# Actions, resources, and condition keys for AWS Network Security Manager
<a name="list_network-security-manager"></a>

AWS Network Security Manager (service prefix: `network-security-manager`) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:
+ Learn how to [configure this service](https://docs.aws.amazon.com/network-security-manager/latest/devguide/).
+ View a list of the [API operations available for this service](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/).
+ Learn how to secure this service and its resources by [using IAM](https://docs.aws.amazon.com/network-security-manager/latest/devguide/security-am.html) permission policies.
+ View the [programmatic service authorization reference](https://servicereference.us-east-1.amazonaws.com/v1/network-security-manager/network-security-manager.json) for this service.

**Topics**
+ [API operations defined by AWS Network Security Manager](#list_network-security-manager-operations)
+ [Actions defined by AWS Network Security Manager](#list_network-security-manager-actions-as-permissions)
+ [Resource types defined by AWS Network Security Manager](#list_network-security-manager-resources-for-iam-policies)
+ [Condition keys for AWS Network Security Manager](#list_network-security-manager-policy-keys)

## API operations defined by AWS Network Security Manager
<a name="list_network-security-manager-operations"></a>

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the [Actions table](#list_network-security-manager-actions-as-permissions).




- **   CreateDeployment  **
  - **IAM action:**  [network-security-manager:CreateDeployment](#list_network-security-manager-action-CreateDeployment)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [network-security-manager:TagResource](#list_network-security-manager-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreateDeploymentSnapshot  **
  - **IAM action:**  [network-security-manager:CreateDeploymentSnapshot](#list_network-security-manager-action-CreateDeploymentSnapshot)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [network-security-manager:TagResource](#list_network-security-manager-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreatePolicy  **
  - **IAM action:**  [network-security-manager:CreatePolicy](#list_network-security-manager-action-CreatePolicy)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [network-security-manager:TagResource](#list_network-security-manager-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreatePolicySnapshot  **
  - **IAM action:**  [network-security-manager:CreatePolicySnapshot](#list_network-security-manager-action-CreatePolicySnapshot)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [network-security-manager:TagResource](#list_network-security-manager-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreateRule  **
  - **IAM action:**  [network-security-manager:CreateRule](#list_network-security-manager-action-CreateRule)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [network-security-manager:TagResource](#list_network-security-manager-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreateRuleSnapshot  **
  - **IAM action:**  [network-security-manager:CreateRuleSnapshot](#list_network-security-manager-action-CreateRuleSnapshot)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [network-security-manager:TagResource](#list_network-security-manager-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreateScope  **
  - **IAM action:**  [network-security-manager:CreateScope](#list_network-security-manager-action-CreateScope)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [network-security-manager:TagResource](#list_network-security-manager-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreateScopeSnapshot  **
  - **IAM action:**  [network-security-manager:CreateScopeSnapshot](#list_network-security-manager-action-CreateScopeSnapshot)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [network-security-manager:TagResource](#list_network-security-manager-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreateTemplate  **
  - **IAM action:**  [network-security-manager:CreateTemplate](#list_network-security-manager-action-CreateTemplate)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [network-security-manager:TagResource](#list_network-security-manager-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   CreateTemplateSnapshot  **
  - **IAM action:**  [network-security-manager:CreateTemplateSnapshot](#list_network-security-manager-action-CreateTemplateSnapshot)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Write
  - **IAM action:**  [network-security-manager:TagResource](#list_network-security-manager-action-TagResource)  / **Condition key:**  / **Possible value(s):**  / **Access level:** Tagging, Write

- **   DeleteAdminAccount  **
  - **IAM action:**  [network-security-manager:DeleteAdminAccount](#list_network-security-manager-action-DeleteAdminAccount) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DeleteDeployment  **
  - **IAM action:**  [network-security-manager:DeleteDeployment](#list_network-security-manager-action-DeleteDeployment) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DeletePolicy  **
  - **IAM action:**  [network-security-manager:DeletePolicy](#list_network-security-manager-action-DeletePolicy) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DeleteRule  **
  - **IAM action:**  [network-security-manager:DeleteRule](#list_network-security-manager-action-DeleteRule) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DeleteScope  **
  - **IAM action:**  [network-security-manager:DeleteScope](#list_network-security-manager-action-DeleteScope) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   DeleteTemplate  **
  - **IAM action:**  [network-security-manager:DeleteTemplate](#list_network-security-manager-action-DeleteTemplate) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   GenerateRuleConfiguration  **
  - **IAM action:**  [network-security-manager:GenerateRuleConfiguration](#list_network-security-manager-action-GenerateRuleConfiguration) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   GetAdminAccount  **
  - **IAM action:**  [network-security-manager:GetAdminAccount](#list_network-security-manager-action-GetAdminAccount) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetDeployment  **
  - **IAM action:**  [network-security-manager:GetDeployment](#list_network-security-manager-action-GetDeployment) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetPolicy  **
  - **IAM action:**  [network-security-manager:GetPolicy](#list_network-security-manager-action-GetPolicy) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetRule  **
  - **IAM action:**  [network-security-manager:GetRule](#list_network-security-manager-action-GetRule) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetScope  **
  - **IAM action:**  [network-security-manager:GetScope](#list_network-security-manager-action-GetScope) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   GetTemplate  **
  - **IAM action:**  [network-security-manager:GetTemplate](#list_network-security-manager-action-GetTemplate) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListAdminAccounts  **
  - **IAM action:**  [network-security-manager:ListAdminAccounts](#list_network-security-manager-action-ListAdminAccounts) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** List

- **   ListAggregateResourceSynchronizationStatuses  **
  - **IAM action:**  [network-security-manager:ListAggregateResourceSynchronizationStatuses](#list_network-security-manager-action-ListAggregateResourceSynchronizationStatuses) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListDeploymentSnapshots  **
  - **IAM action:**  [network-security-manager:ListDeploymentSnapshots](#list_network-security-manager-action-ListDeploymentSnapshots) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListDeployments  **
  - **IAM action:**  [network-security-manager:ListDeployments](#list_network-security-manager-action-ListDeployments) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** List

- **   ListPolicies  **
  - **IAM action:**  [network-security-manager:ListPolicies](#list_network-security-manager-action-ListPolicies) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** List

- **   ListPolicySnapshots  **
  - **IAM action:**  [network-security-manager:ListPolicySnapshots](#list_network-security-manager-action-ListPolicySnapshots) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListResourceAssociations  **
  - **IAM action:**  [network-security-manager:ListResourceAssociations](#list_network-security-manager-action-ListResourceAssociations) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListResourceSynchronizationStatuses  **
  - **IAM action:**  [network-security-manager:ListResourceSynchronizationStatuses](#list_network-security-manager-action-ListResourceSynchronizationStatuses) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListRuleSnapshots  **
  - **IAM action:**  [network-security-manager:ListRuleSnapshots](#list_network-security-manager-action-ListRuleSnapshots) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListRules  **
  - **IAM action:**  [network-security-manager:ListRules](#list_network-security-manager-action-ListRules) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** List

- **   ListScopeSnapshots  **
  - **IAM action:**  [network-security-manager:ListScopeSnapshots](#list_network-security-manager-action-ListScopeSnapshots) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListScopes  **
  - **IAM action:**  [network-security-manager:ListScopes](#list_network-security-manager-action-ListScopes) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** List

- **   ListTagsForResource  **
  - **IAM action:**  [network-security-manager:ListTagsForResource](#list_network-security-manager-action-ListTagsForResource) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListTemplateSnapshots  **
  - **IAM action:**  [network-security-manager:ListTemplateSnapshots](#list_network-security-manager-action-ListTemplateSnapshots) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Read

- **   ListTemplates  **
  - **IAM action:**  [network-security-manager:ListTemplates](#list_network-security-manager-action-ListTemplates) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** List

- **   PutAdminAccount  **
  - **IAM action:**  [network-security-manager:PutAdminAccount](#list_network-security-manager-action-PutAdminAccount) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   TagResource  **
  - **IAM action:**  [network-security-manager:TagResource](#list_network-security-manager-action-TagResource) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Tagging, Write

- **   UntagResource  **
  - **IAM action:**  [network-security-manager:UntagResource](#list_network-security-manager-action-UntagResource) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Tagging, Write

- **   UpdateDeployment  **
  - **IAM action:**  [network-security-manager:UpdateDeployment](#list_network-security-manager-action-UpdateDeployment) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   UpdatePolicy  **
  - **IAM action:**  [network-security-manager:UpdatePolicy](#list_network-security-manager-action-UpdatePolicy) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   UpdateRule  **
  - **IAM action:**  [network-security-manager:UpdateRule](#list_network-security-manager-action-UpdateRule) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   UpdateScope  **
  - **IAM action:**  [network-security-manager:UpdateScope](#list_network-security-manager-action-UpdateScope) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write

- **   UpdateTemplate  **
  - **IAM action:**  [network-security-manager:UpdateTemplate](#list_network-security-manager-action-UpdateTemplate) 
  - **Condition key:** 
  - **Possible value(s):** 
  - **Access level:** Write



## Actions defined by AWS Network Security Manager
<a name="list_network-security-manager-actions-as-permissions"></a>

You can specify the following actions in the `Action` element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.




- **   [CreateDeployment](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateDeployment.html)  **
  - **Description:** Grants permission to create a deployment
  - **Resource types (\*required):** [policy\*](#list_network-security-manager-resource-policy) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [policy-snapshot\*](#list_network-security-manager-resource-policy-snapshot) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [scope\*](#list_network-security-manager-resource-scope) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [scope-snapshot\*](#list_network-security-manager-resource-scope-snapshot) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Access level:** Write

- **   [CreateDeploymentSnapshot](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateDeploymentSnapshot.html)  **
  - **Description:** Grants permission to create a snapshot of a deployment
  - **Resource types (\*required):** [deployment\*](#list_network-security-manager-resource-deployment)
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Access level:** Write

- **   [CreatePolicy](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreatePolicy.html)  **
  - **Description:** Grants permission to create a policy
  - **Resource types (\*required):** [rule](#list_network-security-manager-resource-rule) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [rule-snapshot](#list_network-security-manager-resource-rule-snapshot) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [template](#list_network-security-manager-resource-template) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [template-snapshot](#list_network-security-manager-resource-template-snapshot) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Access level:** Write

- **   [CreatePolicySnapshot](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreatePolicySnapshot.html)  **
  - **Description:** Grants permission to create a snapshot of a policy
  - **Resource types (\*required):** [policy\*](#list_network-security-manager-resource-policy)
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Access level:** Write

- **   [CreateRule](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateRule.html)  **
  - **Description:** Grants permission to create a rule
  - **Resource types (\*required):** 
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Access level:** Write

- **   [CreateRuleSnapshot](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateRuleSnapshot.html)  **
  - **Description:** Grants permission to create a snapshot of a rule
  - **Resource types (\*required):** [rule\*](#list_network-security-manager-resource-rule)
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Access level:** Write

- **   [CreateScope](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateScope.html)  **
  - **Description:** Grants permission to create a scope
  - **Resource types (\*required):** 
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Access level:** Write

- **   [CreateScopeSnapshot](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateScopeSnapshot.html)  **
  - **Description:** Grants permission to create a snapshot of a scope
  - **Resource types (\*required):** [scope\*](#list_network-security-manager-resource-scope)
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Access level:** Write

- **   [CreateTemplate](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateTemplate.html)  **
  - **Description:** Grants permission to create a template
  - **Resource types (\*required):** [rule\*](#list_network-security-manager-resource-rule) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [rule-snapshot\*](#list_network-security-manager-resource-rule-snapshot) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Access level:** Write

- **   [CreateTemplateSnapshot](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateTemplateSnapshot.html)  **
  - **Description:** Grants permission to create a snapshot of a template
  - **Resource types (\*required):** [template\*](#list_network-security-manager-resource-template)
  - **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Access level:** Write

- **   [DeleteAdminAccount](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_DeleteAdminAccount.html)  **
  - **Description:** Grants permission to remove a Network Security Manager administrator account
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Write

- **   [DeleteDeployment](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_DeleteDeployment.html)  **
  - **Description:** Grants permission to delete a deployment
  - **Resource types (\*required):** [deployment\*](#list_network-security-manager-resource-deployment) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [deployment-snapshot\*](#list_network-security-manager-resource-deployment-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DeletePolicy](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_DeletePolicy.html)  **
  - **Description:** Grants permission to delete a policy
  - **Resource types (\*required):** [policy\*](#list_network-security-manager-resource-policy) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [policy-snapshot\*](#list_network-security-manager-resource-policy-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DeleteRule](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_DeleteRule.html)  **
  - **Description:** Grants permission to delete a rule
  - **Resource types (\*required):** [rule\*](#list_network-security-manager-resource-rule) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [rule-snapshot\*](#list_network-security-manager-resource-rule-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DeleteScope](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_DeleteScope.html)  **
  - **Description:** Grants permission to delete a scope
  - **Resource types (\*required):** [scope\*](#list_network-security-manager-resource-scope) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [scope-snapshot\*](#list_network-security-manager-resource-scope-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [DeleteTemplate](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_DeleteTemplate.html)  **
  - **Description:** Grants permission to delete a template
  - **Resource types (\*required):** [template\*](#list_network-security-manager-resource-template) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [template-snapshot\*](#list_network-security-manager-resource-template-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [GenerateRuleConfiguration](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_GenerateRuleConfiguration.html)  **
  - **Description:** Grants permission to generate a rule configuration from a natural-language prompt
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Write

- **   [GetAdminAccount](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_GetAdminAccount.html)  **
  - **Description:** Grants permission to retrieve a Network Security Manager administrator account
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Read

- **   [GetDeployment](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_GetDeployment.html)  **
  - **Description:** Grants permission to retrieve a deployment
  - **Resource types (\*required):** [deployment\*](#list_network-security-manager-resource-deployment) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [deployment-snapshot\*](#list_network-security-manager-resource-deployment-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetPolicy](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_GetPolicy.html)  **
  - **Description:** Grants permission to retrieve a policy
  - **Resource types (\*required):** [policy\*](#list_network-security-manager-resource-policy) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [policy-snapshot\*](#list_network-security-manager-resource-policy-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetRule](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_GetRule.html)  **
  - **Description:** Grants permission to retrieve a rule
  - **Resource types (\*required):** [rule\*](#list_network-security-manager-resource-rule) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [rule-snapshot\*](#list_network-security-manager-resource-rule-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetScope](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_GetScope.html)  **
  - **Description:** Grants permission to retrieve a scope
  - **Resource types (\*required):** [scope\*](#list_network-security-manager-resource-scope) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [scope-snapshot\*](#list_network-security-manager-resource-scope-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [GetTemplate](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_GetTemplate.html)  **
  - **Description:** Grants permission to retrieve a template
  - **Resource types (\*required):** [template\*](#list_network-security-manager-resource-template) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [template-snapshot\*](#list_network-security-manager-resource-template-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [ListAdminAccounts](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_ListAdminAccounts.html)  **
  - **Description:** Grants permission to list Network Security Manager administrator accounts
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** List

- **   [ListAggregateResourceSynchronizationStatuses](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_ListAggregateResourceSynchronizationStatuses.html)  **
  - **Description:** Grants permission to list aggregate resource synchronization statuses across the caller's deployments
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Read

- **   [ListDeploymentSnapshots](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_ListDeploymentSnapshots.html)  **
  - **Description:** Grants permission to list the snapshots of a deployment
  - **Resource types (\*required):** [deployment\*](#list_network-security-manager-resource-deployment)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [ListDeployments](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_ListDeployments.html)  **
  - **Description:** Grants permission to list deployments
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** List

- **   [ListPolicies](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_ListPolicies.html)  **
  - **Description:** Grants permission to list policies
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** List

- **   [ListPolicySnapshots](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_ListPolicySnapshots.html)  **
  - **Description:** Grants permission to list the snapshots of a policy
  - **Resource types (\*required):** [policy\*](#list_network-security-manager-resource-policy)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [ListResourceAssociations](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_ListResourceAssociations.html)  **
  - **Description:** Grants permission to list the associations of a Network Security Manager resource
  - **Resource types (\*required):** [deployment\*](#list_network-security-manager-resource-deployment) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [deployment-snapshot\*](#list_network-security-manager-resource-deployment-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [policy\*](#list_network-security-manager-resource-policy) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [policy-snapshot\*](#list_network-security-manager-resource-policy-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [rule\*](#list_network-security-manager-resource-rule) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [rule-snapshot\*](#list_network-security-manager-resource-rule-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [scope\*](#list_network-security-manager-resource-scope) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [scope-snapshot\*](#list_network-security-manager-resource-scope-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [template\*](#list_network-security-manager-resource-template) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [template-snapshot\*](#list_network-security-manager-resource-template-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [ListResourceSynchronizationStatuses](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_ListResourceSynchronizationStatuses.html)  **
  - **Description:** Grants permission to list resource synchronization statuses for a deployment
  - **Resource types (\*required):** [deployment\*](#list_network-security-manager-resource-deployment) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [deployment-snapshot\*](#list_network-security-manager-resource-deployment-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [ListRuleSnapshots](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_ListRuleSnapshots.html)  **
  - **Description:** Grants permission to list the snapshots of a rule
  - **Resource types (\*required):** [rule\*](#list_network-security-manager-resource-rule)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [ListRules](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_ListRules.html)  **
  - **Description:** Grants permission to list rules
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** List

- **   [ListScopeSnapshots](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_ListScopeSnapshots.html)  **
  - **Description:** Grants permission to list the snapshots of a scope
  - **Resource types (\*required):** [scope\*](#list_network-security-manager-resource-scope)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [ListScopes](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_ListScopes.html)  **
  - **Description:** Grants permission to list scopes
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** List

- **   [ListTagsForResource](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_ListTagsForResource.html)  **
  - **Description:** Grants permission to list the tags of a Network Security Manager resource
  - **Resource types (\*required):** [deployment](#list_network-security-manager-resource-deployment) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [deployment-snapshot](#list_network-security-manager-resource-deployment-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [policy](#list_network-security-manager-resource-policy) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [policy-snapshot](#list_network-security-manager-resource-policy-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [rule](#list_network-security-manager-resource-rule) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [rule-snapshot](#list_network-security-manager-resource-rule-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [scope](#list_network-security-manager-resource-scope) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [scope-snapshot](#list_network-security-manager-resource-scope-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [template](#list_network-security-manager-resource-template) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [template-snapshot](#list_network-security-manager-resource-template-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [ListTemplateSnapshots](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_ListTemplateSnapshots.html)  **
  - **Description:** Grants permission to list the snapshots of a template
  - **Resource types (\*required):** [template\*](#list_network-security-manager-resource-template)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Read

- **   [ListTemplates](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_ListTemplates.html)  **
  - **Description:** Grants permission to list templates
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** List

- **   [PutAdminAccount](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_PutAdminAccount.html)  **
  - **Description:** Grants permission to set a Network Security Manager administrator account
  - **Resource types (\*required):** 
  - **Condition keys:**  
  - **Access level:** Write

- **   [TagResource](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_TagResource.html)  **
  - **Description:** Grants permission to add or overwrite tags on a Network Security Manager resource
  - **Resource types (\*required):** [deployment](#list_network-security-manager-resource-deployment) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [deployment-snapshot](#list_network-security-manager-resource-deployment-snapshot) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [policy](#list_network-security-manager-resource-policy) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [policy-snapshot](#list_network-security-manager-resource-policy-snapshot) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [rule](#list_network-security-manager-resource-rule) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [rule-snapshot](#list_network-security-manager-resource-rule-snapshot) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [scope](#list_network-security-manager-resource-scope) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [scope-snapshot](#list_network-security-manager-resource-scope-snapshot) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [template](#list_network-security-manager-resource-template) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [template-snapshot](#list_network-security-manager-resource-template-snapshot) / **Condition keys:** [aws:RequestTag/${TagKey}](#list_network-security-manager-aws_RequestTag___TagKey_)<br />[aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Access level:** Tagging, Write

- **   [UntagResource](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_UntagResource.html)  **
  - **Description:** Grants permission to remove tags from a Network Security Manager resource
  - **Resource types (\*required):** [deployment](#list_network-security-manager-resource-deployment) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [deployment-snapshot](#list_network-security-manager-resource-deployment-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [policy](#list_network-security-manager-resource-policy) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [policy-snapshot](#list_network-security-manager-resource-policy-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [rule](#list_network-security-manager-resource-rule) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [rule-snapshot](#list_network-security-manager-resource-rule-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [scope](#list_network-security-manager-resource-scope) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [scope-snapshot](#list_network-security-manager-resource-scope-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [template](#list_network-security-manager-resource-template) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Resource types (\*required):** [template-snapshot](#list_network-security-manager-resource-template-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)<br />[aws:TagKeys](#list_network-security-manager-aws_TagKeys)
  - **Access level:** Tagging, Write

- **   [UpdateDeployment](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_UpdateDeployment.html)  **
  - **Description:** Grants permission to update a deployment
  - **Resource types (\*required):** [deployment\*](#list_network-security-manager-resource-deployment) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [policy](#list_network-security-manager-resource-policy) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [policy-snapshot](#list_network-security-manager-resource-policy-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [scope](#list_network-security-manager-resource-scope) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [scope-snapshot](#list_network-security-manager-resource-scope-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [UpdatePolicy](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_UpdatePolicy.html)  **
  - **Description:** Grants permission to update a policy
  - **Resource types (\*required):** [policy\*](#list_network-security-manager-resource-policy) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [rule](#list_network-security-manager-resource-rule) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [rule-snapshot](#list_network-security-manager-resource-rule-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [template](#list_network-security-manager-resource-template) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [template-snapshot](#list_network-security-manager-resource-template-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [UpdateRule](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_UpdateRule.html)  **
  - **Description:** Grants permission to update a rule
  - **Resource types (\*required):** [rule\*](#list_network-security-manager-resource-rule)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [UpdateScope](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_UpdateScope.html)  **
  - **Description:** Grants permission to update a scope
  - **Resource types (\*required):** [scope\*](#list_network-security-manager-resource-scope)
  - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Write

- **   [UpdateTemplate](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_UpdateTemplate.html)  **
  - **Description:** Grants permission to update a template
  - **Resource types (\*required):** [rule](#list_network-security-manager-resource-rule) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [rule-snapshot](#list_network-security-manager-resource-rule-snapshot) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Resource types (\*required):** [template\*](#list_network-security-manager-resource-template) / **Condition keys:** [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_)
  - **Access level:** Write



## Resource types defined by AWS Network Security Manager
<a name="list_network-security-manager-resources-for-iam-policies"></a>

The following resource types are defined by this service and can be used in the `Resource` element of IAM permission policy statements.



| Resource types | ARN | Condition keys | 
| --- | --- | --- | 
|  [deployment](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateDeployment.html)  | arn:${Partition}:network-security-manager:${Region}:${Account}:deployment:${DeploymentId} | [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_) | 
|  [deployment-snapshot](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateDeployment.html)  | arn:${Partition}:network-security-manager:${Region}:${Account}:deployment:${DeploymentId}:${VersionNumber} | [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_) | 
|  [policy](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreatePolicy.html)  | arn:${Partition}:network-security-manager:${Region}:${Account}:policy:${PolicyId} | [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_) | 
|  [policy-snapshot](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreatePolicySnapshot.html)  | arn:${Partition}:network-security-manager:${Region}:${Account}:policy:${PolicyId}:${VersionNumber} | [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_) | 
|  [rule](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateRule.html)  | arn:${Partition}:network-security-manager:${Region}:${Account}:rule:${RuleId} | [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_) | 
|  [rule-snapshot](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateRuleSnapshot.html)  | arn:${Partition}:network-security-manager:${Region}:${Account}:rule:${RuleId}:${VersionNumber} | [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_) | 
|  [scope](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateScope.html)  | arn:${Partition}:network-security-manager:${Region}:${Account}:scope:${ScopeId} | [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_) | 
|  [scope-snapshot](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateScopeSnapshot.html)  | arn:${Partition}:network-security-manager:${Region}:${Account}:scope:${ScopeId}:${VersionNumber} | [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_) | 
|  [template](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateTemplate.html)  | arn:${Partition}:network-security-manager:${Region}:${Account}:template:${TemplateId} | [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_) | 
|  [template-snapshot](https://docs.aws.amazon.com/network-security-manager/latest/APIReference/API_CreateTemplateSnapshot.html)  | arn:${Partition}:network-security-manager:${Region}:${Account}:template:${TemplateId}:${VersionNumber} | [aws:ResourceTag/${TagKey}](#list_network-security-manager-aws_ResourceTag___TagKey_) | 

## Condition keys for AWS Network Security Manager
<a name="list_network-security-manager-policy-keys"></a>

AWS Network Security Manager defines the following condition keys that can be used in the `Condition` element of an IAM policy.



| Condition keys | Description | Type | 
| --- | --- | --- | 
|   [aws:RequestTag/${TagKey}](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requesttag)  | Filters access by the tags that are passed in the request | String | 
|   [aws:ResourceTag/${TagKey}](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag)  | Filters access by the tags associated with the resource | String | 
|   [aws:TagKeys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-tagkeys)  | Filters access by the tag keys that are passed in the request | ArrayOfString |