Actions, resources, and condition keys for AWS Proton

AWS Proton (service prefix: proton) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

• Learn how to configure this service.

• View a list of the API operations available for this service.

• Learn how to secure this service and its resources by using IAM permission policies.

Actions defined by AWS Proton

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys	Dependent actions
AcceptEnvironmentAccountConnection	Grants permission to reject an environment account connection request from another environment account	Write	environment-account-connection*
CancelEnvironmentDeployment	Grants permission to cancel an environment deployment	Write	environment*
				proton:EnvironmentTemplate
CancelServiceInstanceDeployment	Grants permission to cancel a service instance deployment	Write	service-instance*
				proton:ServiceTemplate
CancelServicePipelineDeployment	Grants permission to cancel a service pipeline deployment	Write	service*
				proton:ServiceTemplate
CreateEnvironment	Grants permission to create an environment	Write	environment*		iam:PassRole
				aws:TagKeys aws:RequestTag/${TagKey} proton:EnvironmentTemplate
CreateEnvironmentAccountConnection	Grants permission to create an environment account connection	Write		aws:TagKeys aws:RequestTag/${TagKey}
CreateEnvironmentTemplate	Grants permission to create an environment template	Write	environment-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateEnvironmentTemplateMajorVersion	Grants permission to create an environment template major version. DEPRECATED - use CreateEnvironmentTemplateVersion instead	Write	environment-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateEnvironmentTemplateMinorVersion	Grants permission to create an environment template minor version. DEPRECATED - use CreateEnvironmentTemplateVersion instead	Write	environment-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateEnvironmentTemplateVersion	Grants permission to create an environment template version	Write	environment-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateRepository	Grants permission to create a repository	Write	repository*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateService	Grants permission to create a service	Write	service*		codestar-connections:PassConnection
				aws:TagKeys aws:RequestTag/${TagKey} proton:ServiceTemplate
CreateServiceTemplate	Grants permission to create a service template	Write	service-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateServiceTemplateMajorVersion	Grants permission to create a service template major version. DEPRECATED - use CreateServiceTemplateVersion instead	Write	service-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateServiceTemplateMinorVersion	Grants permission to create a service template minor version. DEPRECATED - use CreateServiceTemplateVersion instead	Write	service-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateServiceTemplateVersion	Grants permission to create a service template version	Write	service-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateTemplateSyncConfig	Grants permission to create a template sync config	Write
DeleteAccountRoles	Grants permission to delete account roles. DEPRECATED - use UpdateAccountSettings instead	Write
DeleteEnvironment	Grants permission to delete an environment	Write	environment*
				proton:EnvironmentTemplate
DeleteEnvironmentAccountConnection	Grants permission to delete an environment account connection	Write	environment-account-connection*
DeleteEnvironmentTemplate	Grants permission to delete an environment template	Write	environment-template*
DeleteEnvironmentTemplateMajorVersion	Grants permission to delete an environment template major version. DEPRECATED - use DeleteEnvironmentTemplateVersion instead	Write	environment-template*
DeleteEnvironmentTemplateMinorVersion	Grants permission to delete an environment template minor version. DEPRECATED - use DeleteEnvironmentTemplateVersion instead	Write	environment-template*
DeleteEnvironmentTemplateVersion	Grants permission to delete an environment template version	Write	environment-template*
DeleteRepository	Grants permission to delete a repository	Write	repository*
DeleteService	Grants permission to delete a service	Write	service*
				proton:ServiceTemplate
DeleteServiceTemplate	Grants permission to delete a service template	Write	service-template*
DeleteServiceTemplateMajorVersion	Grants permission to delete a service template major version. DEPRECATED - use DeleteServiceTemplateVersion instead	Write	service-template*
DeleteServiceTemplateMinorVersion	Grants permission to delete a service template minor version. DEPRECATED - use DeleteServiceTemplateVersion instead	Write	service-template*
DeleteServiceTemplateVersion	Grants permission to delete a service template version	Write	service-template*
DeleteTemplateSyncConfig	Grants permission to delete a TemplateSyncConfig	Write
GetAccountRoles	Grants permission to get account roles. DEPRECATED - use GetAccountSettings instead	Read
GetAccountSettings	Grants permission to describe the account settings	Read
GetEnvironment	Grants permission to describe an environment	Read	environment*
GetEnvironmentAccountConnection	Grants permission to describe an environment account connection	Read	environment-account-connection*
GetEnvironmentTemplate	Grants permission to describe an environment template	Read	environment-template*
GetEnvironmentTemplateMajorVersion	Grants permission to get an environment template major version. DEPRECATED - use GetEnvironmentTemplateVersion instead	Read	environment-template*
GetEnvironmentTemplateMinorVersion	Grants permission to get an environment template minor version. DEPRECATED - use GetEnvironmentTemplateVersion instead	Read	environment-template*
GetEnvironmentTemplateVersion	Grants permission to describe an environment template version	Read	environment-template*
GetRepository	Grants permission to describe a repository	Read	repository*
GetRepositorySyncStatus	Grants permission to get the latest sync status for a repository	Read
GetService	Grants permission to describe a service	Read	service*
GetServiceInstance	Grants permission to describe a service instance	Read	service-instance*
GetServiceTemplate	Grants permission to describe a service template	Read	service-template*
GetServiceTemplateMajorVersion	Grants permission to get a service template major version. DEPRECATED - use GetServiceTemplateVersion instead	Read	service-template*
GetServiceTemplateMinorVersion	Grants permission to get a service template minor version. DEPRECATED - use GetServiceTemplateVersion instead	Read	service-template*
GetServiceTemplateVersion	Grants permission to describe a service template version	Read	service-template*
GetTemplateSyncConfig	Grants permission to describe a TemplateSyncConfig	Read
GetTemplateSyncStatus	Grants permission to describe the sync status of a template	Read
ListEnvironmentAccountConnections	Grants permission to list environment account connections	List	environment-account-connection*
ListEnvironmentOutputs	Grants permission to list environment outputs	List	environment*
ListEnvironmentProvisionedResources	Grants permission to list environment provisioned resources	List	environment*
ListEnvironmentTemplateMajorVersions	Grants permission to list environment template major versions. DEPRECATED - use ListEnvironmentTemplateVersions instead	List	environment-template*
ListEnvironmentTemplateMinorVersions	Grants permission to list an environment template minor versions. DEPRECATED - use ListEnvironmentTemplateVersions instead	List	environment-template*
ListEnvironmentTemplateVersions	Grants permission to list environment template versions	List	environment-template*
ListEnvironmentTemplates	Grants permission to list environment templates	List
ListEnvironments	Grants permission to list environments	List
ListRepositories	Grants permission to list repositories	List
ListRepositorySyncDefinitions	Grants permission to list repository sync definitions	List
ListServiceInstanceOutputs	Grants permission to list service instance outputs	List	service*
			service-instance*
ListServiceInstanceProvisionedResources	Grants permission to list service instance provisioned resources	List	service*
			service-instance*
ListServiceInstances	Grants permission to list service instances	List
ListServicePipelineOutputs	Grants permission to list service pipeline outputs	List	service*
ListServicePipelineProvisionedResources	Grants permission to list service pipeline provisioned resources	List	service*
ListServiceTemplateMajorVersions	Grants permission to list service template major versions. DEPRECATED - use ListServiceTemplateVersions instead	List	service-template*
ListServiceTemplateMinorVersions	Grants permission to list service template minor versions. DEPRECATED - use ListServiceTemplateVersions instead	List	service-template*
ListServiceTemplateVersions	Grants permission to list service template versions	List	service-template*
ListServiceTemplates	Grants permission to list service templates	List
ListServices	Grants permission to list services	List
ListTagsForResource	Grants permission to list tags of a resource	Read	environment
			environment-template
			environment-template-major-version
			environment-template-minor-version
			environment-template-version
			repository
			service
			service-instance
			service-template
			service-template-major-version
			service-template-minor-version
			service-template-version
NotifyResourceDeploymentStatusChange	Grants permission to notify Proton of resource deployment status changes	Write	environment
			service-instance
RejectEnvironmentAccountConnection	Grants permission to reject an environment account connection request from another environment account	Write	environment-account-connection*
TagResource	Grants permission to add tags to a resource	Tagging	environment
			environment-template
			environment-template-major-version
			environment-template-minor-version
			environment-template-version
			repository
			service
			service-instance
			service-template
			service-template-major-version
			service-template-minor-version
			service-template-version
				aws:TagKeys aws:RequestTag/${TagKey}
UntagResource	Grants permission to remove tags from a resource	Tagging	environment
			environment-template
			environment-template-major-version
			environment-template-minor-version
			environment-template-version
			repository
			service
			service-instance
			service-template
			service-template-major-version
			service-template-minor-version
			service-template-version
				aws:TagKeys
UpdateAccountRoles	Grants permission to update account roles. DEPRECATED - use UpdateAccountSettings instead	Write			iam:PassRole
UpdateAccountSettings	Grants permission to update the account settings	Write			iam:PassRole
UpdateEnvironment	Grants permission to update an environment	Write	environment*		iam:PassRole
				proton:EnvironmentTemplate
UpdateEnvironmentAccountConnection	Grants permission to update an environment account connection	Write	environment-account-connection*
UpdateEnvironmentTemplate	Grants permission to update an environment template	Write	environment-template*
UpdateEnvironmentTemplateMajorVersion	Grants permission to update an environment template major version. DEPRECATED - use UpdateEnvironmentTemplateVersion instead	Write	environment-template*
UpdateEnvironmentTemplateMinorVersion	Grants permission to update an environment template minor version. DEPRECATED - use UpdateEnvironmentTemplateVersion instead	Write	environment-template*
UpdateEnvironmentTemplateVersion	Grants permission to update an environment template version	Write	environment-template*
UpdateService	Grants permission to update a service	Write	service*
				proton:ServiceTemplate
UpdateServiceInstance	Grants permission to update a service instance	Write	service-instance*
				proton:ServiceTemplate
UpdateServicePipeline	Grants permission to update a service pipeline	Write	service*
				proton:ServiceTemplate
UpdateServiceTemplate	Grants permission to update a service template	Write	service-template*
UpdateServiceTemplateMajorVersion	Grants permission to update a service template major version. DEPRECATED - use UpdateServiceTemplateVersion instead	Write	service-template*
UpdateServiceTemplateMinorVersion	Grants permission to create a service template minor version. DEPRECATED - use UpdateServiceTemplateVersion instead	Write	service-template*
UpdateServiceTemplateVersion	Grants permission to update a service template version	Write	service-template*
UpdateTemplateSyncConfig	Grants permission to update a TemplateSyncConfig	Write

Resource types defined by AWS Proton

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
environment-template	arn:${Partition}:proton:${Region}:${Account}:environment-template/${Name}	aws:ResourceTag/${TagKey}
environment-template-version	arn:${Partition}:proton:${Region}:${Account}:environment-template/${TemplateName}:${MajorVersion}.${MinorVersion}	aws:ResourceTag/${TagKey}
environment-template-major-version	arn:${Partition}:proton:${Region}:${Account}:environment-template/${TemplateName}:${MajorVersionId}	aws:ResourceTag/${TagKey}
environment-template-minor-version	arn:${Partition}:proton:${Region}:${Account}:environment-template/${TemplateName}:${MajorVersionId}.${MinorVersionId}	aws:ResourceTag/${TagKey}
service-template	arn:${Partition}:proton:${Region}:${Account}:service-template/${Name}	aws:ResourceTag/${TagKey}
service-template-version	arn:${Partition}:proton:${Region}:${Account}:service-template/${TemplateName}:${MajorVersion}.${MinorVersion}	aws:ResourceTag/${TagKey}
service-template-major-version	arn:${Partition}:proton:${Region}:${Account}:service-template/${TemplateName}:${MajorVersionId}	aws:ResourceTag/${TagKey}
service-template-minor-version	arn:${Partition}:proton:${Region}:${Account}:service-template/${TemplateName}:${MajorVersionId}.${MinorVersionId}	aws:ResourceTag/${TagKey}
environment	arn:${Partition}:proton:${Region}:${Account}:environment/${Name}	aws:ResourceTag/${TagKey}
service	arn:${Partition}:proton:${Region}:${Account}:service/${Name}	aws:ResourceTag/${TagKey}
service-instance	arn:${Partition}:proton:${Region}:${Account}:service/${ServiceName}/service-instance/${Name}	aws:ResourceTag/${TagKey}
environment-account-connection	arn:${Partition}:proton:${Region}:${Account}:environment-account-connection/${Id}	aws:ResourceTag/${TagKey}
repository	arn:${Partition}:proton:${Region}:${Account}:repository/${Provider}:${Name}	aws:ResourceTag/${TagKey}

Condition keys for AWS Proton

AWS Proton defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters actions based on the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters actions based on tag key-value pairs attached to the resource	String
aws:TagKeys	Filters actions based on the presence of tag keys in the request	ArrayOfString
proton:EnvironmentTemplate	Filters actions based on specified environment template related to resource	String
proton:ServiceTemplate	Filters actions based on specified service template related to resource	String