Actions, resources, and condition keys for AWS RoboMaker

AWS RoboMaker (service prefix: robomaker) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

• Learn how to configure this service.

• View a list of the API operations available for this service.

• Learn how to secure this service and its resources by using IAM permission policies.

Actions defined by AWS RoboMaker

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions	Description	Access level	Resource types (*required)	Condition keys	Dependent actions
BatchDeleteWorlds	Delete one or more worlds in a batch operation	Write
BatchDescribeSimulationJob	Describe multiple simulation jobs	Read
CancelDeploymentJob	Cancel a deployment job	Write	deploymentJob*
CancelSimulationJob	Cancel a simulation job	Write	simulationJob*
CancelSimulationJobBatch	Cancel a simulation job batch	Write	simulationJobBatch*
CancelWorldExportJob	Cancel a world export job	Write	worldExportJob*
CancelWorldGenerationJob	Cancel a world generation job	Write	worldGenerationJob*
CreateDeploymentJob	Create a deployment job	Write		aws:TagKeys aws:RequestTag/${TagKey}	iam:CreateServiceLinkedRole
CreateFleet	Create a deployment fleet that represents a logical group of robots running the same robot application	Write		aws:TagKeys aws:RequestTag/${TagKey}
CreateRobot	Create a robot that can be registered to a fleet	Write		aws:TagKeys aws:RequestTag/${TagKey}	iam:CreateServiceLinkedRole
CreateRobotApplication	Create a robot application	Write		aws:TagKeys aws:RequestTag/${TagKey}
CreateRobotApplicationVersion	Create a snapshot of a robot application	Write	robotApplication*		s3:GetObject
CreateSimulationApplication	Create a simulation application	Write		aws:TagKeys aws:RequestTag/${TagKey}
CreateSimulationApplicationVersion	Create a snapshot of a simulation application	Write	simulationApplication*		s3:GetObject
CreateSimulationJob	Create a simulation job	Write		aws:TagKeys aws:RequestTag/${TagKey}	iam:CreateServiceLinkedRole
CreateWorldExportJob	Create a world export job	Write	world*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateWorldGenerationJob	Create a world generation job	Write	worldTemplate*
				aws:TagKeys aws:RequestTag/${TagKey}
CreateWorldTemplate	Create a world template	Write		aws:TagKeys aws:RequestTag/${TagKey}
DeleteFleet	Delete a deployment fleet	Write	deploymentFleet*
DeleteRobot	Delete a robot	Write	robot*
DeleteRobotApplication	Delete a robot application	Write	robotApplication*
DeleteSimulationApplication	Delete a simulation application	Write	simulationApplication*
DeleteWorldTemplate	Delete a world template	Write	worldTemplate*
DeregisterRobot	Deregister a robot from a fleet	Write	deploymentFleet*
			robot*
DescribeDeploymentJob	Describe a deployment job	Read	deploymentJob*
DescribeFleet	Describe a deployment fleet	Read	deploymentFleet*
DescribeRobot	Describe a robot	Read	robot*
DescribeRobotApplication	Describe a robot application	Read	robotApplication*
DescribeSimulationApplication	Describe a simulation application	Read	simulationApplication*
DescribeSimulationJob	Describe a simulation job	Read	simulationJob*
DescribeSimulationJobBatch	Describe a simulation job batch	Read	simulationJobBatch*
DescribeWorld	Describe a world	Read	world*
DescribeWorldExportJob	Describe a world export job	Read	worldExportJob*
DescribeWorldGenerationJob	Describe a world generation job	Read	worldGenerationJob*
DescribeWorldTemplate	Describe a world template	Read	worldTemplate*
GetWorldTemplateBody	Get the body of a world template	Read	worldTemplate*
ListDeploymentJobs	List deployment jobs	List
ListFleets	List fleets	List
ListRobotApplications	List robot applications	List
ListRobots	List robots	List
ListSimulationApplications	List simulation applications	List
ListSimulationJobBatches	List simulation job batches	List
ListSimulationJobs	List simulation jobs	List
ListSupportedAvailabilityZones [permission only]	Lists supported availability zones	List
ListTagsForResource	List tags for a RoboMaker resource	List	deploymentFleet
			deploymentJob
			robot
			robotApplication
			simulationApplication
			simulationJob
			simulationJobBatch
			world
			worldExportJob
			worldGenerationJob
			worldTemplate
ListWorldExportJobs	List world export jobs	List
ListWorldGenerationJobs	List world generation jobs	List
ListWorldTemplates	List world templates	List
ListWorlds	List worlds	List
RegisterRobot	Register a robot to a fleet	Write	deploymentFleet*
			robot*
RestartSimulationJob	Restart a running simulation job	Write	simulationJob*
StartSimulationJobBatch	Create a simulation job batch	Write		aws:TagKeys aws:RequestTag/${TagKey}	iam:CreateServiceLinkedRole
SyncDeploymentJob	Ensures the most recently deployed robot application is deployed to all robots in the fleet	Write	deploymentFleet*		iam:CreateServiceLinkedRole
TagResource	Add tags to a RoboMaker resource	Tagging	deploymentFleet
			deploymentJob
			robot
			robotApplication
			simulationApplication
			simulationJob
			simulationJobBatch
			world
			worldExportJob
			worldGenerationJob
			worldTemplate
				aws:TagKeys aws:RequestTag/${TagKey}
UntagResource	Remove tags from a RoboMaker resource	Tagging	deploymentFleet
			deploymentJob
			robot
			robotApplication
			simulationApplication
			simulationJob
			simulationJobBatch
			world
			worldExportJob
			worldGenerationJob
			worldTemplate
				aws:TagKeys
UpdateRobotApplication	Update a robot application	Write	robotApplication*
UpdateRobotDeployment [permission only]	Report the deployment status for an individual robot	Write
UpdateSimulationApplication	Update a simulation application	Write	simulationApplication*
UpdateWorldTemplate	Update a world template	Write	worldTemplate*

Resource types defined by AWS RoboMaker

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types	ARN	Condition keys
robotApplication	arn:${Partition}:robomaker:${Region}:${Account}:robot-application/${ApplicationName}/${CreatedOnEpoch}	aws:ResourceTag/${TagKey}
simulationApplication	arn:${Partition}:robomaker:${Region}:${Account}:simulation-application/${ApplicationName}/${CreatedOnEpoch}	aws:ResourceTag/${TagKey}
simulationJob	arn:${Partition}:robomaker:${Region}:${Account}:simulation-job/${SimulationJobId}	aws:ResourceTag/${TagKey}
simulationJobBatch	arn:${Partition}:robomaker:${Region}:${Account}:simulation-job-batch/${SimulationJobBatchId}	aws:ResourceTag/${TagKey}
deploymentJob	arn:${Partition}:robomaker:${Region}:${Account}:deployment-job/${DeploymentJobId}	aws:ResourceTag/${TagKey}
robot	arn:${Partition}:robomaker:${Region}:${Account}:robot/${RobotName}/${CreatedOnEpoch}	aws:ResourceTag/${TagKey}
deploymentFleet	arn:${Partition}:robomaker:${Region}:${Account}:deployment-fleet/${FleetName}/${CreatedOnEpoch}	aws:ResourceTag/${TagKey}
worldGenerationJob	arn:${Partition}:robomaker:${Region}:${Account}:world-generation-job/${WorldGenerationJobId}	aws:ResourceTag/${TagKey}
worldExportJob	arn:${Partition}:robomaker:${Region}:${Account}:world-export-job/${WorldExportJobId}	aws:ResourceTag/${TagKey}
worldTemplate	arn:${Partition}:robomaker:${Region}:${Account}:world-template/${WorldTemplateJobId}	aws:ResourceTag/${TagKey}
world	arn:${Partition}:robomaker:${Region}:${Account}:world/${WorldId}	aws:ResourceTag/${TagKey}

Condition keys for AWS RoboMaker

AWS RoboMaker defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access based on the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access based on the tags associated with the resource	String
aws:TagKeys	Filters access based on the tag keys that are passed in the request	ArrayOfString