Actions, resources, and condition keys for AWS Network Security Manager

AWS Network Security Manager (service prefix: network-security-manager) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

• Learn how to configure this service.

• View a list of the API operations available for this service.

• Learn how to secure this service and its resources by using IAM permission policies.

• View the programmatic service authorization reference for this service.

API operations defined by AWS Network Security Manager

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateDeployment	network-security-manager:CreateDeployment			Write
	network-security-manager:TagResource			Tagging, Write
CreateDeploymentSnapshot	network-security-manager:CreateDeploymentSnapshot			Write
	network-security-manager:TagResource			Tagging, Write
CreatePolicy	network-security-manager:CreatePolicy			Write
	network-security-manager:TagResource			Tagging, Write
CreatePolicySnapshot	network-security-manager:CreatePolicySnapshot			Write
	network-security-manager:TagResource			Tagging, Write
CreateRule	network-security-manager:CreateRule			Write
	network-security-manager:TagResource			Tagging, Write
CreateRuleSnapshot	network-security-manager:CreateRuleSnapshot			Write
	network-security-manager:TagResource			Tagging, Write
CreateScope	network-security-manager:CreateScope			Write
	network-security-manager:TagResource			Tagging, Write
CreateScopeSnapshot	network-security-manager:CreateScopeSnapshot			Write
	network-security-manager:TagResource			Tagging, Write
CreateTemplate	network-security-manager:CreateTemplate			Write
	network-security-manager:TagResource			Tagging, Write
CreateTemplateSnapshot	network-security-manager:CreateTemplateSnapshot			Write
	network-security-manager:TagResource			Tagging, Write
DeleteAdminAccount	network-security-manager:DeleteAdminAccount			Write
DeleteDeployment	network-security-manager:DeleteDeployment			Write
DeletePolicy	network-security-manager:DeletePolicy			Write
DeleteRule	network-security-manager:DeleteRule			Write
DeleteScope	network-security-manager:DeleteScope			Write
DeleteTemplate	network-security-manager:DeleteTemplate			Write
GenerateRuleConfiguration	network-security-manager:GenerateRuleConfiguration			Write
GetAdminAccount	network-security-manager:GetAdminAccount			Read
GetDeployment	network-security-manager:GetDeployment			Read
GetPolicy	network-security-manager:GetPolicy			Read
GetRule	network-security-manager:GetRule			Read
GetScope	network-security-manager:GetScope			Read
GetTemplate	network-security-manager:GetTemplate			Read
ListAdminAccounts	network-security-manager:ListAdminAccounts			List
ListAggregateResourceSynchronizationStatuses	network-security-manager:ListAggregateResourceSynchronizationStatuses			Read
ListDeploymentSnapshots	network-security-manager:ListDeploymentSnapshots			Read
ListDeployments	network-security-manager:ListDeployments			List
ListPolicies	network-security-manager:ListPolicies			List
ListPolicySnapshots	network-security-manager:ListPolicySnapshots			Read
ListResourceAssociations	network-security-manager:ListResourceAssociations			Read
ListResourceSynchronizationStatuses	network-security-manager:ListResourceSynchronizationStatuses			Read
ListRuleSnapshots	network-security-manager:ListRuleSnapshots			Read
ListRules	network-security-manager:ListRules			List
ListScopeSnapshots	network-security-manager:ListScopeSnapshots			Read
ListScopes	network-security-manager:ListScopes			List
ListTagsForResource	network-security-manager:ListTagsForResource			Read
ListTemplateSnapshots	network-security-manager:ListTemplateSnapshots			Read
ListTemplates	network-security-manager:ListTemplates			List
PutAdminAccount	network-security-manager:PutAdminAccount			Write
TagResource	network-security-manager:TagResource			Tagging, Write
UntagResource	network-security-manager:UntagResource			Tagging, Write
UpdateDeployment	network-security-manager:UpdateDeployment			Write
UpdatePolicy	network-security-manager:UpdatePolicy			Write
UpdateRule	network-security-manager:UpdateRule			Write
UpdateScope	network-security-manager:UpdateScope			Write
UpdateTemplate	network-security-manager:UpdateTemplate			Write

Actions defined by AWS Network Security Manager

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateDeployment	Grants permission to create a deployment	policy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		policy-snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		scope*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		scope-snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateDeploymentSnapshot	Grants permission to create a snapshot of a deployment	deployment*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePolicy	Grants permission to create a policy	rule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		rule-snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		template	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		template-snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreatePolicySnapshot	Grants permission to create a snapshot of a policy	policy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRule	Grants permission to create a rule		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateRuleSnapshot	Grants permission to create a snapshot of a rule	rule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateScope	Grants permission to create a scope		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateScopeSnapshot	Grants permission to create a snapshot of a scope	scope*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTemplate	Grants permission to create a template	rule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		rule-snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateTemplateSnapshot	Grants permission to create a snapshot of a template	template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAdminAccount	Grants permission to remove a Network Security Manager administrator account			Write
DeleteDeployment	Grants permission to delete a deployment	deployment*	aws:ResourceTag/${TagKey}	Write
		deployment-snapshot*	aws:ResourceTag/${TagKey}
DeletePolicy	Grants permission to delete a policy	policy*	aws:ResourceTag/${TagKey}	Write
		policy-snapshot*	aws:ResourceTag/${TagKey}
DeleteRule	Grants permission to delete a rule	rule*	aws:ResourceTag/${TagKey}	Write
		rule-snapshot*	aws:ResourceTag/${TagKey}
DeleteScope	Grants permission to delete a scope	scope*	aws:ResourceTag/${TagKey}	Write
		scope-snapshot*	aws:ResourceTag/${TagKey}
DeleteTemplate	Grants permission to delete a template	template*	aws:ResourceTag/${TagKey}	Write
		template-snapshot*	aws:ResourceTag/${TagKey}
GenerateRuleConfiguration	Grants permission to generate a rule configuration from a natural-language prompt			Write
GetAdminAccount	Grants permission to retrieve a Network Security Manager administrator account			Read
GetDeployment	Grants permission to retrieve a deployment	deployment*	aws:ResourceTag/${TagKey}	Read
		deployment-snapshot*	aws:ResourceTag/${TagKey}
GetPolicy	Grants permission to retrieve a policy	policy*	aws:ResourceTag/${TagKey}	Read
		policy-snapshot*	aws:ResourceTag/${TagKey}
GetRule	Grants permission to retrieve a rule	rule*	aws:ResourceTag/${TagKey}	Read
		rule-snapshot*	aws:ResourceTag/${TagKey}
GetScope	Grants permission to retrieve a scope	scope*	aws:ResourceTag/${TagKey}	Read
		scope-snapshot*	aws:ResourceTag/${TagKey}
GetTemplate	Grants permission to retrieve a template	template*	aws:ResourceTag/${TagKey}	Read
		template-snapshot*	aws:ResourceTag/${TagKey}
ListAdminAccounts	Grants permission to list Network Security Manager administrator accounts			List
ListAggregateResourceSynchronizationStatuses	Grants permission to list aggregate resource synchronization statuses across the caller's deployments			Read
ListDeploymentSnapshots	Grants permission to list the snapshots of a deployment	deployment*	aws:ResourceTag/${TagKey}	Read
ListDeployments	Grants permission to list deployments			List
ListPolicies	Grants permission to list policies			List
ListPolicySnapshots	Grants permission to list the snapshots of a policy	policy*	aws:ResourceTag/${TagKey}	Read
ListResourceAssociations	Grants permission to list the associations of a Network Security Manager resource	deployment*	aws:ResourceTag/${TagKey}	Read
		deployment-snapshot*	aws:ResourceTag/${TagKey}
		policy*	aws:ResourceTag/${TagKey}
		policy-snapshot*	aws:ResourceTag/${TagKey}
		rule*	aws:ResourceTag/${TagKey}
		rule-snapshot*	aws:ResourceTag/${TagKey}
		scope*	aws:ResourceTag/${TagKey}
		scope-snapshot*	aws:ResourceTag/${TagKey}
		template*	aws:ResourceTag/${TagKey}
		template-snapshot*	aws:ResourceTag/${TagKey}
ListResourceSynchronizationStatuses	Grants permission to list resource synchronization statuses for a deployment	deployment*	aws:ResourceTag/${TagKey}	Read
		deployment-snapshot*	aws:ResourceTag/${TagKey}
ListRuleSnapshots	Grants permission to list the snapshots of a rule	rule*	aws:ResourceTag/${TagKey}	Read
ListRules	Grants permission to list rules			List
ListScopeSnapshots	Grants permission to list the snapshots of a scope	scope*	aws:ResourceTag/${TagKey}	Read
ListScopes	Grants permission to list scopes			List
ListTagsForResource	Grants permission to list the tags of a Network Security Manager resource	deployment	aws:ResourceTag/${TagKey}	Read
		deployment-snapshot	aws:ResourceTag/${TagKey}
		policy	aws:ResourceTag/${TagKey}
		policy-snapshot	aws:ResourceTag/${TagKey}
		rule	aws:ResourceTag/${TagKey}
		rule-snapshot	aws:ResourceTag/${TagKey}
		scope	aws:ResourceTag/${TagKey}
		scope-snapshot	aws:ResourceTag/${TagKey}
		template	aws:ResourceTag/${TagKey}
		template-snapshot	aws:ResourceTag/${TagKey}
ListTemplateSnapshots	Grants permission to list the snapshots of a template	template*	aws:ResourceTag/${TagKey}	Read
ListTemplates	Grants permission to list templates			List
PutAdminAccount	Grants permission to set a Network Security Manager administrator account			Write
TagResource	Grants permission to add or overwrite tags on a Network Security Manager resource	deployment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		deployment-snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		policy	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		policy-snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		rule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		rule-snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		scope	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		scope-snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		template	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		template-snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from a Network Security Manager resource	deployment	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		deployment-snapshot	aws:ResourceTag/${TagKey} aws:TagKeys
		policy	aws:ResourceTag/${TagKey} aws:TagKeys
		policy-snapshot	aws:ResourceTag/${TagKey} aws:TagKeys
		rule	aws:ResourceTag/${TagKey} aws:TagKeys
		rule-snapshot	aws:ResourceTag/${TagKey} aws:TagKeys
		scope	aws:ResourceTag/${TagKey} aws:TagKeys
		scope-snapshot	aws:ResourceTag/${TagKey} aws:TagKeys
		template	aws:ResourceTag/${TagKey} aws:TagKeys
		template-snapshot	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateDeployment	Grants permission to update a deployment	deployment*	aws:ResourceTag/${TagKey}	Write
		policy	aws:ResourceTag/${TagKey}
		policy-snapshot	aws:ResourceTag/${TagKey}
		scope	aws:ResourceTag/${TagKey}
		scope-snapshot	aws:ResourceTag/${TagKey}
UpdatePolicy	Grants permission to update a policy	policy*	aws:ResourceTag/${TagKey}	Write
		rule	aws:ResourceTag/${TagKey}
		rule-snapshot	aws:ResourceTag/${TagKey}
		template	aws:ResourceTag/${TagKey}
		template-snapshot	aws:ResourceTag/${TagKey}
UpdateRule	Grants permission to update a rule	rule*	aws:ResourceTag/${TagKey}	Write
UpdateScope	Grants permission to update a scope	scope*	aws:ResourceTag/${TagKey}	Write
UpdateTemplate	Grants permission to update a template	rule	aws:ResourceTag/${TagKey}	Write
		rule-snapshot	aws:ResourceTag/${TagKey}
		template*	aws:ResourceTag/${TagKey}

Resource types defined by AWS Network Security Manager

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
deployment	arn:${Partition}:network-security-manager:${Region}:${Account}:deployment:${DeploymentId}	aws:ResourceTag/${TagKey}
deployment-snapshot	arn:${Partition}:network-security-manager:${Region}:${Account}:deployment:${DeploymentId}:${VersionNumber}	aws:ResourceTag/${TagKey}
policy	arn:${Partition}:network-security-manager:${Region}:${Account}:policy:${PolicyId}	aws:ResourceTag/${TagKey}
policy-snapshot	arn:${Partition}:network-security-manager:${Region}:${Account}:policy:${PolicyId}:${VersionNumber}	aws:ResourceTag/${TagKey}
rule	arn:${Partition}:network-security-manager:${Region}:${Account}:rule:${RuleId}	aws:ResourceTag/${TagKey}
rule-snapshot	arn:${Partition}:network-security-manager:${Region}:${Account}:rule:${RuleId}:${VersionNumber}	aws:ResourceTag/${TagKey}
scope	arn:${Partition}:network-security-manager:${Region}:${Account}:scope:${ScopeId}	aws:ResourceTag/${TagKey}
scope-snapshot	arn:${Partition}:network-security-manager:${Region}:${Account}:scope:${ScopeId}:${VersionNumber}	aws:ResourceTag/${TagKey}
template	arn:${Partition}:network-security-manager:${Region}:${Account}:template:${TemplateId}	aws:ResourceTag/${TagKey}
template-snapshot	arn:${Partition}:network-security-manager:${Region}:${Account}:template:${TemplateId}:${VersionNumber}	aws:ResourceTag/${TagKey}

Condition keys for AWS Network Security Manager

AWS Network Security Manager defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString