Actions, resources, and condition keys for AWS services
Each AWS service can define actions, resources, and condition context keys for use in IAM policies. This topic describes how the elements provided for each service are documented.
Each topic consists of tables that provide the list of available actions, resources, and condition keys.
The actions table
The Actions table lists all the actions that you can use in an IAM policy statement's
Action
element. Not all API operations that are defined by a service can be used
as an action in an IAM policy. In addition, a service might define some
actions that don't directly correspond to an API operation. Use this list
to determine which actions you can use in an IAM policy. For more information
about the Action
, Resource
, or Condition
elements, see IAM JSON policy elements reference. The Actions and Description table columns are self-descriptive.
-
The Access level column describes how the action is classified (List, Read, Write, Permissions management, or Tagging). This classification can help you understand the level of access that an action grants when you use it in a policy. For more information about access levels, see Understanding access level summaries within policy summaries.
-
The Resource types column indicates whether the action supports resource-level permissions. If the column is empty, then the action does not support resource-level permissions and you must specify all resources ("*") in your policy. If the column includes a resource type, then you can specify the resource ARN in the
Resource
element of your policy. For more information about that resource, refer to that row in the Resource types table. All actions and resources that are included in one statement must be compatible with each other. If you specify a resource that is not valid for the action, any request to use that action fails, and the statement'sEffect
does not apply.Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.
-
The Condition keys column includes keys that you can specify in a policy statement's
Condition
element. Condition keys might be supported with an action, or with an action and a specific resource. Pay close attention to whether the key is in the same row as a specific resource type. This table does not include global condition keys that are available for any action or under unrelated circumstances. For more information about global condition keys, see AWS global condition context keys. -
The Dependent actions column includes any additional permissions that you must have, in addition to the permission for the action itself, to successfully call the action. This can be required if the action accesses more than one resource.
The resource types table
The Resource types table lists all the resource types that you can specify as an ARN in the
Resource
policy element. Not every resource type can be specified with every action.
Some resource types work with only certain actions. If you specify a resource
type in a statement with an action that does not support that resource
type, then the statement doesn't allow access. For more information about
the Resource
element, see IAM JSON policy elements: Resource.
-
The ARN column specifies the Amazon Resource Name (ARN) format that you must use to reference resources of this type. The portions that are preceded by a $ must be replaced by the actual values for your scenario. For example, if you see
$user-name
in an ARN, you must replace that string with either the actual IAM user's name or a policy variable that contains an IAM user's name. For more information about ARNs, see IAM ARNs. -
The Condition keys column specifies condition context keys that you can include in an IAM policy statement only when both this resource and a supporting action from the table above are included in the statement.
The condition keys table
The condition keys table lists all of the condition context keys that you can use in an IAM
policy statement's Condition
element. Not every key can be specified with every action or resource.
Certain keys only work with certain types of actions and resources. For
more information about the Condition
element, see IAM JSON policy elements: Condition.
-
The Type column specifies the data type of the condition key. This data type determines which condition operators you can use to compare values in the request with the values in the policy statement. You must use an operator that is appropriate for the data type. If you use an incorrect operator, then the match always fails and the policy statement never applies.
If the Type column specifies a "List of …" one of the simple types, then you can use multiple keys and values in your policies. Do this using condition set prefixes with your operators. Use the
ForAllValues
prefix to specify that all values in the request must match a value in the policy statement. Use theForAnyValue
prefix to specify that at least one value in the request matches one of the values in the policy statement.
Topics
- AWS Accounts
- AWS Activate
- Alexa for Business
- AWS Amplify
- AWS Amplify Admin
- Amazon API Gateway
- AWS App Mesh
- AWS App Mesh Preview
- AWS AppConfig
- Amazon AppFlow
- Amazon AppIntegrations
- Application Auto Scaling
- Application Discovery
- Application Discovery Arsenal
- Amazon AppStream 2.0
- AWS AppSync
- AWS Artifact
- Amazon Athena
- AWS Audit Manager
- AWS Auto Scaling
- AWS Backup
- AWS Backup storage
- AWS Batch
- AWS Billing
- Amazon Braket
- AWS Budget Service
- AWS Certificate Manager
- AWS Certificate Manager Private Certificate Authority
- AWS Chatbot
- Amazon Chime
- Amazon Cloud Directory
- AWS Cloud Map
- AWS Cloud9
- AWS CloudFormation
- Amazon CloudFront
- AWS CloudHSM
- Amazon CloudSearch
- AWS CloudShell
- AWS CloudTrail
- Amazon CloudWatch
- CloudWatch Application Insights
- Amazon CloudWatch Logs
- Amazon CloudWatch Synthetics
- AWS CodeArtifact
- AWS CodeBuild
- AWS CodeCommit
- AWS CodeDeploy
- Amazon CodeGuru
- Amazon CodeGuru Profiler
- Amazon CodeGuru Reviewer
- AWS CodePipeline
- AWS CodeStar
- AWS CodeStar Connections
- AWS CodeStar Notifications
- Amazon Cognito Identity
- Amazon Cognito Sync
- Amazon Cognito User Pools
- Amazon Comprehend
- Amazon Comprehend Medical
- AWS Compute Optimizer
- AWS Config
- Amazon Connect
- Amazon Connect Customer Profiles
- AWS Connector Service
- AWS Cost and Usage Report
- AWS Cost Explorer Service
- AWS Data Exchange
- Amazon Data Lifecycle Manager
- Data Pipeline
- AWS Database Migration Service
- Database Query Metadata Service
- DataSync
- AWS DeepComposer
- AWS DeepLens
- AWS DeepRacer
- Amazon Detective
- AWS Device Farm
- Amazon DevOps Guru
- AWS Direct Connect
- AWS Directory Service
- Amazon DynamoDB
- Amazon DynamoDB Accelerator (DAX)
- Amazon EC2
- Amazon EC2 Auto Scaling
- Amazon EC2 Image Builder
- Amazon EC2 Instance Connect
- AWS Elastic Beanstalk
- Amazon Elastic Block Store
- Amazon Elastic Container Registry
- Amazon Elastic Container Registry Public
- Amazon Elastic Container Service
- Amazon Elastic Container Service for Kubernetes
- Amazon Elastic File System
- Amazon Elastic Inference
- Elastic Load Balancing
- Elastic Load Balancing V2
- Amazon Elastic MapReduce
- Amazon Elastic Transcoder
- Amazon ElastiCache
- Amazon Elasticsearch Service
- AWS Elemental Appliances and Software
- AWS Elemental Appliances and Software Activation Service
- AWS Elemental MediaConnect
- AWS Elemental MediaConvert
- AWS Elemental MediaLive
- AWS Elemental MediaPackage
- AWS Elemental MediaPackage VOD
- AWS Elemental MediaStore
- AWS Elemental MediaTailor
- Elemental Support Cases
- Elemental Support Content
- Amazon EMR on EKS (EMR Containers)
- Amazon EventBridge
- Amazon EventBridge Schemas
- AWS Firewall Manager
- Fleet Hub for AWS IoT Device Management
- Amazon Forecast
- Amazon Fraud Detector
- Amazon FreeRTOS
- Amazon FSx
- Amazon GameLift
- Amazon Glacier
- AWS Global Accelerator
- AWS Glue
- AWS Glue DataBrew
- AWS Ground Station
- Amazon GroundTruth Labeling
- Amazon GuardDuty
- AWS Health APIs and Notifications
- Amazon Honeycode
- IAM Access Analyzer
- Identity And Access Management
- AWS Identity Store
- AWS Import Export Disk Service
- Amazon Inspector
- Amazon Interactive Video Service
- AWS IoT
- AWS IoT 1-Click
- AWS IoT Analytics
- AWS IoT Core Device Advisor
- AWS IoT Core for LoRaWAN
- AWS IoT Device Tester
- AWS IoT Events
- AWS IoT Greengrass
- AWS IoT Greengrass V2
- AWS IoT SiteWise
- AWS IoT Things Graph
- AWS IQ
- AWS IQ Permissions
- Amazon Kendra
- AWS Key Management Service
- Amazon Keyspaces (for Apache Cassandra)
- Amazon Kinesis
- Amazon Kinesis Analytics
- Amazon Kinesis Analytics V2
- Amazon Kinesis Firehose
- Amazon Kinesis Video Streams
- AWS Lake Formation
- AWS Lambda
- Launch Wizard
- Amazon Lex
- Amazon Lex V2
- AWS License Manager
- Amazon Lightsail
- Amazon Location
- Amazon Lookout for Equipment
- Amazon Lookout for Metrics
- Amazon Lookout for Vision
- Amazon Machine Learning
- Amazon Macie
- Amazon Macie Classic
- Manage Amazon API Gateway
- Amazon Managed Blockchain
- Amazon Managed Service for Grafana
- Amazon Managed Service for Prometheus
- Amazon Managed Streaming for Apache Kafka
- Amazon Managed Workflows for Apache Airflow
- AWS Marketplace
- AWS Marketplace Catalog
- AWS Marketplace Commerce Analytics Service
- AWS Marketplace Entitlement Service
- AWS Marketplace Image Building Service
- AWS Marketplace Management Portal
- AWS Marketplace Metering Service
- AWS Marketplace Procurement Systems Integration
- Amazon Mechanical Turk
- Amazon Message Delivery Service
- AWS Migration Hub
- Amazon Mobile Analytics
- AWS Mobile Hub
- Amazon Monitron
- Amazon MQ
- Amazon Neptune
- AWS Network Firewall
- Network Manager
- AWS OpsWorks
- AWS OpsWorks Configuration Management
- AWS Organizations
- AWS Outposts
- AWS Panorama
- AWS Performance Insights
- Amazon Personalize
- Amazon Pinpoint
- Amazon Pinpoint Email Service
- Amazon Pinpoint SMS and Voice Service
- Amazon Polly
- AWS Price List
- AWS Private Marketplace
- AWS Proton
- AWS Purchase Orders Console
- Amazon QLDB
- Amazon QuickSight
- Amazon RDS
- Amazon RDS Data API
- Amazon RDS IAM Authentication
- Amazon Redshift
- Amazon Redshift Data API
- Amazon Rekognition
- AWS Resource Access Manager
- Amazon Resource Group Tagging API
- AWS Resource Groups
- AWS RoboMaker
- Amazon Route 53
- Amazon Route 53 Resolver
- Amazon Route53 Domains
- Amazon S3
- Amazon S3 on Outposts
- Amazon SageMaker
- AWS Savings Plans
- AWS Secrets Manager
- AWS Security Hub
- AWS Security Token Service
- AWS Server Migration Service
- AWS Serverless Application Repository
- AWS Service Catalog
- Service Quotas
- Amazon SES
- Amazon Session Manager Message Gateway Service
- AWS Shield
- AWS Signer
- Amazon Simple Workflow Service
- Amazon SimpleDB
- AWS Snowball
- Amazon SNS
- Amazon SQS
- AWS SSO
- AWS SSO Directory
- AWS Step Functions
- Amazon Storage Gateway
- Amazon Sumerian
- AWS Support
- AWS Systems Manager
- AWS Tag Editor
- Amazon Textract
- Amazon Timestream
- AWS Tiros
- Amazon Transcribe
- AWS Transfer for SFTP
- Amazon Translate
- AWS Trusted Advisor
- AWS WAF
- AWS WAF Regional
- AWS WAF V2
- AWS Well-Architected Tool
- Amazon WorkDocs
- Amazon WorkLink
- Amazon WorkMail
- Amazon WorkMail Message Flow
- Amazon WorkSpaces
- Amazon WorkSpaces Application Manager
- AWS X-Ray