# action

name: directconnect:DescribeCustomerMetadata
access_level: Read
description:
Grants permission to view a list of customer agreements, along with their signed status and whether the customer is an NNIPartner, NNIPartnerV2, or a nonPartner


name: directconnect:DescribeDirectConnectGatewayAssociationProposals
access_level: Read
description:
Grants permission to describe one or more association proposals for connection between a virtual private gateway and a Direct Connect gateway


name: directconnect:DescribeDirectConnectGatewayAssociations
access_level: Read
description:
Grants permission to describe the associations between your Direct Connect gateways and virtual private gateways


name: directconnect:DescribeDirectConnectGatewayAttachments
access_level: Read
description:
Grants permission to describe the attachments between your Direct Connect gateways and virtual interfaces


name: directconnect:DescribeDirectConnectGateways
access_level: Read
description:
Grants permission to describe all your Direct Connect gateways or only the specified Direct Connect gateway


name: directconnect:DescribeHostedConnections
access_level: Read
description:
Grants permission to describe the hosted connections that have been provisioned on the specified interconnect or link aggregation group (LAG)


name: directconnect:DescribeLoa
access_level: Read
description:
Grants permission to describe the LOA-CFA for a connection, interconnect, or link aggregation group (LAG)


name: directconnect:StartBgpFailoverTest
access_level: Write
description:
Grants permission to start the virtual interface failover test that verifies your configuration meets your resiliency requirements by placing the BGP peering session in the DOWN state. You can then send traffic to verify that there are no outages


name: directconnect:TagResource
access_level: Tagging
description:
Grants permission to add the specified tags to the specified AWS Direct Connect resource. Each resource can have a maximum of 50 tags


name: dynamodb:ConditionCheckItem
access_level: Read
description:
Grants permission to the ConditionCheckItem operation checks the existence of a set of attributes for the item with the given primary key


name: dynamodb:DescribeContributorInsights
access_level: Read
description:
Grants permission to describe the contributor insights status and related details for a given table or global secondary index


name: dynamodb:DescribeKinesisStreamingDestination
access_level: Read
description:
Grants permission to grant permission to describe the status of Kinesis streaming and related details for a given table


name: dynamodb:DescribeLimits
access_level: Read
description:
Grants permission to return the current provisioned-capacity limits for your AWS account in a region, both for the region as a whole and for any one DynamoDB table that you create there


name: dynamodb:DescribeStream
access_level: Read
description:
Grants permission to return information about a stream, including the current status of the stream, its Amazon Resource Name (ARN), the composition of its shards, and its corresponding DynamoDB table


name: dynamodb:DisableKinesisStreamingDestination
access_level: Write
description:
Grants permission to grant permission to stop replication from the DynamoDB table to the Kinesis data stream


name: dynamodb:EnableKinesisStreamingDestination
access_level: Write
description:
Grants permission to grant permission to start table data replication to the specified Kinesis data stream at a timestamp chosen during the enable workflow


name: dynamodb:GetItem
access_level: Read
description:
Grants permission to the GetItem operation that returns a set of attributes for the item with the given primary key


name: dynamodb:ListContributorInsights
access_level: List
description:
Grants permission to list the ContributorInsightsSummary for all tables and global secondary indexes associated with the current account and endpoint


name: dynamodb:ListStreams
access_level: Read
description:
Grants permission to return an array of stream ARNs associated with the current account and endpoint


name: dynamodb:ListTables
access_level: List
description:
Grants permission to return an array of table names associated with the current account and endpoint


name: dynamodb:Query
access_level: Read
description:
Grants permission to use the primary key of a table or a secondary index to directly access items from that table or index


name: dynamodb:Scan
access_level: Read
description:
Grants permission to return one or more items and item attributes by accessing every item in a table or a secondary index


name: dynamodb:UpdateContributorInsights
access_level: Write
description:
Grants permission to update the status for contributor insights for a specific table or global secondary index


name: dynamodb:UpdateItem
access_level: Write
description:
Grants permission to edit an existing item's attributes, or adds a new item to the table if it does not already exist


name: dynamodb:UpdateTable
access_level: Write
description:
Grants permission to modify the provisioned throughput settings, global secondary indexes, or DynamoDB Streams settings for a given table


name: es:DescribeElasticsearchDomainConfig
access_level: Read
description:
Grants permission to view a description of the configuration and status of an OpenSearch Service domain. This permission is deprecated. Use DescribeDomainConfig instead


name: fsx:CreateDataRepositoryAssociation
access_level: Write
description:
Grants permission to create a new data respository association for an Amazon FSx for Lustre file system


name: fsx:DeleteBackup
access_level: Write
description:
Grants permission to delete a backup, deleting its contents. After deletion, the backup no longer exists, and its data is no longer available


name: fsx:DeleteVolume
access_level: Write
description:
Grants permission to delete a volume, deleting its contents and any existing automatic backups of the volume


name: fsx:DescribeDataRepositoryAssociations
access_level: Read
description:
Grants permission to return the descriptions of all data repository associations owned by your AWS account in the AWS Region of the endpoint that you're calling


name: fsx:DescribeDataRepositoryTasks
access_level: Read
description:
Grants permission to return the descriptions of all data repository tasks owned by your AWS account in the AWS Region of the endpoint that you're calling


name: fsx:DescribeSnapshots
access_level: Read
description:
Grants permission to return the descriptions of all snapshots owned by your AWS account in the AWS Region of the endpoint you're calling


name: greengrass:ListClientDevicesAssociatedWithCoreDevice
access_level: List
description:
Grants permission to retrieve a paginated list of client devices associated to a AWS IoT Greengrass core device


name: inspector2:BatchGetFreeTrialInfo
access_level: Read
description:
Grants permission to retrieve free trial period eligibility about Amazon Inspector accounts for an account


name: inspector2:DescribeOrganizationConfiguration
access_level: Read
description:
Grants permission to retrieve information about the Amazon Inspector configuration settings for an AWS organization


name: inspector2:DisableDelegatedAdminAccount
access_level: Write
description:
Grants permission to disable an account as the delegated Amazon Inspector administrator account for an AWS organization


name: inspector2:DisassociateMember
access_level: Write
description:
Grants permission to an Amazon Inspector administrator account to disassociate from an Inspector member account


name: inspector2:Enable
access_level: Write
description:
Grants permission to enable and specify the configuration settings for a new Amazon Inspector account


name: inspector2:EnableDelegatedAdminAccount
access_level: Write
description:
Grants permission to enable an account as the delegated Amazon Inspector administrator account for an AWS organization


name: inspector2:GetDelegatedAdminAccount
access_level: Read
description:
Grants permission to retrieve information about the Amazon Inspector administrator account for an account


name: inspector2:GetMember
access_level: Read
description:
Grants permission to retrieve information about an account that's associated with an Amazon Inspector administrator account


name: inspector2:ListAccountPermissions
access_level: List
description:
Grants permission to retrieve feature configuration permissions associated with an Amazon Inspector account within an organization


name: inspector2:ListCoverage
access_level: List
description:
Grants permission to retrieve the types of statistics Amazon Inspector can generate for resources Inspector monitors


name: inspector2:ListCoverageStatistics
access_level: List
description:
Grants permission to retrieve statistical data and other information about the resources Amazon Inspector monitors


name: inspector2:ListDelegatedAdminAccounts
access_level: List
description:
Grants permission to retrieve information about the delegated Amazon Inspector administrator account for an AWS organization


name: inspector2:ListFindingAggregations
access_level: List
description:
Grants permission to retrieve statistical data and other information about Amazon Inspector findings


name: inspector2:ListMembers
access_level: List
description:
Grants permission to retrieve information about the Amazon Inspector member accounts that are associated with an Inspector administrator account


name: iotwireless:ListMulticastGroupsByFuotaTask
access_level: Read
description:
Grants permission to list information of available MulticastGroups by FuotaTask based on the AWS account


name: mediaconvert:AssociateCertificate
access_level: Write
description:
Grants permission to associate an AWS Certificate Manager (ACM) Amazon Resource Name (ARN) with AWS Elemental MediaConvert


name: mediaconvert:DescribeEndpoints
access_level: List
description:
Grants permission to subscribe to the AWS Elemental MediaConvert service, by sending a request for an account-specific endpoint. All transcoding requests must be sent to the endpoint that the service returns


name: mediaconvert:DisassociateCertificate
access_level: Write
description:
Grants permission to remove an association between the Amazon Resource Name (ARN) of an AWS Certificate Manager (ACM) certificate and an AWS Elemental MediaConvert resource


name: mobiletargeting:CreateSegment
access_level: Write
description:
Grants permission to create a segment that is based on endpoint data reported to Pinpoint by your app. To allow a user to create a segment by importing endpoint data from outside of Pinpoint, allow the mobiletargeting:CreateImportJob action


name: mobiletargeting:GetAdmChannel
access_level: Read
description:
Grants permission to retrieve information about the Amazon Device Messaging (ADM) channel for an app


name: mobiletargeting:GetApplicationDateRangeKpi
access_level: Read
description:
Grants permission to retrieve (queries) pre-aggregated data for a standard metric that applies to an application


name: mobiletargeting:GetCampaignDateRangeKpi
access_level: Read
description:
Grants permission to retrieve (queries) pre-aggregated data for a standard metric that applies to a campaign


name: mobiletargeting:GetEmailTemplate
access_level: Read
description:
Grants permission to retrieve information about a specific or the active version of an email template


name: mobiletargeting:GetJourneyDateRangeKpi
access_level: Read
description:
Grants permission to retrieve (queries) pre-aggregated data for a standard engagement metric that applies to a journey


name: mobiletargeting:GetJourneyExecutionActivityMetrics
access_level: Read
description:
Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey activity


name: mobiletargeting:GetJourneyExecutionMetrics
access_level: Read
description:
Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey


name: mobiletargeting:GetPushTemplate
access_level: Read
description:
Grants permission to retrieve information about a specific or the active version of an push notification template


name: mobiletargeting:GetRecommenderConfiguration
access_level: Read
description:
Grants permission to retrieve information about an Amazon Pinpoint configuration for a recommender model


name: mobiletargeting:GetRecommenderConfigurations
access_level: List
description:
Grants permission to retrieve information about all the recommender model configurations that are associated with an Amazon Pinpoint account


name: mobiletargeting:GetSegmentExportJobs
access_level: List
description:
Grants permission to retrieve information about jobs that export endpoint definitions from segments to Amazon S3


name: mobiletargeting:GetSegmentImportJobs
access_level: List
description:
Grants permission to retrieve information about jobs that create segments by importing endpoint definitions from


name: mobiletargeting:GetSmsTemplate
access_level: Read
description:
Grants permission to retrieve information about a specific or the active version of an sms message template


name: mobiletargeting:GetVoiceTemplate
access_level: Read
description:
Grants permission to retrieve information about a specific or the active version of a voice message template


name: mobiletargeting:PhoneNumberValidate
access_level: Read
description:
Grants permission to obtain metadata for a phone number, such as the number type (mobile, landline, or VoIP), location, and provider


name: mobiletargeting:SendUsersMessages
access_level: Write
description:
Grants permission to send an SMS message or push notification to all endpoints that are associated with a specific user ID


name: mobiletargeting:UpdateApnsVoipSandboxChannel
access_level: Write
description:
Grants permission to update the Apple Push Notification service (APNs) VoIP sandbox channel for an app


name: mobiletargeting:UpdateEmailTemplate
access_level: Write
description:
Grants permission to update a specific email template under the same version or generate a new version


name: mobiletargeting:UpdateGcmChannel
access_level: Write
description:
Grants permission to update the Firebase Cloud Messaging (FCM) or Google Cloud Messaging (GCM) API key that allows to send push notifications to your Android app


name: mobiletargeting:UpdatePushTemplate
access_level: Write
description:
Grants permission to update a specific push notification template under the same version or generate a new version


name: mobiletargeting:UpdateSmsTemplate
access_level: Write
description:
Grants permission to update a specific sms message template under the same version or generate a new version


name: mobiletargeting:UpdateVoiceTemplate
access_level: Write
description:
Grants permission to update a specific voice message template under the same version or generate a new version


name: networkmanager:AcceptAttachment
access_level: Write
description:
Grants permission to accept creation of an attachment between a source and destination in a core network


name: rekognition:CompareFaces
access_level: Read
description:
Grants permission to compare faces in the source input image with each face detected in the target input image


name: rekognition:DistributeDatasetEntries
access_level: Write
description:
Grants permission to distribute the entries in a training dataset across the training dataset and the test dataset for a project


name: rekognition:GetCelebrityRecognition
access_level: Read
description:
Grants permission to read the celebrity recognition results found in a stored video by an asynchronous celebrity recognition job


name: rekognition:GetContentModeration
access_level: Read
description:
Grants permission to read the content moderation analysis results found in a stored video by an asynchronous content moderation job


name: rekognition:GetFaceDetection
access_level: Read
description:
Grants permission to read the faces detection results found in a stored video by an asynchronous face detection job


name: rekognition:GetFaceSearch
access_level: Read
description:
Grants permission to read the matching collection faces found in a stored video by an asynchronous face search job


name: rekognition:GetLabelDetection
access_level: Read
description:
Grants permission to read the label detected resuls found in a stored video by an asynchronous label detection job


name: rekognition:GetPersonTracking
access_level: Read
description:
Grants permission to read the list of persons detected in a stored video by an asynchronous person tracking job


name: rekognition:GetSegmentDetection
access_level: Read
description:
Grants permission to get the vdeo segments found in a stored video by an asynchronous segment detection job


name: rekognition:ListDatasetEntries
access_level: Read
description:
Grants permission to list the dataset entries in an existing Amazon Rekognition Custom Labels dataset


name: rekognition:StartContentModeration
access_level: Write
description:
Grants permission to start asynchronous detection of explicit or suggestive adult content in a stored video


name: rekognition:StartFaceSearch
access_level: Write
description:
Grants permission to start an asynchronous search for faces in a collection that match the faces of persons detected in a stored video


name: route53resolver:ListResolverEndpointIpAddresses
access_level: List
description:
Grants permission to list the IP addresses that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound) for a specified Resolver endpoint


name: s3:PutObjectAcl
access_level: Permissions management
description:
Grants permission to set the access control list (ACL) permissions for new or existing objects in an S3 bucket


name: sagemaker:DescribeHumanTaskUi
access_level: Read
description:
Grants permission to return detailed information about the specified human review workflow user interface


name: secretsmanager:ReplicateSecretToRegions
access_level: Write
description:
Grants permission to convert an existing secret to a multi-Region secret and begin replicating the secret to a list of new regions


name: secretsmanager:StopReplicationToReplica
access_level: Write
description:
Grants permission to remove the secret from replication and promote the secret to a regional secret in the replica Region


name: securityhub:CreateFindingAggregator
access_level: Write
description:
Grants permission to create a finding aggregator, which contains the cross-Region finding aggregation configuration


name: securityhub:GetFindingAggregator
access_level: Read
description:
Grants permission to retrieve details for a finding aggregator, which configures finding aggregation across Regions


name: securityhub:ListFindingAggregators
access_level: List
description:
Grants permission to retrieve a list of finding aggregators, which contain the cross-Region finding aggregation configuration


name: securityhub:UpdateFindingAggregator
access_level: Write
description:
Grants permission to update a finding aggregator, which contains the cross-Region finding aggregation configuration


name: serviceextract:GetConfig
access_level: Read
description:
Grants permission to get required configuration for the AWS Microservice Extractor for .NET desktop client


name: sts:AssumeRole
access_level: Write
description:
Grants permission to obtain a set of temporary security credentials that you can use to access AWS resources that you might not normally have access to


name: sts:AssumeRoleWithSAML
access_level: Write
description:
Grants permission to obtain a set of temporary security credentials for users who have been authenticated via a SAML authentication response


name: sts:AssumeRoleWithWebIdentity
access_level: Write
description:
Grants permission to obtain a set of temporary security credentials for users who have been authenticated in a mobile or web application with a web identity provider


name: sts:DecodeAuthorizationMessage
access_level: Write
description:
Grants permission to decode additional information about the authorization status of a request from an encoded message returned in response to an AWS request


name: sts:GetCallerIdentity
access_level: Read
description:
Grants permission to obtain details about the IAM identity whose credentials are used to call the API


name: sts:GetFederationToken
access_level: Read
description:
Grants permission to obtain a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for a federated user


name: sts:GetSessionToken
access_level: Read
description:
Grants permission to obtain a set of temporary security credentials (consisting of an access key ID, a secret access key, and a security token) for an AWS account or IAM user


name: textract:StartExpenseAnalysis
access_level: Write
description:
Grants permission to start an asynchronous job to detect instances of invoices or receipts within an image or pdf provided as input


# resource

name: ArchiveRule
arn:
arn:${Partition}:access-analyzer:${Region}:${Account}:analyzer/${AnalyzerName}/archive-rule/${RuleName}


name: DocumentationPart
arn:
arn:${Partition}:apigateway:${Region}::/restapis/${RestApiId}/documentation/parts/${DocumentationPartId}


name: DocumentationVersion
arn:
arn:${Partition}:apigateway:${Region}::/restapis/${RestApiId}/documentation/versions/${DocumentationVersionId}


name: Integration
arn:
arn:${Partition}:apigateway:${Region}::/restapis/${RestApiId}/resources/${ResourceId}/methods/${HttpMethodType}/integration


name: IntegrationResponse
arn:
arn:${Partition}:apigateway:${Region}::/restapis/${RestApiId}/resources/${ResourceId}/methods/${HttpMethodType}/integration/responses/${StatusCode}


name: Method
arn:
arn:${Partition}:apigateway:${Region}::/restapis/${RestApiId}/resources/${ResourceId}/methods/${HttpMethodType}


name: MethodResponse
arn:
arn:${Partition}:apigateway:${Region}::/restapis/${RestApiId}/resources/${ResourceId}/methods/${HttpMethodType}/responses/${StatusCode}


name: RequestValidator
arn:
arn:${Partition}:apigateway:${Region}::/restapis/${RestApiId}/requestvalidators/${RequestValidatorId}


name: IntegrationResponse
arn:
arn:${Partition}:apigateway:${Region}::/apis/${ApiId}/integrations/${IntegrationId}/integrationresponses/${IntegrationResponseId}


name: IntegrationResponses
arn:
arn:${Partition}:apigateway:${Region}::/apis/${ApiId}/integrations/${IntegrationId}/integrationresponses


name: RouteResponse
arn:
arn:${Partition}:apigateway:${Region}::/apis/${ApiId}/routes/${RouteId}/routeresponses/${RouteResponseId}


name: RouteRequestParameter
arn:
arn:${Partition}:apigateway:${Region}::/apis/${ApiId}/routes/${RouteId}/requestparameters/${RequestParameterKey}


name: event-integration-association
arn:
arn:${Partition}:app-integrations:${Region}:${Account}:event-integration-association/${EventIntegrationName}/${ResourceId}


name: environment
arn:
arn:${Partition}:appconfig:${Region}:${Account}:application/${ApplicationId}/environment/${EnvironmentId}


name: configurationprofile
arn:
arn:${Partition}:appconfig:${Region}:${Account}:application/${ApplicationId}/configurationprofile/${ConfigurationProfileId}


name: deployment
arn:
arn:${Partition}:appconfig:${Region}:${Account}:application/${ApplicationId}/environment/${EnvironmentId}/deployment/${DeploymentNumber}


name: hostedconfigurationversion
arn:
arn:${Partition}:appconfig:${Region}:${Account}:application/${ApplicationId}/configurationprofile/${ConfigurationProfileId}/hostedconfigurationversion/${VersionNumber}


name: route
arn:
arn:${Partition}:appmesh:${Region}:${Account}:mesh/${MeshName}/virtualRouter/${VirtualRouterName}/route/${RouteName}


name: gatewayRoute
arn:
arn:${Partition}:appmesh:${Region}:${Account}:mesh/${MeshName}/virtualGateway/${VirtualGatewayName}/gatewayRoute/${GatewayRouteName}


name: virtualService
arn:
arn:${Partition}:appmesh-preview:${Region}:${Account}:mesh/${MeshName}/virtualService/${VirtualServiceName}


name: virtualNode
arn:
arn:${Partition}:appmesh-preview:${Region}:${Account}:mesh/${MeshName}/virtualNode/${VirtualNodeName}


name: virtualRouter
arn:
arn:${Partition}:appmesh-preview:${Region}:${Account}:mesh/${MeshName}/virtualRouter/${VirtualRouterName}


name: route
arn:
arn:${Partition}:appmesh-preview:${Region}:${Account}:mesh/${MeshName}/virtualRouter/${VirtualRouterName}/route/${RouteName}


name: virtualGateway
arn:
arn:${Partition}:appmesh-preview:${Region}:${Account}:mesh/${MeshName}/virtualGateway/${VirtualGatewayName}


name: gatewayRoute
arn:
arn:${Partition}:appmesh-preview:${Region}:${Account}:mesh/${MeshName}/virtualGateway/${VirtualGatewayName}/gatewayRoute/${GatewayRouteName}


name: autoscalingconfiguration
arn:
arn:${Partition}:apprunner:${Region}:${Account}:autoscalingconfiguration/${AutoscalingConfigurationName}/${AutoscalingConfigurationVersion}/${AutoscalingConfigurationId}


name: field
arn:
arn:${Partition}:appsync:${Region}:${Account}:apis/${GraphQLAPIId}/types/${TypeName}/fields/${FieldName}


name: assessmentControlSet
arn:
arn:${Partition}:auditmanager:${Region}:${Account}:assessment/${assessmentId}/controlSet/{controlSetId}


name: autoScalingGroup
arn:
arn:${Partition}:autoscaling:${Region}:${Account}:autoScalingGroup:${GroupId}:autoScalingGroupName/${GroupFriendlyName}


name: launchConfiguration
arn:
arn:${Partition}:autoscaling:${Region}:${Account}:launchConfiguration:${Id}:launchConfigurationName/${LaunchConfigurationName}


name: codereview
arn:
arn:${Partition}:codeguru-reviewer:${Region}:${Account}:association:${ResourceId}:codereview:${CodeReviewId}


name: app-instance-user
arn:
arn:${Partition}:chime:${Region}:${AccountId}:app-instance/${AppInstanceId}/user/${AppInstanceUserId}


name: appliedSchema
arn:
arn:${Partition}:clouddirectory:${Region}:${Account}:directory/${DirectoryId}/schema/${SchemaName}/${Version}


name: package
arn:
arn:${Partition}:codeartifact:${Region}:${Account}:package/${DomainName}/${RepositoryName}/${PackageFormat}/${PackageNamespace}/${PackageName}


name: deploymentgroup
arn:
arn:${Partition}:codedeploy:${Region}:${Account}:deploymentgroup:${ApplicationName}/${DeploymentGroupName}


name: actiontype
arn:
arn:${Partition}:codepipeline:${Region}:${Account}:actiontype:${Owner}/${Category}/${Provider}/${Version}


name: dataset
arn:
arn:${Partition}:cognito-sync:${Region}:${Account}:identitypool/${IdentityPoolId}/identity/${IdentityId}/dataset/${DatasetName}


name: identity
arn:
arn:${Partition}:cognito-sync:${Region}:${Account}:identitypool/${IdentityPoolId}/identity/${IdentityId}


name: document-classifier-endpoint
arn:
arn:${Partition}:comprehend:${Region}:${Account}:document-classifier-endpoint/${DocumentClassifierEndpointName}


name: entity-recognizer-endpoint
arn:
arn:${Partition}:comprehend:${Region}:${Account}:entity-recognizer-endpoint/${EntityRecognizerEndpointName}


name: AggregationAuthorization
arn:
arn:${Partition}:config:${Region}:${Account}:aggregation-authorization/${AggregatorAccount}/${AggregatorRegion}


name: ConformancePack
arn:
arn:${Partition}:config:${Region}:${Account}:conformance-pack/${ConformancePackName}/${ConformancePackId}


name: OrganizationConformancePack
arn:
arn:${Partition}:config:${Region}:${Account}:organization-conformance-pack/${OrganizationConformancePackId}


name: RemediationConfiguration
arn:
arn:${Partition}:config:${Region}:${Account}:remediation-configuration/${RemediationConfigurationId}


name: routing-profile
arn:
arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/routing-profile/${RoutingProfileId}


name: security-profile
arn:
arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/security-profile/${SecurityProfileId}


name: hierarchy-group
arn:
arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/agent-group/${HierarchyGroupId}


name: quick-connect
arn:
arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/transfer-destination/${QuickConnectId}


name: hours-of-operation
arn:
arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/operating-hours/${HoursOfOperationId}


name: integration-association
arn:
arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/integration-association/${IntegrationAssociationId}


name: assets
arn:
arn:${Partition}:dataexchange:${Region}:${Account}:data-sets/${DataSetId}/revisions/${RevisionId}/assets/${AssetId}


name: egress-only-internet-gateway
arn:
arn:${Partition}:ec2:${Region}:${Account}:egress-only-internet-gateway/${EgressOnlyInternetGatewayId}


name: elastic-inference
arn:
arn:${Partition}:elastic-inference:${Region}:${Account}:elastic-inference-accelerator/${ElasticInferenceAcceleratorId}


name: local-gateway-route-table-virtual-interface-group-association
arn:
arn:${Partition}:ec2:${Region}:${Account}:local-gateway-route-table-virtual-interface-group-association/${LocalGatewayRouteTableVirtualInterfaceGroupAssociationId}


name: local-gateway-route-table-vpc-association
arn:
arn:${Partition}:ec2:${Region}:${Account}:local-gateway-route-table-vpc-association/${LocalGatewayRouteTableVpcAssociationId}


name: local-gateway-virtual-interface-group
arn:
arn:${Partition}:ec2:${Region}:${Account}:local-gateway-virtual-interface-group/${LocalGatewayVirtualInterfaceGroupId}


name: local-gateway-virtual-interface
arn:
arn:${Partition}:ec2:${Region}:${Account}:local-gateway-virtual-interface/${LocalGatewayVirtualInterfaceId}


name: transit-gateway-connect-peer
arn:
arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-connect-peer/${TransitGatewayConnectPeerId}


name: transit-gateway-multicast-domain
arn:
arn:${Partition}:ec2:${Region}:${Account}:transit-gateway-multicast-domain/${TransitGatewayMulticastDomainId}


name: task-definition
arn:
arn:${Partition}:ecs:${Region}:${Account}:task-definition/${TaskDefinitionFamilyName}:${TaskDefinitionRevisionNumber}


name: fargateprofile
arn:
arn:${Partition}:eks:${Region}:${Account}:fargateprofile/${ClusterName}/${FargateProfileName}/${UUID}


name: identityproviderconfig
arn:
arn:${Partition}:eks:${Region}:${Account}:identityproviderconfig/${ClusterName}/${IdentityProviderType}/${IdentityProviderConfigName}/${UUID}


name: accelerator
arn:
arn:${Partition}:elastic-inference:${Region}:${Account}:elastic-inference-accelerator/${AcceleratorId}


name: applicationversion
arn:
arn:${Partition}:elasticbeanstalk:${Region}:${Account}:applicationversion/${ApplicationName}/${VersionLabel}


name: configurationtemplate
arn:
arn:${Partition}:elasticbeanstalk:${Region}:${Account}:configurationtemplate/${ApplicationName}/${TemplateName}


name: environment
arn:
arn:${Partition}:elasticbeanstalk:${Region}:${Account}:environment/${ApplicationName}/${EnvironmentName}


name: listener/app
arn:
arn:${Partition}:elasticloadbalancing:${Region}:${Account}:listener/app/${LoadBalancerName}/${LoadBalancerId}/${ListenerId}


name: listener-rule/app
arn:
arn:${Partition}:elasticloadbalancing:${Region}:${Account}:listener-rule/app/${LoadBalancerName}/${LoadBalancerId}/${ListenerId}/${ListenerRuleId}


name: listener/net
arn:
arn:${Partition}:elasticloadbalancing:${Region}:${Account}:listener/net/${LoadBalancerName}/${LoadBalancerId}/${ListenerId}


name: listener-rule/net
arn:
arn:${Partition}:elasticloadbalancing:${Region}:${Account}:listener-rule/net/${LoadBalancerName}/${LoadBalancerId}/${ListenerId}/${ListenerRuleId}


name: loadbalancer/app/
arn:
arn:${Partition}:elasticloadbalancing:${Region}:${Account}:loadbalancer/app/${LoadBalancerName}/${LoadBalancerId}


name: loadbalancer/net/
arn:
arn:${Partition}:elasticloadbalancing:${Region}:${Account}:loadbalancer/net/${LoadBalancerName}/${LoadBalancerId}


name: targetgroup
arn:
arn:${Partition}:elasticloadbalancing:${Region}:${Account}:targetgroup/${TargetGroupName}/${TargetGroupId}


name: jobRun
arn:
arn:${Partition}:emr-containers:${Region}:${Account}:/virtualclusters/${virtualClusterId}/jobruns/${jobRunId}


name: managedEndpoint
arn:
arn:${Partition}:emr-containers:${Region}:${Account}:/virtualclusters/${virtualClusterId}/endpoints/${endpointId}


name: es_role
arn:
arn:${Partition}:iam::${Account}:role/aws-service-role/es.amazonaws.com/AWSServiceRoleForAmazonElasticsearchService


name: opensearchservice_role
arn:
arn:${Partition}:iam::${Account}:role/aws-service-role/opensearchservice.amazonaws.com/AWSServiceRoleForAmazonOpenSearchInternalService


name: execute-api-general
arn:
arn:${Partition}:execute-api:${Region}:${Account}:${ApiId}/${Stage}/${Method}/${ApiSpecificResourcePath}


name: matchmakingConfiguration
arn:
arn:${Partition}:gamelift:${Region}:${Account}:matchmakingconfiguration/${MatchmakingConfigurationName}


name: endpointgroup
arn:
arn:${Partition}:globalaccelerator::${Account}:accelerator/${AcceleratorId}/listener/${ListenerId}/endpoint-group/${EndpointGroupId}


name: tableversion
arn:
arn:${Partition}:glue:${Region}:${Account}:tableVersion/${DatabaseName}/${TableName}/${TableVersionName}


name: userdefinedfunction
arn:
arn:${Partition}:glue:${Region}:${Account}:userDefinedFunction/${DatabaseName}/${UserDefinedFunctionName}


name: certificateAuthority
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/groups/${GroupId}/certificateauthorities/${CertificateAuthorityId}


name: deployment
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/groups/${GroupId}/deployments/${DeploymentId}


name: groupVersion
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/groups/${GroupId}/versions/${VersionId}


name: coreDefinitionVersion
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/cores/${CoreDefinitionId}/versions/${VersionId}


name: deviceDefinition
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/devices/${DeviceDefinitionId}


name: deviceDefinitionVersion
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/devices/${DeviceDefinitionId}/versions/${VersionId}


name: functionDefinition
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/functions/${FunctionDefinitionId}


name: functionDefinitionVersion
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/functions/${FunctionDefinitionId}/versions/${VersionId}


name: subscriptionDefinition
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/subscriptions/${SubscriptionDefinitionId}


name: subscriptionDefinitionVersion
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/subscriptions/${SubscriptionDefinitionId}/versions/${VersionId}


name: loggerDefinition
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/loggers/${LoggerDefinitionId}


name: loggerDefinitionVersion
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/loggers/${LoggerDefinitionId}/versions/${VersionId}


name: resourceDefinition
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/resources/${ResourceDefinitionId}


name: resourceDefinitionVersion
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/resources/${ResourceDefinitionId}/versions/${VersionId}


name: connectorDefinition
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/connectors/${ConnectorDefinitionId}


name: connectorDefinitionVersion
arn:
arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/connectors/${ConnectorDefinitionId}/versions/${VersionId}


name: componentVersion
arn:
arn:${Partition}:greengrass:${Region}:${Account}:components:${ComponentName}:versions:${ComponentVersion}


name: DataflowEndpointGroup
arn:
arn:${Partition}:groundstation:${Region}:${Account}:dataflow-endpoint-group/${dataflowEndpointGroupId}


name: threatintelset
arn:
arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}/threatintelset/${ThreatIntelSetId}


name: publishingDestination
arn:
arn:${Partition}:guardduty:${Region}:${Account}:detector/${DetectorId}/publishingDestination/${PublishingDestinationId}


name: screen
arn:
arn:${Partition}:honeycode:${Region}:${Account}:screen:workbook/${WorkbookId}/app/${AppId}/screen/${ScreenId}


name: screen-automation
arn:
arn:${Partition}:honeycode:${Region}:${Account}:screen-automation:workbook/${WorkbookId}/app/${AppId}/screen/${ScreenId}/automation/${AutomationId}


name: component
arn:
arn:${Partition}:imagebuilder:${Region}:${Account}:component/${ComponentName}/${ComponentVersion}/${ComponentBuildVersion}


name: distributionConfiguration
arn:
arn:${Partition}:imagebuilder:${Region}:${Account}:distribution-configuration/${DistributionConfigurationName}


name: image
arn:
arn:${Partition}:imagebuilder:${Region}:${Account}:image/${ImageName}/${ImageVersion}/${ImageBuildVersion}


name: imageRecipe
arn:
arn:${Partition}:imagebuilder:${Region}:${Account}:image-recipe/${ImageRecipeName}/${ImageRecipeVersion}


name: containerRecipe
arn:
arn:${Partition}:imagebuilder:${Region}:${Account}:container-recipe/${ContainerRecipeName}/${ContainerRecipeVersion}


name: WirelessGatewayTaskDefinition
arn:
arn:${Partition}:iotwireless:${Region}:${Account}:WirelessGatewayTaskDefinition/${WirelessGatewayTaskDefinitionId}


name: transactional-id
arn:
arn:${Partition}:kafka:${Region}:${Account}:transactional-id/${ClusterName}/${ClusterUuid}/${TransactionalId}


name: query-suggestions-block-list
arn:
arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/query-suggestions-block-list/${QuerySuggestionsBlockListId}


name: consumer
arn:
arn:${Partition}:kinesis:${Region}:${Account}:${StreamType}/${StreamName}/consumer/${ConsumerName}:${ConsumerCreationTimpstamp}


name: license-configuration
arn:
arn:${Partition}:license-manager:${Region}:${Account}:license-configuration:${LicenseConfigurationId}


name: inference-scheduler
arn:
arn:${Partition}:lookoutequipment:${Region}:${Account}:inference-scheduler/${InferenceSchedulerName}/${InferenceSchedulerId}


name: MetricSet
arn:
arn:${Partition}:lookoutmetrics:${Region}:${Account}:MetricSet/${AnomalyDetectorName}/${MetricSetName}


name: packaging-configurations
arn:
arn:${Partition}:mediapackage-vod:${Region}:${Account}:packaging-configurations/${PackagingConfigurationIdentifier}


name: ReplicationConfigurationTemplateResource
arn:
arn:${Partition}:mgn:${Region}:${Account}:replication-configuration-template/${replicationConfigurationTemplateID}


name: handshake
arn:
arn:${Partition}:organizations::${MasterAccountId}:handshake/o-${OrganizationId}/${HandshakeType}/h-${HandshakeId}


name: organizationalunit
arn:
arn:${Partition}:organizations::${MasterAccountId}:ou/o-${OrganizationId}/ou-${OrganizationalUnitId}


name: policy
arn:
arn:${Partition}:organizations::${MasterAccountId}:policy/o-${OrganizationId}/${PolicyType}/p-${PolicyId}


name: environment-template-version
arn:
arn:${Partition}:proton:${Region}:${Account}:environment-template/${TemplateName}:${MajorVersion}.${MinorVersion}


name: environment-template-minor-version
arn:
arn:${Partition}:proton:${Region}:${Account}:environment-template/${TemplateName}:${MajorVersionId}.${MinorVersionId}


name: service-template-version
arn:
arn:${Partition}:proton:${Region}:${Account}:service-template/${TemplateName}:${MajorVersion}.${MinorVersion}


name: service-template-minor-version
arn:
arn:${Partition}:proton:${Region}:${Account}:service-template/${TemplateName}:${MajorVersionId}.${MinorVersionId}


name: datashare
arn:
arn:${Partition}:redshift:${Region}:${Account}:datashare:${ProducerClusterNamespace}/{DataShareName}


name: securitygroup
arn:
arn:${Partition}:redshift:${Region}:${Account}:securitygroup:${SecurityGroupName}/ec2securitygroup/${Owner}/${Ec2SecurityGroupId}


name: securitygroupingress-cidr
arn:
arn:${Partition}:redshift:${Region}:${Account}:securitygroupingress:${SecurityGroupName}/cidrip/${IpRange}


name: securitygroupingress-ec2securitygroup
arn:
arn:${Partition}:redshift:${Region}:${Account}:securitygroupingress:${SecurityGroupName}/ec2securitygroup/${Owner}/${Ece2SecuritygroupId}


name: projectversion
arn:
arn:${Partition}:rekognition:${Region}:${Account}:project/${ProjectName}/version/${VersionName}/${CreationTimestamp}


name: robotApplication
arn:
arn:${Partition}:robomaker:${Region}:${Account}:robot-application/${ApplicationName}/${CreatedOnEpoch}


name: simulationApplication
arn:
arn:${Partition}:robomaker:${Region}:${Account}:simulation-application/${ApplicationName}/${CreatedOnEpoch}


name: routingcontrol
arn:
arn:${Partition}:route53-recovery-control::${Account}:controlpanel/${ControlPanelId}/routingcontrol/${RoutingControlId}


name: safetyrule
arn:
arn:${Partition}:route53-recovery-control::${Account}:controlpanel/${ControlPanelId}/safetyrule/${SafetyRuleId}


name: accesspoint
arn:
arn:${Partition}:s3-outposts:${Region}:${Account}:outpost/${OutpostId}/accesspoint/${AccessPointName}


name: object
arn:
arn:${Partition}:s3-outposts:${Region}:${Account}:outpost/${OutpostId}/bucket/${BucketName}/object/${ObjectName}


name: device
arn:
arn:${Partition}:sagemaker:${Region}:${Account}:device-fleet/${DeviceFleetName}/device/${DeviceName}


name: app
arn:
arn:${Partition}:sagemaker:${Region}:${Account}:app/${DomainId}/${UserProfileName}/${AppType}/${AppName}


name: notebook-instance-lifecycle-config
arn:
arn:${Partition}:sagemaker:${Region}:${Account}:notebook-instance-lifecycle-config/${NotebookInstanceLifecycleConfigName}


name: hyper-parameter-tuning-job
arn:
arn:${Partition}:sagemaker:${Region}:${Account}:hyper-parameter-tuning-job/${HyperParameterTuningJobName}


name: data-quality-job-definition
arn:
arn:${Partition}:sagemaker:${Region}:${Account}:data-quality-job-definition/${DataQualityJobDefinitionName}


name: model-quality-job-definition
arn:
arn:${Partition}:sagemaker:${Region}:${Account}:model-quality-job-definition/${ModelQualityJobDefinitionName}


name: model-bias-job-definition
arn:
arn:${Partition}:sagemaker:${Region}:${Account}:model-bias-job-definition/${ModelBiasJobDefinitionName}


name: model-explainability-job-definition
arn:
arn:${Partition}:sagemaker:${Region}:${Account}:model-explainability-job-definition/${ModelExplainabilityJobDefinitionName}


name: automation-definition
arn:
arn:${Partition}:ssm:${Region}:${Account}:automation-definition/${AutomationDefinitionName}:${VersionId}


name: contactchannel
arn:
arn:${Partition}:ssm-contacts:${Region}:${Account}:contactchannel/${ContactAlias}/${ContactChannelId}


name: RawMessage
arn:
arn:${Partition}:workmailmessageflow:${Region}:${Account}:message/${OrganizationId}/${Context}/${MessageId}


name: opensearchservice_role
arn:
arn:${Partition}:iam::${Account}:role/aws-service-role/opensearchservice.amazonaws.com/AWSServiceRoleForAmazonOpenSearchService


name: storage-virtual-machine
arn:
arn:${Partition}:fsx:${Region}:${Account}:storage-virtual-machine/${FileSystemId}/${StorageVirtualMachineId}


name: worker configuration
arn:
arn:${Partition}:kafkaconnect:${Region}:${Account}:worker-configuration/${WorkerConfigurationName}/${UUID}


name: data-integration-association
arn:
arn:${Partition}:app-integrations:${Region}:${Account}:data-integration-association/${DataIntegrationId}/${ResourceId}


name: es_role
arn:
arn:${Partition}:iam::${Account}:role/aws-service-role/es.amazonaws.com/AWSServiceRoleForAmazonOpenSearchService


name: channel-flow
arn:
arn:${Partition}:chime:${Region}:${AccountId}:app-instance/${AppInstanceId}/channel-flow/${ChannelFlowId}


name: ComponentResource
arn:
arn:${Partition}:amplifyuibuilder:${Region}:${Account}:app/${AppId}/environment/${EnvironmentName}/components/${Id}


name: ThemeResource
arn:
arn:${Partition}:amplifyuibuilder:${Region}:${Account}:app/${AppId}/environment/${EnvironmentName}/themes/${Id}


name: assessmentControlSet
arn:
arn:${Partition}:auditmanager:${Region}:${Account}:assessment/${AssessmentId}/ControlSet/${ControlSetId}


name: contact-flow-module
arn:
arn:${Partition}:connect:${Region}:${Account}:instance/${InstanceId}/flow-module/${ContactFlowModuleId}


name: ReplicationConfigurationTemplateResource
arn:
arn:${Partition}:drs:${Region}:${Account}:replication-configuration-template/${ReplicationConfigurationTemplateID}


name: Feature
arn:
arn:${Partition}:evidently:${Region}:${OwnerAccountId}:project/${ProjectName}/feature/${FeatureName}


name: Experiment
arn:
arn:${Partition}:evidently:${Region}:${OwnerAccountId}:project/${ProjectName}/experiment/${ExperimentName}


name: DestinationRelationshipResource
arn:
arn:${Partition}:iotroborunner:${Region}:${Account}:destination-relationship/${DestinationRelationshipId}


name: componentType
arn:
arn:${Partition}:iottwinmaker:${Region}:${Account}:workspace/${WorkspaceId}/component-type/${ComponentTypeId}


name: ReplicationConfigurationTemplateResource
arn:
arn:${Partition}:mgn:${Region}:${Account}:replication-configuration-template/${ReplicationConfigurationTemplateID}


name: application
arn:
arn:${Partition}:refactor-spaces:${Region}:${Account}:environment/${EnvironmentId}/application/${ApplicationId}


name: service
arn:
arn:${Partition}:refactor-spaces:${Region}:${Account}:environment/${EnvironmentId}/application/${ApplicationId}/service/${ServiceId}


name: route
arn:
arn:${Partition}:refactor-spaces:${Region}:${Account}:environment/${EnvironmentId}/application/${ApplicationId}/route/${RouteId}


name: dataset
arn:
arn:${Partition}:rekognition:${Region}:${Account}:project/${ProjectName}/${CreationTimestamp}/dataset/${DatasetType}/${CreationTimestamp}


name: recommendation-template
arn:
arn:${Partition}:resiliencehub:${Region}:${Account}:recommendation-template/${RecommendationTemplateID}


name: inference-recommendations-job
arn:
arn:${Partition}:sagemaker:${Region}:${Account}:inference-recommendations-job/${InferenceRecommendationsJobName}


# condition

name: apigateway:Request/AccessLoggingDestination
type: String
description:
Filters access by access log destination. Available during the CreateStage and UpdateStage operations


name: apigateway:Request/ApiKeyRequired
type: ArrayOfBool
description:
Filters access based on whether an API key is required or not. Available during the CreateMethod and PutMethod operations. Also available as a collection during import and reimport


name: apigateway:Request/AuthorizerType
type: ArrayOfString
description:
Filters access by type of authorizer in the request, for example TOKEN, REQUEST, JWT. Available during CreateAuthorizer and UpdateAuthorizer. Also available during import and reimport as an ArrayOfString


name: apigateway:Request/AuthorizerUri
type: ArrayOfString
description:
Filters access by URI of a Lambda authorizer function. Available during CreateAuthorizer and UpdateAuthorizer. Also available during import and reimport as an ArrayOfString


name: apigateway:Request/DisableExecuteApiEndpoint
type: Bool
description:
Filters access by status of the default execute-api endpoint. Available during the CreateRestApi and DeleteRestApi operations


name: apigateway:Request/EndpointType
type: ArrayOfString
description:
Filters access by endpoint type. Available during the CreateDomainName, UpdateDomainName, CreateRestApi, and UpdateRestApi operations


name: apigateway:Request/MtlsTrustStoreUri
type: String
description:
Filters access by URI of the truststore used for mutual TLS authentication. Available during the CreateDomainName and UpdateDomainName operations


name: apigateway:Request/MtlsTrustStoreVersion
type: String
description:
Filters access by version of the truststore used for mutual TLS authentication. Available during the CreateDomainName and UpdateDomainName operations


name: apigateway:Request/RouteAuthorizationType
type: ArrayOfString
description:
Filters access by authorization type, for example NONE, AWS_IAM, CUSTOM, JWT, COGNITO_USER_POOLS. Available during the CreateMethod and PutMethod operations Also available as a collection during import


name: apigateway:Request/StageName
type: String
description:
Filters access by stage name of the deployment that you attempt to create. Available during the CreateDeployment operation


name: apigateway:Resource/AccessLoggingDestination
type: String
description:
Filters access by access log destination of the current Stage resource. Available during the UpdateStage and DeleteStage operations


name: apigateway:Resource/AccessLoggingFormat
type: String
description:
Filters access by access log format of the current Stage resource. Available during the UpdateStage and DeleteStage operations


name: apigateway:Resource/ApiKeyRequired
type: ArrayOfBool
description:
Filters access based on whether an API key is required or not for the existing Method resource. Available during the PutMethod and DeleteMethod operations. Also available as a collection during reimport


name: apigateway:Resource/ApiName
type: String
description:
Filters access by API name of the existing RestApi resource. Available during UpdateRestApi and DeleteRestApi operations


name: apigateway:Resource/AuthorizerType
type: ArrayOfString
description:
Filters access by the current type of authorizer, for example TOKEN, REQUEST, JWT. Available during UpdateAuthorizer and DeleteAuthorizer operations. Also available during reimport as an ArrayOfString


name: apigateway:Resource/AuthorizerUri
type: ArrayOfString
description:
Filters access by URI of a Lambda authorizer function. Available during UpdateAuthorizer and DeleteAuthorizer operations. Also available during reimport as an ArrayOfString


name: apigateway:Resource/DisableExecuteApiEndpoint
type: Bool
description:
Filters access by status of the default execute-api endpoint of the current RestApi resource. Available during UpdateRestApi and DeleteRestApi operations


name: apigateway:Resource/EndpointType
type: ArrayOfString
description:
Filters access by endpoint type. Available during the UpdateDomainName, DeleteDomainName, UpdateRestApi, and DeleteRestApi operations


name: apigateway:Resource/MtlsTrustStoreUri
type: String
description:
Filters access by URI of the truststore used for mutual TLS authentication. Available during UpdateDomainName and DeleteDomainName operations


name: apigateway:Resource/MtlsTrustStoreVersion
type: String
description:
Filters access by version of the truststore used for mutual TLS authentication. Available during UpdateDomainName and DeleteDomainName operations


name: apigateway:Resource/RouteAuthorizationType
type: ArrayOfString
description:
Filters access by authorization type of the existing Method resource, for example NONE, AWS_IAM, CUSTOM, JWT, COGNITO_USER_POOLS. Available during the PutMethod and DeleteMethod operations. Also available as a collection during reimport


name: apigateway:Request/ApiKeyRequired
type: ArrayOfBool
description:
Filters access based on whether an API key is required or not. Available during the CreateRoute and UpdateRoute operations. Also available as a collection during import and reimport


name: apigateway:Request/AuthorizerType
type: ArrayOfString
description:
Filters access by type of authorizer in the request, for example REQUEST or JWT. Available during CreateAuthorizer and UpdateAuthorizer. Also available during import and reimport as an ArrayOfString


name: apigateway:Request/DisableExecuteApiEndpoint
type: Bool
description:
Filters access by status of the default execute-api endpoint. Available during the CreateApi and UpdateApi operations


name: apigateway:Request/EndpointType
type: String
description:
Filters access by endpoint type. Available during the CreateDomainName, UpdateDomainName, CreateApi, and UpdateApi operations


name: apigateway:Request/RouteAuthorizationType
type: ArrayOfString
description:
Filters access by authorization type, for example NONE, AWS_IAM, CUSTOM, JWT. Available during the CreateRoute and UpdateRoute operations. Also available as a collection during import


name: apigateway:Resource/ApiKeyRequired
type: ArrayOfBool
description:
Filters access based on whether an API key is required or not for the existing Route resource. Available during the UpdateRoute and DeleteRoute operations. Also available as a collection during reimport


name: apigateway:Resource/AuthorizerType
type: ArrayOfString
description:
Filters access by the current type of authorizer, for example REQUEST or JWT. Available during UpdateAuthorizer and DeleteAuthorizer operations. Also available during import and reimport as an ArrayOfString


name: apigateway:Resource/AuthorizerUri
type: ArrayOfString
description:
Filters access by the URI of the current Lambda authorizer associated with the current API. Available during UpdateAuthorizer and DeleteAuthorizer. Also available as a collection during reimport


name: apigateway:Resource/DisableExecuteApiEndpoint
type: Bool
description:
Filters access by status of the default execute-api endpoint. Available during the UpdateApi and DeleteApi operations


name: apigateway:Resource/EndpointType
type: String
description:
Filters access by endpoint type. Available during the UpdateDomainName, DeleteDomainName, UpdateApi, and DeleteApi operations


name: apigateway:Resource/MtlsTrustStoreUri
type: String
description:
Filters access by URI of the truststore used for mutual TLS authentication. Available during the UpdateDomainName and DeleteDomainName operations


name: apigateway:Resource/MtlsTrustStoreVersion
type: String
description:
Filters access by version of the truststore used for mutual TLS authentication. Available during the UpdateDomainName and DeleteDomainName operations


name: apigateway:Resource/RouteAuthorizationType
type: ArrayOfString
description:
ilters access by authorization type of the existing Route resource, for example NONE, AWS_IAM, CUSTOM. Available during the UpdateRoute and DeleteRoute operations. Also available as a collection during reimport


name: apigateway:Resource/SecurityPolicy
type: ArrayOfString
description:
Filters access by TLS version. Available during the UpdateDomainName and DeleteDomainName operations


name: apprunner:AutoScalingConfigurationArn
type: ARN
description:
Filters access to the CreateService and UpdateService actions based on the ARN of an associated AutoScalingConfiguration resource


name: apprunner:ConnectionArn
type: ARN
description:
Filters access to the CreateService and UpdateService actions based on the ARN of an associated Connection resource


name: autoscaling:LaunchTemplateVersionSpecified
type: Bool
description:
Filters access based on whether users can specify any version of a launch template or only the Latest or Default version


name: autoscaling:MetadataHttpTokens
type: String
description:
Filters access based on whether tokens are required when calling the instance metadata service (optional or required)


name: batch:AWSLogsCreateGroup
type: Boolean
description:
Filters access based on the specified logging driver to determine whether awslogs group will be created for the logs


name: batch:Privileged
type: Boolean
description:
Filter access based on the specified privileged parameter value that determines whether the container is given elevated privileges on the host container instance (similar to the root user)


name: cloudformation:ChangeSetName
type: String
description:
Filters actions based on an AWS CloudFormation change set name. Use to control which change sets IAM users can execute or delete


name: cloudformation:ImportResourceTypes
type: String
description:
Filters actions based on the template resource types, such as AWS::EC2::Instance. Use to control which resource types IAM users can work with when they want to import a resource into a stack


name: cloudformation:ResourceTypes
type: String
description:
Filters actions based on the template resource types, such as AWS::EC2::Instance. Use to control which resource types IAM users can work with when they create or update a stack


name: cloudformation:RoleArn
type: ARN
description:
Filters actions based on the ARN of an IAM service role. Use to control which service role IAM users can use to work with stacks or change sets


name: cloudformation:StackPolicyUrl
type: String
description:
Filters actions based on an Amazon S3 stack policy URL. Use to control which stack policies IAM users can associate with a stack during a create or update stack action


name: cloudformation:TemplateUrl
type: String
description:
Filters actions based on an Amazon S3 template URL. Use to control which templates IAM users can use when they create or update stacks


name: codestar-connections:BranchName
type: String
description:
Filters access by the branch name that is passed in the request. Applies only to UseConnection requests for access to a specific repository branch


name: codestar-connections:FullRepositoryId
type: String
description:
Filters access by the repository that is passed in the request. Applies only to UseConnection requests for access to a specific repository


name: codestar-connections:InstallationId
type: String
description:
Filters access by the third-party ID (such as the Bitbucket App installation ID for CodeStar Connections) that is used to update a Connection. Allows you to restrict which third-party App installations can be used to make a Connection


name: codestar-connections:OwnerId
type: String
description:
Filters access by the owner of the third-party repository. Applies only to UseConnection requests for access to repositories owned by a specific user


name: codestar-connections:ProviderAction
type: String
description:
Filters access by the provider action in a UseConnection request such as ListRepositories. See documentation for all valid values


name: codestar-connections:ProviderPermissionsRequired
type: String
description:
Filters access by the write permissions of a provider action in a UseConnection request. Valid types include read_only and read_write


name: codestar-connections:RepositoryName
type: String
description:
Filters access by the repository name that is passed in the request. Applies only to UseConnection requests for creating new repositories


name: comprehend:VpcSecurityGroupIds
type: ArrayOfString
description:
Filters access by the list of all VPC security group ids associated with the resource in the request


name: connect:StorageResourceType
type: String
description:
Filters access by restricting the storage resource type of the Amazon Connect instance storage configuration


name: dynamodb:ReturnConsumedCapacity
type: String
description:
Filter based on the ReturnConsumedCapacity parameter of a request. Contains either "TOTAL" or "NONE".


name: dynamodb:ReturnValues
type: String
description:
Filter based on the ReturnValues parameter of request. Contains one of the following: "ALL_OLD", "UPDATED_OLD","ALL_NEW","UPDATED_NEW", or "NONE".


name: ec2:IsLaunchTemplateResource
type: Bool
description:
Filters access by whether users are able to override resources that are specified in the launch template


name: ec2:MetadataHttpTokens
type: String
description:
Filters access by whether tokens are required when calling the instance metadata service (optional or required)


name: ec2:Phase1DHGroupNumbers
type: Numeric
description:
Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 1 IKE negotiations


name: ec2:Phase1EncryptionAlgorithms
type: String
description:
Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations


name: ec2:Phase1IntegrityAlgorithms
type: String
description:
Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 1 IKE negotiations


name: ec2:Phase2DHGroupNumbers
type: Numeric
description:
Filters access by the Diffie-Hellman group numbers that are permitted for a VPN tunnel for the phase 2 IKE negotiations


name: ec2:Phase2EncryptionAlgorithms
type: String
description:
Filters access by the encryption algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations


name: ec2:Phase2IntegrityAlgorithms
type: String
description:
Filters access by the integrity algorithms that are permitted for a VPN tunnel for the phase 2 IKE negotiations


name: ec2:PlacementGroupStrategy
type: String
description:
Filters access by the instance placement strategy used by the placement group (cluster, spread, or partition)


name: ec2:PresharedKeys
type: String
description:
Filters access by the pre-shared key (PSK) used to establish the initial IKE security association between a virtual private gateway and a customer gateway


name: ec2:RekeyFuzzPercentage
type: Numeric
description:
Filters access by the percentage of increase of the rekey window (determined by the rekey margin time) within which the rekey time is randomly selected for a VPN tunnel


name: ec2:ReservedInstancesOfferingType
type: String
description:
Filters access by the payment option of the Reserved Instance offering (No Upfront, Partial Upfront, or All Upfront)


name: ec2:RoleDelivery
type: Numeric
description:
Filters access by the version of the instance metadata service for retrieving IAM role credentials for EC2


name: ec2:VolumeIops
type: Numeric
description:
Filters access by the the number of input/output operations per second (IOPS) provisioned for the volume


name: ec2:VpceServiceOwner
type: String
description:
Filters access by the service owner of the VPC endpoint service (amazon, aws-marketplace, or an AWS account ID)


name: ec2:osuser
type: String
description:
Filters access by specifying the default user name for the AMI that you used to launch your instance


name: ecs:container-name
type: String
description:
Filters access based on the name of an Amazon ECS container which is defined in the ECS task definition


name: aws:TagKeys
type: String
description:
Filters access by the list of all the tag key names present in the request the user makes to the EKS service


name: eks:clientId
type: String
description:
Filters access by the clientId present in the associateIdentityProviderConfig request the user makes to the EKS service


name: eks:issuerUrl
type: String
description:
Filters access by the issuerUrl present in the associateIdentityProviderConfig request the user makes to the EKS service


name: elasticache:AtRestEncryptionEnabled
type: Bool
description:
Filters access by the AtRestEncryptionEnabled parameter present in the request or default false value if parameter is not present


name: elasticache:CacheNodeType
type: String
description:
Filters access by the cacheNodeType parameter present in the request. This key can be used to restrict which cache node types can be used on cluster creation or scaling operations


name: elasticache:ClusterModeEnabled
type: Bool
description:
Filters access by the cluster mode parameter present in the request. Default value for single node group (shard) creations is false


name: elasticache:EngineType
type: String
description:
Filters access by the engine type present in creation requests. For replication group creations, default engine ‘redis’ is used as key if parameter is not present


name: elasticache:MultiAZEnabled
type: Bool
description:
Filters access by the AZMode parameter, MultiAZEnabled parameter or the number of availability zones that the cluster or replication group can be placed in


name: elasticache:NumNodeGroups
type: Numeric
description:
Filters access by the NumNodeGroups or NodeGroupCount parameter specified in the request. This key can be used to restrict the number of node groups (shards) clusters can have after creation or scaling operations


name: elasticache:ReplicasPerNodeGroup
type: Numeric
description:
Filters access by the number of replicas per node group (shards) specified in creations or scaling requests


name: elasticache:TransitEncryptionEnabled
type: Bool
description:
Filters access by the TransitEncryptionEnabled parameter present in the request or default false value if parameter is not present


name: aws:RequestTag/${TagKey}
type: String
description:
Filters access to event bus and rule actions based on the allowed set of values for each of the tags


name: aws:SourceAccount
type: String
description:
Filters access to PutEvents actions based on whether the source of the request comes from a specific account


name: aws:SourceArn
type: String
description:
Filters access to PutEvents actions based on the Amazon Resource Name (ARN) of the source making the request


name: events:ManagedBy
type: String
description:
Used internally by AWS services. If a rule is created by an AWS service on your behalf, the value is the principal name of the service that created the rule


name: events:detail-type
type: String
description:
Filters access to PutEvents and PutRule actions based on the literal string of the detail-type of the event


name: events:detail.eventTypeCode
type: String
description:
Filters access to PutRule actions based on the literal string for the detail.eventTypeCode field of the event


name: events:detail.service
type: String
description:
Filters access to PutRule actions based on the literal string for the detail.service field of the event


name: events:detail.userIdentity.principalId
type: String
description:
Filters access to PutRule actions based on the literal string for the detail.useridentity.principalid field of the event


name: events:eventBusInvocation
type: String
description:
Filters access to PutEvents actions based on whether the event was generated via API or cross-account bus invocation


name: events:source
type: String
description:
Filters access to PutEvents and PutRule actions based on the AWS service or AWS partner event source that generated the event. Matches the literal string of the source field of the event


name: fis:Operations
type: ArrayOfString
description:
Filters access by the list of operations on the AWS service that is being affected by the AWS FIS action


name: glue:RoleAssumedBy
type: String
description:
Filters access by the service from which the credentials of the request is obtained by assuming the customer role


name: aws:MultiFactorAuthAge
type: Numeric
description:
Filters actions based on how long ago (in seconds) the security credentials validated by multi-factor authentication (MFA) in the request were issued using MFA


name: aws:MultiFactorAuthPresent
type: Boolean
description:
Filters actions based on whether multi-factor authentication (MFA) was used to validate the temporary security credentials that made the current request


name: aws:MultiFactorAuthAge
type: Numeric
description:
Filters access by checking how long ago (in seconds) the security credentials validated by multi-factor authentication (MFA) in the request were issued using MFA


name: aws:MultiFactorAuthPresent
type: Boolean
description:
Filters access by checking whether multi-factor authentication (MFA) was used to validate the temporary security credentials that made the current request


name: iam:PermissionsBoundary
type: String
description:
Filters access if the specified policy is set as the permissions boundary on the IAM entity (user or role)


name: iot:Delete
type: Bool
description:
Filters access by a flag indicating whether or not to also delete an IoT Tunnel immediately when making iot:CloseTunnel request


name: iot:ThingGroupArn
type: String
description:
Filters access by a list of IoT Thing Group ARNs that the destination IoT Thing belongs to for an IoT Tunnel


name: iotsitewise:assetHierarchyPath
type: String
description:
Filters access by an asset hierarchy path, which is the string of asset IDs in the asset's hierarchy, each separated by a forward slash


name: aws:TagKeys
type: String
description:
Filters access by the list of all the tag key names present in the request the user makes to the thingsgraph service.


name: aws:TagKeys
type: String
description:
Filters access based on the list of all the tag key names associated with the resource in the request


name: aws:ResourceTag/${TagKey}
type: String
description:
Filters actions based on tag key-value pairs attached to the resource. The resource tag context key will only apply to the cluster resource, not topics, groups and transactional IDs


name: aws:ResourceTag/${TagKey}
type: String
description:
Filters access to the specified AWS KMS operations based on tags assigned to the customer master key


name: kms:BypassPolicyLockoutSafetyCheck
type: Bool
description:
Filters access to the CreateKey and PutKeyPolicy operations based on the value of the BypassPolicyLockoutSafetyCheck parameter in the request


name: kms:CallerAccount
type: String
description:
Filters access to specified AWS KMS operations based on the AWS account ID of the caller. You can use this condition key to allow or deny access to all IAM users and roles in an AWS account in a single policy statement


name: kms:CustomerMasterKeySpec
type: String
description:
Filters access to an API operation based on the CustomerMasterKeySpec property of the CMK that is created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a CMK resource


name: kms:CustomerMasterKeyUsage
type: String
description:
Filters access to an API operation based on the KeyUsage property of the CMK created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a CMK resource


name: kms:DataKeyPairSpec
type: String
description:
Filters access to GenerateDataKeyPair and GenerateDataKeyPairWithoutPlaintext operations based on the value of the KeyPairSpec parameter in the request


name: kms:EncryptionAlgorithm
type: String
description:
Filters access to encryption operations based on the value of the encryption algorithm in the request


name: kms:EncryptionContextKeys
type: ArrayOfString
description:
Filters access based on the presence of specified keys in the encryption context. The encryption context is an optional element in a cryptographic operation


name: kms:ExpirationModel
type: String
description:
Filters access to the ImportKeyMaterial operation based on the value of the ExpirationModel parameter in the request


name: kms:KeyOrigin
type: String
description:
Filters access to an API operation based on the Origin property of the CMK created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a CMK resource


name: kms:MessageType
type: String
description:
Filters access to the Sign and Verify operations based on the value of the MessageType parameter in the request


name: kms:MultiRegion
type: Bool
description:
Filters access to an API operation based on the MultiRegion property of the CMK created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a CMK resource


name: kms:MultiRegionKeyType
type: String
description:
Filters access to an API operation based on the MultiRegionKeyType property of the CMK created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a CMK resource


name: kms:PrimaryRegion
type: String
description:
Filters access to the UpdatePrimaryRegion operation based on the value of the PrimaryRegion parameter in the request


name: kms:ReEncryptOnSameKey
type: Bool
description:
Filters access to the ReEncrypt operation when it uses the same customer master key that was used for the Encrypt operation


name: kms:ReplicaRegion
type: String
description:
Filters access to the ReplicateKey operation based on the value of the ReplicaRegion parameter in the request


name: kms:RequestAlias
type: String
description:
Filters access to cryptographic operations, DescribeKey, and GetPublicKey based on the alias in the request


name: kms:ResourceAliases
type: ArrayOfString
description:
Filters access to specified AWS KMS operations based on aliases associated with the customer master key


name: kms:ValidTo
type: Date
description:
Filters access to the ImportKeyMaterial operation based on the value of the ValidTo parameter in the request. You can use this condition key to allow users to import key material only when it expires by the specified date


name: kms:WrappingAlgorithm
type: String
description:
Filters access to the GetParametersForImport operation based on the value of the WrappingAlgorithm parameter in the request


name: kms:WrappingKeySpec
type: String
description:
Filters access to the GetParametersForImport operation based on the value of the WrappingKeySpec parameter in the request


name: aws:TagKeys
type: String
description:
Filters access by the list of all the tag key names present in the request the user makes to the pinpoint service.


name: aws:RequestTag/${TagKey}
type: String
description:
Filters access based on the tags that are passed in the request when creating or tagging a resource share. If users don't pass these specific tags, or if they don't specify tags at all, the request fails


name: ram:AllowsExternalPrincipals
type: Bool
description:
Filters access based on resource shares that allow or deny sharing with external principals. For example, specify true if the action can only be performed on resource shares that allow sharing with external principals. External principals are AWS accounts that are outside of its AWS organization


name: ram:RequestedAllowsExternalPrincipals
type: Bool
description:
Filters access based on the specified value for 'allowExternalPrincipals'. External principals are AWS accounts that are outside of its AWS Organization


name: ram:ShareOwnerAccountId
type: String
description:
Filters access based on resource shares owned by a specific account. For example, you can use this condition key to specify which resource share invitations can be accepted or rejected based on the resource share owner’s account ID


name: rds:DatabaseEngine
type: String
description:
Filters access by the database engine. For possible values refer to the engine parameter in CreateDBInstance API


name: rds:MultiAz
type: Boolean
description:
Filters access by the value that specifies whether the DB instance runs in multiple Availability Zones. To indicate that the DB instance is using Multi-AZ, specify true


name: rds:Piops
type: Numeric
description:
Filters access by the value that contains the number of Provisioned IOPS (PIOPS) that the instance supports. To indicate a DB instance that does not have PIOPS enabled, specify 0


name: rds:StorageEncrypted
type: Boolean
description:
Filters access by the value that specifies whether the DB instance storage should be encrypted. To enforce storage encryption, specify true


name: rds:Vpc
type: Boolean
description:
Filters access by the value that specifies whether the DB instance runs in an Amazon Virtual Private Cloud (Amazon VPC). To indicate that the DB instance runs in an Amazon VPC, specify true


name: s3:JobSuspendedCause
type: String
description:
Filters access to cancelling suspended jobs by a specific job suspended cause (for example, AWAITING_CONFIRMATION)


name: s3:x-amz-website-redirect-location
type: String
description:
Filters access by a specific website redirect location for buckets that are configured as static websites


name: s3-outposts:signatureAge
type: Numeric
description:
Filters access by identifying the length of time, in milliseconds, that a signature is valid in an authenticated request


name: s3-outposts:signatureversion
type: String
description:
Filters access by identifying the version of AWS Signature that is supported for authenticated requests


name: s3-outposts:x-amz-metadata-directive
type: String
description:
Filters access by enabling enforcement of object metadata behavior (COPY or REPLACE) when objects are copied


name: sagemaker:FeatureGroupOfflineStoreKmsKey
type: ARN
description:
Filters access by the offline store kms key associated with the feature group resource in the request


name: sagemaker:FeatureGroupOfflineStoreS3Uri
type: String
description:
Filters access by the offline store s3 uri associated with the feature group resource in the request


name: sagemaker:FeatureGroupOnlineStoreKmsKey
type: ARN
description:
Filters access by the online store kms key associated with the feature group resource in the request


name: sagemaker:InterContainerTrafficEncryption
type: Bool
description:
Filters access by the inter container traffic encryption associated with the resource in the request


name: sagemaker:WorkteamType
type: String
description:
Filters access by the workteam type associated to the request. This can be public-crowd, private-crowd or vendor-crowd


name: aws:RequestTag/tag-key
type: String
description:
Filters access by a key that is present in the request the user makes to the Secrets Manager service.


name: aws:TagKeys
type: String
description:
Filters access by the list of all the tag key namespresent in the request the user makes to the Secrets Manager service.


name: servicecatalog:roleLevel
type: String
description:
Filters users to see and perform actions on resources created either by them or by anyone federating into the same role as them


name: ses:FeedbackAddress
type: String
description:
Filters actions based on the "Return-Path" address, which specifies where bounces and complaints are sent by email feedback forwarding


name: ses:Recipients
type: ArrayOfString
description:
Filters actions based on the recipient addresses of a message, which include the "To", "CC", and "BCC" addresses


name: sns:Endpoint
type: String
description:
Filters access based on the URL, email address, or ARN from a Subscribe request or a previously confirmed subscription


name: sns:Protocol
type: String
description:
Filters access based on the protocol value from a Subscribe request or a previously confirmed subscription


name: ssm:SessionDocumentAccessCheck
type: Boolean
description:
Filters access by verifying that a user has permission to access either the default Session Manager configuration document or the custom configuration document specified in a request


name: ssm:SyncType
type: String
description:
Filters access by verifying that a user also has access to the ResourceDataSync SyncType specified in the request


name: swf:typeFilter.name
type: String
description:
Constrains the policy statement to only requests that specify a type filter with the specified name.


name: swf:typeFilter.version
type: String
description:
Constrains the policy statement to only requests that specify a type filter with the specified version.


name: swf:workflowType.name
type: String
description:
Constrains the policy statement to only requests that specify a workflow type of the specified name.


name: swf:workflowType.version
type: String
description:
Constrains the policy statement to only requests that specify a workflow type of the specified version.


name: fsx:StorageVirtualMachineId
type: String
description:
Filters access by the containing storage virtual machine for a volume for mutating volume operations


name: kms:CustomerMasterKeySpec
type: String
description:
The kms:CustomerMasterKeySpec condition key is deprecated. Instead, use the kms:KeySpec condition key.


name: kms:CustomerMasterKeyUsage
type: String
description:
The kms:CustomerMasterKeyUsage condition key is deprecated. Instead, use the kms:KeyUsage condition key.


name: kms:KeyOrigin
type: String
description:
Filters access to an API operation based on the Origin property of the AWS KMS key created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a KMS key


name: kms:KeySpec
type: String
description:
Filters access to an API operation based on the KeySpec property of the AWS KMS key that is created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a KMS key resource


name: kms:KeyUsage
type: String
description:
Filters access to an API operation based on the KeyUsage property of the AWS KMS key created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a KMS key resource


name: kms:MultiRegion
type: Bool
description:
Filters access to an API operation based on the MultiRegion property of the AWS KMS key created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a KMS key resource


name: kms:MultiRegionKeyType
type: String
description:
Filters access to an API operation based on the MultiRegionKeyType property of the AWS KMS key created by or used in the operation. Use it to qualify authorization of the CreateKey operation or any operation that is authorized for a KMS key resource


name: kms:ReEncryptOnSameKey
type: Bool
description:
Filters access to the ReEncrypt operation when it uses the same AWS KMS key that was used for the Encrypt operation


name: aws:RequestTag/${TagKey}
type: String
description:
Filters access by a key that is present in the request the user makes to the customer profile service


name: aws:TagKeys
type: String
description:
Filters access by the list of all the tag key names present in the request the user makes to the customer profile service


name: aws-marketplace:ProductId
type: String
description:
Filters access to AWS Marketplace RedHat OpenShift products in the RedHat console, based on the ProductID of the product. Note: This condition key only applies to the RedHat console, and using it will not allow access to products in AWS Marketplace.


name: cloudformation:ChangeSetName
type: String
description:
Filters access by an AWS CloudFormation change set name. Use to control which change sets IAM users can execute or delete


name: cloudformation:ImportResourceTypes
type: String
description:
Filters access by the template resource types, such as AWS::EC2::Instance. Use to control which resource types IAM users can work with when they want to import a resource into a stack


name: cloudformation:ResourceTypes
type: String
description:
Filters access by the template resource types, such as AWS::EC2::Instance. Use to control which resource types IAM users can work with when they create or update a stack


name: cloudformation:RoleArn
type: ARN
description:
Filters access by the ARN of an IAM service role. Use to control which service role IAM users can use to work with stacks or change sets


name: cloudformation:StackPolicyUrl
type: String
description:
Filters access by an Amazon S3 stack policy URL. Use to control which stack policies IAM users can associate with a stack during a create or update stack action


name: cloudformation:TargetRegion
type: ArrayOfString
description:
Filters access by stack set target region. Use to control which regions IAM users can use when they create or update stack sets


name: cloudformation:TemplateUrl
type: String
description:
Filters access by an Amazon S3 template URL. Use to control which templates IAM users can use when they create or update stacks


name: batch:AWSLogsCreateGroup
type: Bool
description:
Filters access by the specified logging driver to determine whether awslogs group will be created for the logs


name: batch:Privileged
type: Bool
description:
Filters access by the specified privileged parameter value that determines whether the container is given elevated privileges on the host container instance (similar to the root user)


name: dynamodb:ReturnConsumedCapacity
type: String
description:
Filter based on the ReturnConsumedCapacity parameter of a request. Contains either "TOTAL" or "NONE"


name: dynamodb:ReturnValues
type: String
description:
Filter based on the ReturnValues parameter of request. Contains one of the following: "ALL_OLD", "UPDATED_OLD","ALL_NEW","UPDATED_NEW", or "NONE"


name: aws:SourceArn
type: String
description:
Filters access by the Amazon Resource Name (ARN) of the source making the request to PutEvents actions


name: events:ManagedBy
type: String
description:
Filters access by AWS services. If a rule is created by an AWS service on your behalf, the value is the principal name of the service that created the rule


name: events:detail-type
type: String
description:
Filters access by the literal string of the detail-type of the event to PutEvents and PutRule actions


name: events:detail.eventTypeCode
type: String
description:
Filters access by the literal string for the detail.eventTypeCode field of the event to PutRule actions


name: events:detail.userIdentity.principalId
type: String
description:
Filters access by the literal string for the detail.useridentity.principalid field of the event to PutRule actions


name: events:eventBusInvocation
type: String
description:
Filters access by whether the event was generated via API or cross-account bus invocation to PutEvents actions


name: events:source
type: ArrayOfString
description:
Filters access by the AWS service or AWS partner event source that generated the event to PutEvents and PutRule actions. Matches the literal string of the source field of the event


name: aws:ResourceTag/${TagKey}
type: String
description:
Filters access by the tags associated with the resource that make the request on behalf of the IAM principal


name: aws:TagKeys
type: String
description:
Filters access by the list of all the tag key names present in the request the user makes to the pinpoint service


name: refactor-spaces:ApplicationCreatedByAccount
type: String
description:
Filters access by restricting the action to only those accounts that created the application within an environment


name: refactor-spaces:RouteCreatedByAccount
type: String
description:
Filters access by restricting the action to only those accounts that created the route within an application


name: refactor-spaces:ServiceCreatedByAccount
type: String
description:
Filters access by restricting the action to only those accounts that created the service within an application


name: s3:JobSuspendedCause
type: String
description:
Filters access by a specific job suspended cause (for example, AWAITING_CONFIRMATION) to cancelling suspended jobs


name: sagemaker:HomeEfsFileSystemKmsKey
type: ARN
description:
Filters access by a key that is present in the request the user makes to the SageMaker service. This key is deprecated. It has been replaced by sagemaker:VolumeKmsKey


name: aws:RequestTag/${TagKey}
type: String
description:
Filters access by a key that is present in the request the user makes to the Secrets Manager service


name: aws:TagKeys
type: String
description:
Filters access by the list of all the tag key namespresent in the request the user makes to the Secrets Manager service


name: servicecatalog:roleLevel
type: String
description:
Filters access by user to see and perform actions on resources created either by them or by anyone federating into the same role as them


