Actions, resources, and condition keys for AWS Storage Gateway

AWS Storage Gateway (service prefix: storagegateway) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

• Learn how to configure this service.

• View a list of the API operations available for this service.

• Learn how to secure this service and its resources by using IAM permission policies.

• View the programmatic service authorization reference for this service.

API operations defined by AWS Storage Gateway

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
ActivateGateway	storagegateway:ActivateGateway			Write
	storagegateway:AddTagsToResource			Tagging, Write
AddCache	storagegateway:AddCache			Write
AddTagsToResource	storagegateway:AddTagsToResource			Tagging, Write
AddUploadBuffer	storagegateway:AddUploadBuffer			Write
AddWorkingStorage	storagegateway:AddWorkingStorage			Write
AssignTapePool	storagegateway:AssignTapePool			Write
	storagegateway:BypassGovernanceRetention			Write
AssociateFileSystem	storagegateway:AddTagsToResource			Tagging, Write
	storagegateway:AssociateFileSystem			Write
AttachVolume	storagegateway:AttachVolume			Write
CancelArchival	storagegateway:CancelArchival			Write
CancelCacheReport	storagegateway:CancelCacheReport			Write
CancelRetrieval	storagegateway:CancelRetrieval			Write
CreateCachediSCSIVolume	storagegateway:AddTagsToResource			Tagging, Write
	storagegateway:CreateCachediSCSIVolume			Write
CreateNFSFileShare	storagegateway:AddTagsToResource			Tagging, Write
	storagegateway:CreateNFSFileShare			Write
	iam:PassRole			Write
CreateSMBFileShare	storagegateway:AddTagsToResource			Tagging, Write
	storagegateway:CreateSMBFileShare			Write
	iam:PassRole			Write
CreateSnapshot	storagegateway:CreateSnapshot			Write
CreateSnapshotFromVolumeRecoveryPoint	storagegateway:CreateSnapshotFromVolumeRecoveryPoint			Write
CreateStorediSCSIVolume	storagegateway:AddTagsToResource			Tagging, Write
	storagegateway:CreateStorediSCSIVolume			Write
CreateTapePool	storagegateway:AddTagsToResource			Tagging, Write
	storagegateway:CreateTapePool			Write
CreateTapeWithBarcode	storagegateway:AddTagsToResource			Tagging, Write
	storagegateway:CreateTapeWithBarcode			Write
CreateTapes	storagegateway:AddTagsToResource			Tagging, Write
	storagegateway:CreateTapes			Write
DeleteAutomaticTapeCreationPolicy	storagegateway:DeleteAutomaticTapeCreationPolicy			Write
DeleteBandwidthRateLimit	storagegateway:DeleteBandwidthRateLimit			Write
DeleteCacheReport	storagegateway:DeleteCacheReport			Write
DeleteChapCredentials	storagegateway:DeleteChapCredentials			Write
DeleteFileShare	storagegateway:DeleteFileShare			Write
DeleteGateway	storagegateway:DeleteGateway			Write
DeleteSnapshotSchedule	storagegateway:DeleteSnapshotSchedule			Write
DeleteTape	storagegateway:DeleteTape			Write
DeleteTapeArchive	storagegateway:BypassGovernanceRetention			Write
	storagegateway:DeleteTapeArchive			Write
DeleteTapePool	storagegateway:DeleteTapePool			Write
DeleteVolume	storagegateway:DeleteVolume			Write
DescribeAvailabilityMonitorTest	storagegateway:DescribeAvailabilityMonitorTest			Read
DescribeBandwidthRateLimit	storagegateway:DescribeBandwidthRateLimit			Read
DescribeBandwidthRateLimitSchedule	storagegateway:DescribeBandwidthRateLimitSchedule			Read
DescribeCache	storagegateway:DescribeCache			Read
DescribeCacheReport	storagegateway:DescribeCacheReport			Read
DescribeCachediSCSIVolumes	storagegateway:DescribeCachediSCSIVolumes			Read
DescribeChapCredentials	storagegateway:DescribeChapCredentials			Read
DescribeFileSystemAssociations	storagegateway:DescribeFileSystemAssociations			Read
DescribeGatewayInformation	storagegateway:DescribeGatewayInformation			Read
DescribeMaintenanceStartTime	storagegateway:DescribeMaintenanceStartTime			Read
DescribeNFSFileShares	storagegateway:DescribeNFSFileShares			Read
DescribeSMBFileShares	storagegateway:DescribeSMBFileShares			Read
DescribeSMBSettings	storagegateway:DescribeSMBSettings			Read
DescribeSnapshotSchedule	storagegateway:DescribeSnapshotSchedule			Read
DescribeStorediSCSIVolumes	storagegateway:DescribeStorediSCSIVolumes			Read
DescribeTapeArchives	storagegateway:DescribeTapeArchives			Read
DescribeTapeRecoveryPoints	storagegateway:DescribeTapeRecoveryPoints			Read
DescribeTapes	storagegateway:DescribeTapes			Read
DescribeUploadBuffer	storagegateway:DescribeUploadBuffer			Read
DescribeVTLDevices	storagegateway:DescribeVTLDevices			Read
DescribeWorkingStorage	storagegateway:DescribeWorkingStorage			Read
DetachVolume	storagegateway:DetachVolume			Write
DisableGateway	storagegateway:DisableGateway			Write
DisassociateFileSystem	storagegateway:DisassociateFileSystem			Write
EvictFilesFailingUpload	storagegateway:EvictFilesFailingUpload			Write
JoinDomain	storagegateway:JoinDomain			Write
ListAutomaticTapeCreationPolicies	storagegateway:ListAutomaticTapeCreationPolicies			List
ListCacheReports	storagegateway:ListCacheReports			List
ListFileShares	storagegateway:ListFileShares			List
ListFileSystemAssociations	storagegateway:ListFileSystemAssociations			List
ListGateways	storagegateway:ListGateways			List
ListLocalDisks	storagegateway:ListLocalDisks			List
ListTagsForResource	storagegateway:ListTagsForResource			List
ListTapePools	storagegateway:ListTapePools			List
ListTapes	storagegateway:ListTapes			List
ListVolumeInitiators	storagegateway:ListVolumeInitiators			List
ListVolumeRecoveryPoints	storagegateway:ListVolumeRecoveryPoints			List
ListVolumes	storagegateway:ListVolumes			List
NotifyWhenUploaded	storagegateway:NotifyWhenUploaded			Write
RefreshCache	storagegateway:RefreshCache			Write
RemoveTagsFromResource	storagegateway:RemoveTagsFromResource			Tagging, Write
ResetCache	storagegateway:ResetCache			Write
RetrieveTapeArchive	storagegateway:RetrieveTapeArchive			Write
RetrieveTapeRecoveryPoint	storagegateway:RetrieveTapeRecoveryPoint			Write
SetLocalConsolePassword	storagegateway:SetLocalConsolePassword			Write
SetSMBGuestPassword	storagegateway:SetSMBGuestPassword			Write
ShutdownGateway	storagegateway:ShutdownGateway			Write
StartAvailabilityMonitorTest	storagegateway:StartAvailabilityMonitorTest			Write
StartCacheReport	storagegateway:AddTagsToResource			Tagging, Write
	storagegateway:StartCacheReport			Write
	iam:PassRole			Write
StartGateway	storagegateway:StartGateway			Write
UpdateAutomaticTapeCreationPolicy	storagegateway:UpdateAutomaticTapeCreationPolicy			Write
UpdateBandwidthRateLimit	storagegateway:UpdateBandwidthRateLimit			Write
UpdateBandwidthRateLimitSchedule	storagegateway:UpdateBandwidthRateLimitSchedule			Write
UpdateChapCredentials	storagegateway:UpdateChapCredentials			Write
UpdateFileSystemAssociation	storagegateway:UpdateFileSystemAssociation			Write
UpdateGatewayInformation	storagegateway:UpdateGatewayInformation			Write
UpdateGatewaySoftwareNow	storagegateway:UpdateGatewaySoftwareNow			Write
UpdateMaintenanceStartTime	storagegateway:UpdateMaintenanceStartTime			Write
UpdateNFSFileShare	storagegateway:UpdateNFSFileShare			Write
UpdateSMBFileShare	storagegateway:UpdateSMBFileShare			Write
UpdateSMBFileShareVisibility	storagegateway:UpdateSMBFileShareVisibility			Write
UpdateSMBLocalGroups	storagegateway:UpdateSMBLocalGroups			Write
UpdateSMBSecurityStrategy	storagegateway:UpdateSMBSecurityStrategy			Write
UpdateSnapshotSchedule	storagegateway:UpdateSnapshotSchedule			Write
UpdateVTLDeviceType	storagegateway:UpdateVTLDeviceType			Write

Actions defined by AWS Storage Gateway

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
ActivateGateway	Grants permission to activate the gateway you previously deployed on your host		aws:RequestTag/${TagKey} aws:TagKeys	Write
AddCache	Grants permission to configure one or more gateway local disks as cache for a cached-volume gateway	gateway*	aws:ResourceTag/${TagKey}	Write
AddTagsToResource	Grants permission to add one or more tags to the specified resource	cache-report	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		fs-association	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		gateway	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		share	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		tape	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		tapepool	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		volume	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
AddUploadBuffer	Grants permission to configure one or more gateway local disks as upload buffer for a specified gateway	gateway*	aws:ResourceTag/${TagKey}	Write
AddWorkingStorage	Grants permission to configure one or more gateway local disks as working storage for a gateway	gateway*	aws:ResourceTag/${TagKey}	Write
AssignTapePool	Grants permission to move a tape to the target pool specified	tape*	aws:ResourceTag/${TagKey}	Write
		tapepool*	aws:ResourceTag/${TagKey}
AssociateFileSystem	Grants permission to associate an Amazon FSx file system with the Amazon FSx file gateway	gateway*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
AttachVolume	Grants permission to connect a volume to an iSCSI connection and then attaches the volume to the specified gateway	gateway*	aws:ResourceTag/${TagKey}	Write
		volume*	aws:ResourceTag/${TagKey}
BypassGovernanceRetention	Grants permission to allow the governance retention lock on a pool to be bypassed	tapepool*	aws:ResourceTag/${TagKey}	Write
CancelArchival	Grants permission to cancel archiving of a virtual tape to the virtual tape shelf (VTS) after the archiving process is initiated	gateway*	aws:ResourceTag/${TagKey}	Write
		tape*	aws:ResourceTag/${TagKey}
CancelCacheReport	Grants permission to cancel a cache report	cache-report*	aws:ResourceTag/${TagKey}	Write
CancelRetrieval	Grants permission to cancel retrieval of a virtual tape from the virtual tape shelf (VTS) to a gateway after the retrieval process is initiated	gateway*	aws:ResourceTag/${TagKey}	Write
		tape*	aws:ResourceTag/${TagKey}
CreateCachediSCSIVolume	Grants permission to create a cached volume on a specified cached gateway. This operation is supported only for the gateway-cached volume architecture	gateway*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		volume*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateNFSFileShare	Grants permission to create a NFS file share on an existing file gateway	gateway*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSMBFileShare	Grants permission to create a SMB file share on an existing file gateway	gateway*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSnapshot	Grants permission to initiate a snapshot of a volume	volume*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSnapshotFromVolumeRecoveryPoint	Grants permission to initiate a snapshot of a gateway from a volume recovery point	volume*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateStorediSCSIVolume	Grants permission to create a volume on a specified gateway	gateway*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTapePool	Grants permission to create a tape pool		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateTapeWithBarcode	Grants permission to create a virtual tape by using your own barcode	gateway*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		tapepool*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateTapes	Grants permission to create one or more virtual tapes. You write data to the virtual tapes and then archive the tapes	gateway*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		tapepool*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
DeleteAutomaticTapeCreationPolicy	Grants permission to delete the automatic tape creation policy configured on a gateway-VTL	gateway*	aws:ResourceTag/${TagKey}	Write
DeleteBandwidthRateLimit	Grants permission to delete the bandwidth rate limits of a gateway	gateway*	aws:ResourceTag/${TagKey}	Write
DeleteCacheReport	Grants permission to delete the metadata associated with a cache report	cache-report*	aws:ResourceTag/${TagKey}	Write
DeleteChapCredentials	Grants permission to delete Challenge-Handshake Authentication Protocol (CHAP) credentials for a specified iSCSI target and initiator pair	target*	aws:ResourceTag/${TagKey}	Write
DeleteFileShare	Grants permission to delete a file share from a file gateway	share*	aws:ResourceTag/${TagKey}	Write
DeleteGateway	Grants permission to delete a gateway	gateway*	aws:ResourceTag/${TagKey}	Write
DeleteSnapshotSchedule	Grants permission to delete a snapshot of a volume	volume*	aws:ResourceTag/${TagKey}	Write
DeleteTape	Grants permission to delete the specified virtual tape	gateway*	aws:ResourceTag/${TagKey}	Write
		tape*	aws:ResourceTag/${TagKey}
DeleteTapeArchive	Grants permission to delete the specified virtual tape from the virtual tape shelf (VTS)			Write
DeleteTapePool	Grants permission to delete the specified tape pool	tapepool*	aws:ResourceTag/${TagKey}	Write
DeleteVolume	Grants permission to delete the specified gateway volume that you previously created using the CreateCachediSCSIVolume or CreateStorediSCSIVolume API	volume*	aws:ResourceTag/${TagKey}	Write
DescribeAvailabilityMonitorTest	Grants permission to get the information about the most recent high availability monitoring test that was performed on the gateway	gateway*	aws:ResourceTag/${TagKey}	Read
DescribeBandwidthRateLimit	Grants permission to get the bandwidth rate limits of a gateway	gateway*	aws:ResourceTag/${TagKey}	Read
DescribeBandwidthRateLimitSchedule	Grants permission to get the bandwidth rate limit schedule of a gateway	gateway*	aws:ResourceTag/${TagKey}	Read
DescribeCache	Grants permission to get information about the cache of a gateway. This operation is supported only for the gateway-cached volume architecture	gateway*	aws:ResourceTag/${TagKey}	Read
DescribeCacheReport	Grants permission to get a description of a cache report	cache-report*	aws:ResourceTag/${TagKey}	Read
DescribeCachediSCSIVolumes	Grants permission to get a description of the gateway volumes specified in the request. This operation is supported only for the gateway-cached volume architecture	volume*	aws:ResourceTag/${TagKey}	Read
DescribeChapCredentials	Grants permission to get an array of Challenge-Handshake Authentication Protocol (CHAP) credentials information for a specified iSCSI target, one for each target-initiator pair	target*	aws:ResourceTag/${TagKey}	Read
DescribeFileSystemAssociations	Grants permission to get a description for one or more file system associations	fs-association*	aws:ResourceTag/${TagKey}	Read
DescribeGatewayInformation	Grants permission to get metadata about a gateway such as its name, network interfaces, configured time zone, and the state (whether the gateway is running or not)	gateway*	aws:ResourceTag/${TagKey}	Read
DescribeMaintenanceStartTime	Grants permission to get your gateway's weekly maintenance start time including the day and time of the week	gateway*	aws:ResourceTag/${TagKey}	Read
DescribeNFSFileShares	Grants permission to get a description for one or more file shares from a file gateway	share*	aws:ResourceTag/${TagKey}	Read
DescribeSMBFileShares	Grants permission to get a description for one or more file shares from a file gateway	share*	aws:ResourceTag/${TagKey}	Read
DescribeSMBSettings	Grants permission to get a description of a Server Message Block (SMB) file share settings from a file gateway	gateway*	aws:ResourceTag/${TagKey}	Read
DescribeSnapshotSchedule	Grants permission to describe the snapshot schedule for the specified gateway volume	volume*	aws:ResourceTag/${TagKey}	Read
DescribeStorediSCSIVolumes	Grants permission to get the description of the gateway volumes specified in the request	volume*	aws:ResourceTag/${TagKey}	Read
DescribeTapeArchives	Grants permission to get a description of specified virtual tapes in the virtual tape shelf (VTS)			Read
DescribeTapeRecoveryPoints	Grants permission to get a list of virtual tape recovery points that are available for the specified gateway-VTL	gateway*	aws:ResourceTag/${TagKey}	Read
DescribeTapes	Grants permission to get a description of the specified Amazon Resource Name (ARN) of virtual tapes	gateway*	aws:ResourceTag/${TagKey}	Read
DescribeUploadBuffer	Grants permission to get information about the upload buffer of a gateway	gateway*	aws:ResourceTag/${TagKey}	Read
DescribeVTLDevices	Grants permission to get a description of virtual tape library (VTL) devices for the specified gateway	gateway*	aws:ResourceTag/${TagKey}	Read
DescribeWorkingStorage	Grants permission to get information about the working storage of a gateway	gateway*	aws:ResourceTag/${TagKey}	Read
DetachVolume	Grants permission to disconnect a volume from an iSCSI connection and then detaches the volume from the specified gateway	volume*	aws:ResourceTag/${TagKey}	Write
DisableGateway	Grants permission to disable a gateway when the gateway is no longer functioning	gateway*	aws:ResourceTag/${TagKey}	Write
DisassociateFileSystem	Grants permission to disassociate an Amazon FSx file system from an Amazon FSx file gateway	fs-association*	aws:ResourceTag/${TagKey}	Write
EvictFilesFailingUpload	Grants permission to clean a share's cache of file entries that are failing upload to Amazon S3	share*	aws:ResourceTag/${TagKey}	Write
JoinDomain	Grants permission to enable you to join an Active Directory Domain	gateway*	aws:ResourceTag/${TagKey}	Write
ListAutomaticTapeCreationPolicies	Grants permission to list the automatic tape creation policies configured on the specified gateway-VTL or all gateway-VTLs owned by your AWS account			List
ListCacheReports	Grants permission to get a list of the cache reports owned by your AWS account			List
ListFileShares	Grants permission to get a list of the file shares for a specific file gateway, or the list of file shares owned by your AWS account			List
ListFileSystemAssociations	Grants permission to get a list of the file system associations for the specified gateway			List
ListGateways	Grants permission to list gateways owned by an AWS account in a region specified in the request. The returned list is ordered by gateway Amazon Resource Name (ARN)			List
ListLocalDisks	Grants permission to get a list of the gateway's local disks	gateway*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to get the tags that have been added to the specified resource	gateway	aws:ResourceTag/${TagKey}	List
		share	aws:ResourceTag/${TagKey}
		tape	aws:ResourceTag/${TagKey}
		volume	aws:ResourceTag/${TagKey}
ListTapePools	Grants permission to list tape pools owned by your AWS account			List
ListTapes	Grants permission to list virtual tapes in your virtual tape library (VTL) and your virtual tape shelf (VTS)			List
ListVolumeInitiators	Grants permission to list iSCSI initiators that are connected to a volume	volume*	aws:ResourceTag/${TagKey}	List
ListVolumeRecoveryPoints	Grants permission to list the recovery points for a specified gateway	gateway*	aws:ResourceTag/${TagKey}	List
ListVolumes	Grants permission to list the iSCSI stored volumes of a gateway			List
NotifyWhenUploaded	Grants permission to send you a notification through CloudWatch Events when all files written to your NFS file share have been uploaded to Amazon S3	share*	aws:ResourceTag/${TagKey}	Write
RefreshCache	Grants permission to refresh the cache for the specified file share	share*	aws:ResourceTag/${TagKey}	Write
RemoveTagsFromResource	Grants permission to remove one or more tags from the specified resource	cache-report	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		fs-association	aws:ResourceTag/${TagKey} aws:TagKeys
		gateway	aws:ResourceTag/${TagKey} aws:TagKeys
		share	aws:ResourceTag/${TagKey} aws:TagKeys
		tape	aws:ResourceTag/${TagKey} aws:TagKeys
		tapepool	aws:ResourceTag/${TagKey} aws:TagKeys
		volume	aws:ResourceTag/${TagKey} aws:TagKeys
ResetCache	Grants permission to reset all cache disks that have encountered a error and makes the disks available for reconfiguration as cache storage	gateway*	aws:ResourceTag/${TagKey}	Write
RetrieveTapeArchive	Grants permission to retrieve an archived virtual tape from the virtual tape shelf (VTS) to a gateway-VTL	gateway*	aws:ResourceTag/${TagKey}	Write
		tape*	aws:ResourceTag/${TagKey}
RetrieveTapeRecoveryPoint	Grants permission to retrieve the recovery point for the specified virtual tape	gateway*	aws:ResourceTag/${TagKey}	Write
		tape*	aws:ResourceTag/${TagKey}
SetLocalConsolePassword	Grants permission to set the password for your VM local console	gateway*	aws:ResourceTag/${TagKey}	Write
SetSMBGuestPassword	Grants permission to set the password for SMB Guest user	gateway*	aws:ResourceTag/${TagKey}	Write
ShutdownGateway	Grants permission to shut down a gateway	gateway*	aws:ResourceTag/${TagKey}	Write
StartAvailabilityMonitorTest	Grants permission to start a test that verifies that the specified gateway is configured for High Availability monitoring in your host environment	gateway*	aws:ResourceTag/${TagKey}	Write
StartCacheReport	Grants permission to start a cache report for an existing file share	share*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
StartGateway	Grants permission to start a gateway that you previously shut down	gateway*	aws:ResourceTag/${TagKey}	Write
UpdateAutomaticTapeCreationPolicy	Grants permission to update the automatic tape creation policy configured on a gateway-VTL	gateway*	aws:ResourceTag/${TagKey}	Write
		tapepool*	aws:ResourceTag/${TagKey}
UpdateBandwidthRateLimit	Grants permission to update the bandwidth rate limits of a gateway	gateway*	aws:ResourceTag/${TagKey}	Write
UpdateBandwidthRateLimitSchedule	Grants permission to update the bandwidth rate limit schedule of a gateway	gateway*	aws:ResourceTag/${TagKey}	Write
UpdateChapCredentials	Grants permission to update the Challenge-Handshake Authentication Protocol (CHAP) credentials for a specified iSCSI target	target*	aws:ResourceTag/${TagKey}	Write
UpdateFileSystemAssociation	Grants permission to update a file system association	fs-association*	aws:ResourceTag/${TagKey}	Write
UpdateGatewayInformation	Grants permission to update a gateway's metadata, which includes the gateway's name and time zone	gateway*	aws:ResourceTag/${TagKey}	Write
UpdateGatewaySoftwareNow	Grants permission to update the gateway virtual machine (VM) software	gateway*	aws:ResourceTag/${TagKey}	Write
UpdateMaintenanceStartTime	Grants permission to update a gateway's weekly maintenance start time information, including day and time of the week. The maintenance time is the time in your gateway's time zone	gateway*	aws:ResourceTag/${TagKey}	Write
UpdateNFSFileShare	Grants permission to update a NFS file share	share*	aws:ResourceTag/${TagKey}	Write
UpdateSMBFileShare	Grants permission to update a SMB file share	share*	aws:ResourceTag/${TagKey}	Write
UpdateSMBFileShareVisibility	Grants permission to update whether the shares on a gateway are visible in a net view or browse list	gateway*	aws:ResourceTag/${TagKey}	Write
UpdateSMBLocalGroups	Grants permission to update the list of Active Directory users and groups that have special permissions for SMB file shares on the gateway	gateway*	aws:ResourceTag/${TagKey}	Write
UpdateSMBSecurityStrategy	Grants permission to update the SMB security strategy on a file gateway	gateway*	aws:ResourceTag/${TagKey}	Write
UpdateSnapshotSchedule	Grants permission to update a snapshot schedule configured for a gateway volume	volume*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateVTLDeviceType	Grants permission to update the type of medium changer in a gateway-VTL	device*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS Storage Gateway

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
cache-report	arn:${Partition}:storagegateway:${Region}:${Account}:share/${ShareId}/cache-report/${CacheReportId}	aws:ResourceTag/${TagKey}
device	arn:${Partition}:storagegateway:${Region}:${Account}:gateway/${GatewayId}/device/${Vtldevice}	aws:ResourceTag/${TagKey}
fs-association	arn:${Partition}:storagegateway:${Region}:${Account}:fs-association/${FsaId}	aws:ResourceTag/${TagKey}
gateway	arn:${Partition}:storagegateway:${Region}:${Account}:gateway/${GatewayId}	aws:ResourceTag/${TagKey}
share	arn:${Partition}:storagegateway:${Region}:${Account}:share/${ShareId}	aws:ResourceTag/${TagKey}
tape	arn:${Partition}:storagegateway:${Region}:${Account}:tape/${TapeBarcode}	aws:ResourceTag/${TagKey}
tapepool	arn:${Partition}:storagegateway:${Region}:${Account}:tapepool/${PoolId}	aws:ResourceTag/${TagKey}
target	arn:${Partition}:storagegateway:${Region}:${Account}:gateway/${GatewayId}/target/${IscsiTarget}	aws:ResourceTag/${TagKey}
volume	arn:${Partition}:storagegateway:${Region}:${Account}:gateway/${GatewayId}/volume/${VolumeId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Storage Gateway

AWS Storage Gateway defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the allowed set of values for each of the tags	String
aws:ResourceTag/${TagKey}	Filters access by tag-value associated with the resource	String
aws:TagKeys	Filters access by the presence of mandatory tags in the request	ArrayOfString