator
			attachment
				aws:TagKeys
UpdateAccelerator	Grants permission to update a standard accelerator	Write	accelerator*
UpdateAcceleratorAttributes	Grants permission to update a standard accelerator attributes	Write	accelerator*
UpdateCrossAccountAttachment	Grants permission to update a CrossAccountAttachment	Write	attachment*
UpdateCustomRoutingAccelerator	Grants permission to update a custom routing accelerator	Write	accelerator*
UpdateCustomRoutingAcceleratorAttributes	Grants permission to update the attributes for a custom routing accelerator	Write	accelerator*
UpdateCustomRoutingListener	Grants permission to update a listener for a custom routing accelerator	Write	listener*
UpdateEndpointGroup	Grants permission to update an endpoint group on a standard accelerator listener	Write	endpointgroup*
UpdateListener	Grants permission to update a listener on a standard accelerator	Write	listener*
WithdrawByoipCidr	Grants permission to stops advertising a BYOIP IPv4 address	Write

Resource types defined by AWS Global Accelerator

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
accelerator	arn:${Partition}:globalaccelerator::${Account}:accelerator/${ResourceId}	aws:ResourceTag/${TagKey}
listener	arn:${Partition}:globalaccelerator::${Account}:accelerator/${ResourceId}/listener/${ListenerId}	aws:ResourceTag/${TagKey}
endpointgroup	arn:${Partition}:globalaccelerator::${Account}:accelerator/${ResourceId}/listener/${ListenerId}/endpoint-group/${EndpointGroupId}	aws:ResourceTag/${TagKey}
attachment	arn:${Partition}:globalaccelerator::${Account}:attachment/${ResourceId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Global Accelerator

AWS Global Accelerator defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString