Actions, resources, and condition keys for AWS Proton

AWS Proton (service prefix: proton) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

• Learn how to configure this service.

• View a list of the API operations available for this service.

• Learn how to secure this service and its resources by using IAM permission policies.

Actions defined by AWS Proton

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys	Dependent actions
AcceptEnvironmentAccountConnection	Grants permission to reject an environment account connection request from another environment account	Write	environment-account-connection*
CancelComponentDeployment	Grants permission to cancel component deployment	Write	component*
CancelEnvironmentDeployment	Grants permission to cancel an environment deployment	Write	environment*
				proton:EnvironmentTemplate
CancelServiceInstanceDeployment	Grants permission to cancel a service instance deployment	Write	service-instance*
				proton:ServiceTemplate
CancelServicePipelineDeployment	Grants permission to cancel a service pipeline deployment	Write	service*
				proton:ServiceTemplate
CreateComponent	Grants permission to create component	Write	component*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateEnvironment	Grants permission to create an environment	Write	environment*		iam:PassRole
				aws:TagKeys aws:RequestTag/${TagKey} proton:EnvironmentTemplate
CreateEnvironmentAccountConnection	Grants permission to create an environment account connection	Write		aws:TagKeys aws:RequestTag/${TagKey}
CreateEnvironmentTemplate	Grants permission to create an environment template	Write	environment-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateEnvironmentTemplateMajorVersion	Grants permission to create an environment template major version. DEPRECATED - use CreateEnvironmentTemplateVersion instead	Write	environment-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateEnvironmentTemplateMinorVersion	Grants permission to create an environment template minor version. DEPRECATED - use CreateEnvironmentTemplateVersion instead	Write	environment-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateEnvironmentTemplateVersion	Grants permission to create an environment template version	Write	environment-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateRepository	Grants permission to create a repository	Write	repository*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateService	Grants permission to create a service	Write	service*		codestar-connections:PassConnection
				aws:TagKeys aws:RequestTag/${TagKey} proton:ServiceTemplate
CreateServiceInstance	Grants permission to create a service instance	Write	service-instance*
				aws:TagKeys aws:RequestTag/${TagKey} proton:ServiceTemplate
CreateServiceSyncConfig	Grants permission to create a service sync config	Write
CreateServiceTemplate	Grants permission to create a service template	Write	service-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateServiceTemplateMajorVersion	Grants permission to create a service template major version. DEPRECATED - use CreateServiceTemplateVersion instead	Write	service-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateServiceTemplateMinorVersion	Grants permission to create a service template minor version. DEPRECATED - use CreateServiceTemplateVersion instead	Write	service-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateServiceTemplateVersion	Grants permission to create a service template version	Write	service-template*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateTemplateSyncConfig	Grants permission to create a template sync config	Write
DeleteAccountRoles	Grants permission to delete account roles. DEPRECATED - use UpdateAccountSettings instead	Write
DeleteComponent	Grants permission to delete component	Write	component*
DeleteDeployment	Grants permission to delete a deployment	Write	deployment*
DeleteEnvironment	Grants permission to delete an environment	Write	environment*
				proton:EnvironmentTemplate
DeleteEnvironmentAccountConnection	Grants permission to delete an environment account connection	Write	environment-account-connection*
DeleteEnvironmentTemplate	Grants permission to delete an environment template	Write	environment-template*
DeleteEnvironmentTemplateMajorVersion	Grants permission to delete an environment template major version. DEPRECATED - use DeleteEnvironmentTemplateVersion instead	Write	environment-template*
DeleteEnvironmentTemplateMinorVersion	Grants permission to delete an environment template minor version. DEPRECATED - use DeleteEnvironmentTemplateVersion instead	Write	environment-template*
DeleteEnvironmentTemplateVersion	Grants permission to delete an environment template version	Write	environment-template*
DeleteRepository	Grants permission to delete a repository	Write	repository*
DeleteService	Grants permission to delete a service	Write	service*
				proton:ServiceTemplate
DeleteServiceSyncConfig	Grants permission to delete a service sync config	Write
DeleteServiceTemplate	Grants permission to delete a service template	Write	service-template*
DeleteServiceTemplateMajorVersion	Grants permission to delete a service template major version. DEPRECATED - use DeleteServiceTemplateVersion instead	Write	service-template*
DeleteServiceTemplateMinorVersion	Grants permission to delete a service template minor version. DEPRECATED - use DeleteServiceTemplateVersion instead	Write	service-template*
DeleteServiceTemplateVersion	Grants permission to delete a service template version	Write	service-template*
DeleteTemplateSyncConfig	Grants permission to delete a TemplateSyncConfig	Write
GetAccountRoles	Grants permission to get account roles. DEPRECATED - use GetAccountSettings instead	Read
GetAccountSettings	Grants permission to describe the account settings	Read
GetComponent	Grants permission to describe a component	Read	component*
GetDeployment	Grants permission to describe a deployment	Read	deployment*
GetEnvironment	Grants permission to describe an environment	Read	environment*
GetEnvironmentAccountConnection	Grants permission to describe an environment account connection	Read	environment-account-connection*
GetEnvironmentTemplate	Grants permission to describe an environment template	Read	environment-template*
GetEnvironmentTemplateMajorVersion	Grants permission to get an environment template major version. DEPRECATED - use GetEnvironmentTemplateVersion instead	Read	environment-template*
GetEnvironmentTemplateMinorVersion	Grants permission to get an environment template minor version. DEPRECATED - use GetEnvironmentTemplateVersion instead	Read	environment-template*
GetEnvironmentTemplateVersion	Grants permission to describe an environment template version	Read	environment-template*
GetRepository	Grants permission to describe a repository	Read	repository*
GetRepositorySyncStatus	Grants permission to get the latest sync status for a repository	Read
GetResourceTemplateVersionStatusCounts	Grants permission to list resource template version status counts	Read
GetResourcesSummary	Grants permission to get resources summary	Read
GetService	Grants permission to describe a service	Read	service*
GetServiceInstance	Grants permission to describe a service instance	Read	service-instance*
GetServiceInstanceSyncStatus	Grants permission to describe the sync status of a service instance	Read
GetServiceSyncBlockerSummary	Grants permission to describe service sync blockers on a service or service instance	Read
GetServiceSyncConfig	Grants permission to describe a service sync config	Read
GetServiceTemplate	Grants permission to describe a service template	Read	service-template*
GetServiceTemplateMajorVersion	Grants permission to get a service template major version. DEPRECATED - use GetServiceTemplateVersion instead	Read	service-template*
GetServiceTemplateMinorVersion	Grants permission to get a service template minor version. DEPRECATED - use GetServiceTemplateVersion instead	Read	service-template*
GetServiceTemplateVersion	Grants permission to describe a service template version	Read	service-template*
GetTemplateSyncConfig	Grants permission to describe a TemplateSyncConfig	Read
GetTemplateSyncStatus	Grants permission to describe the sync status of a template	Read
ListComponentOutputs	Grants permission to list component outputs	List	component*
			deployment
ListComponentProvisionedResources	Grants permission to list component provisioned resources	List	component*
ListComponents	Grants permission to list components	List	environment
			service
			service-instance
ListDeployments	Grants permission to list deployments	List
ListEnvironmentAccountConnections	Grants permission to list environment account connections	List
ListEnvironmentOutputs	Grants permission to list environment outputs	List	environment*
			deployment
ListEnvironmentProvisionedResources	Grants permission to list environment provisioned resources	List	environment*
ListEnvironmentTemplateMajorVersions	Grants permission to list environment template major versions. DEPRECATED - use ListEnvironmentTemplateVersions instead	List	environment-template*
ListEnvironmentTemplateMinorVersions	Grants permission to list an environment template minor versions. DEPRECATED - use ListEnvironmentTemplateVersions instead	List	environment-template*
ListEnvironmentTemplateVersions	Grants permission to list environment template versions	List	environment-template*
ListEnvironmentTemplates	Grants permission to list environment templates	List
ListEnvironments	Grants permission to list environments	List
ListRepositories	Grants permission to list repositories	List
ListRepositorySyncDefinitions	Grants permission to list repository sync definitions	List
ListServiceInstanceOutputs	Grants permission to list service instance outputs	List	service*
			service-instance*
			deployment
ListServiceInstanceProvisionedResources	Grants permission to list service instance provisioned resources	List	service*
			service-instance*
ListServiceInstances	Grants permission to list service instances	List
ListServicePipelineOutputs	Grants permission to list service pipeline outputs	List	service*
			deployment
ListServicePipelineProvisionedResources	Grants permission to list service pipeline provisioned resources	List	service*
ListServiceTemplateMajorVersions	Grants permission to list service template major versions. DEPRECATED - use ListServiceTemplateVersions instead	List	service-template*
ListServiceTemplateMinorVersions	Grants permission to list service template minor versions. DEPRECATED - use ListServiceTemplateVersions instead	List	service-template*
ListServiceTemplateVersions	Grants permission to list service template versions	List	service-template*
ListServiceTemplates	Grants permission to list service templates	List
ListServices	Grants permission to list services	List
ListTagsForResource	Grants permission to list tags of a resource	Read	component
			environment
			environment-account-connection
			environment-template
			environment-template-major-version
			environment-template-minor-version
			environment-template-version
			repository
			service
			service-instance
			service-template
			service-template-major-version
			service-template-minor-version
			service-template-version
NotifyResourceDeploymentStatusChange	Grants permission to notify Proton of resource deployment status changes	Write	environment
			service-instance
RejectEnvironmentAccountConnection	Grants permission to reject an environment account connection request from another environment account	Write	environment-account-connection*
TagResource	Grants permission to add tags to a resource	Tagging	component
			environment
			environment-account-connection
			environment-template
			environment-template-major-version
			environment-template-minor-version
			environment-template-version
			repository
			service
			service-instance
			service-template
			service-template-major-version
			service-template-minor-version
			service-template-version
				aws:TagKeys aws:RequestTag/${TagKey}
UntagResource	Grants permission to remove tags from a resource	Tagging	component
			environment
			environment-account-connection
			environment-template
			environment-template-major-version
			environment-template-minor-version
			environment-template-version
			repository
			service
			service-instance
			service-template
			service-template-major-version
			service-template-minor-version
			service-template-version
				aws:TagKeys
UpdateAccountRoles	Grants permission to update account roles. DEPRECATED - use UpdateAccountSettings instead	Write			iam:PassRole
UpdateAccountSettings	Grants permission to update the account settings	Write			iam:PassRole
UpdateComponent	Grants permission to update component	Write	component*
UpdateEnvironment	Grants permission to update an environment	Write	environment*		iam:PassRole
				proton:EnvironmentTemplate
UpdateEnvironmentAccountConnection	Grants permission to update an environment account connection	Write	environment-account-connection*
UpdateEnvironmentTemplate	Grants permission to update an environment template	Write	environment-template*
UpdateEnvironmentTemplateMajorVersion	Grants permission to update an environment template major version. DEPRECATED - use UpdateEnvironmentTemplateVersion instead	Write	environment-template*
UpdateEnvironmentTemplateMinorVersion	Grants permission to update an environment template minor version. DEPRECATED - use UpdateEnvironmentTemplateVersion instead	Write	environment-template*
UpdateEnvironmentTemplateVersion	Grants permission to update an environment template version	Write	environment-template*
UpdateService	Grants permission to update a service	Write	service*
				proton:ServiceTemplate
UpdateServiceInstance	Grants permission to update a service instance	Write	service-instance*
				proton:ServiceTemplate
UpdateServicePipeline	Grants permission to update a service pipeline	Write	service*
				proton:ServiceTemplate
UpdateServiceSyncBlocker	Grants permission to update a service sync blocker	Write
UpdateServiceSyncConfig	Grants permission to update a service sync config	Write
UpdateServiceTemplate	Grants permission to update a service template	Write	service-template*
UpdateServiceTemplateMajorVersion	Grants permission to update a service template major version. DEPRECATED - use UpdateServiceTemplateVersion instead	Write	service-template*
UpdateServiceTemplateMinorVersion	Grants permission to create a service template minor version. DEPRECATED - use UpdateServiceTemplateVersion instead	Write	service-template*
UpdateServiceTemplateVersion	Grants permission to update a service template version	Write	service-template*
UpdateTemplateSyncConfig	Grants permission to update a TemplateSyncConfig	Write

Resource types defined by AWS Proton

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
environment-template	arn:${Partition}:proton:${Region}:${Account}:environment-template/${Name}	aws:ResourceTag/${TagKey}
environment-template-version	arn:${Partition}:proton:${Region}:${Account}:environment-template/${TemplateName}:${MajorVersion}.${MinorVersion}	aws:ResourceTag/${TagKey}
environment-template-major-version	arn:${Partition}:proton:${Region}:${Account}:environment-template/${TemplateName}:${MajorVersionId}	aws:ResourceTag/${TagKey}
environment-template-minor-version	arn:${Partition}:proton:${Region}:${Account}:environment-template/${TemplateName}:${MajorVersionId}.${MinorVersionId}	aws:ResourceTag/${TagKey}
service-template	arn:${Partition}:proton:${Region}:${Account}:service-template/${Name}	aws:ResourceTag/${TagKey}
service-template-version	arn:${Partition}:proton:${Region}:${Account}:service-template/${TemplateName}:${MajorVersion}.${MinorVersion}	aws:ResourceTag/${TagKey}
service-template-major-version	arn:${Partition}:proton:${Region}:${Account}:service-template/${TemplateName}:${MajorVersionId}	aws:ResourceTag/${TagKey}
service-template-minor-version	arn:${Partition}:proton:${Region}:${Account}:service-template/${TemplateName}:${MajorVersionId}.${MinorVersionId}	aws:ResourceTag/${TagKey}
environment	arn:${Partition}:proton:${Region}:${Account}:environment/${Name}	aws:ResourceTag/${TagKey}
service	arn:${Partition}:proton:${Region}:${Account}:service/${Name}	aws:ResourceTag/${TagKey}
service-instance	arn:${Partition}:proton:${Region}:${Account}:service/${ServiceName}/service-instance/${Name}	aws:ResourceTag/${TagKey}
environment-account-connection	arn:${Partition}:proton:${Region}:${Account}:environment-account-connection/${Id}	aws:ResourceTag/${TagKey}
repository	arn:${Partition}:proton:${Region}:${Account}:repository/${Provider}:${Name}	aws:ResourceTag/${TagKey}
component	arn:${Partition}:proton:${Region}:${Account}:component/${Id}	aws:ResourceTag/${TagKey}
deployment	arn:${Partition}:proton:${Region}:${Account}:deployment/${Id}	aws:ResourceTag/${TagKey}

Condition keys for AWS Proton

AWS Proton defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by tag keys in the request	ArrayOfString
proton:EnvironmentTemplate	Filters access by specified environment template related to resource	String
proton:ServiceTemplate	Filters access by specified service template related to resource	String