Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Amplify

AWS Amplify (service prefix: amplify) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS Amplify

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateApp	amplify:CreateApp			Write
	amplify:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	amplify.amazonaws.com	Write
CreateBackendEnvironment	amplify:CreateBackendEnvironment			Write
CreateBranch	amplify:CreateBranch			Write
	amplify:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	amplify.amazonaws.com	Write
CreateDeployment	amplify:CreateDeployment			Write
CreateDomainAssociation	amplify:CreateDomainAssociation			Write
CreateDomainAssociation	iam:PassRole	iam:PassedToService	amplify.amazonaws.com	Write
CreateWebhook	amplify:CreateWebHook			Write
DeleteApp	amplify:DeleteApp			Write
DeleteBackendEnvironment	amplify:DeleteBackendEnvironment			Write
DeleteBranch	amplify:DeleteBranch			Write
DeleteDomainAssociation	amplify:DeleteDomainAssociation			Write
DeleteJob	amplify:DeleteJob			Write
DeleteWebhook	amplify:DeleteWebHook			Write
GenerateAccessLogs	amplify:GenerateAccessLogs			Write
GetApp	amplify:GetApp			Read
GetArtifactUrl	amplify:GetArtifactUrl			Read
GetBackendEnvironment	amplify:GetBackendEnvironment			Read
GetBranch	amplify:GetBranch			Read
GetDomainAssociation	amplify:GetDomainAssociation			Read
GetJob	amplify:GetJob			Read
GetWebhook	amplify:GetWebHook			Read
ListApps	amplify:ListApps			List
ListArtifacts	amplify:ListArtifacts			List
ListBackendEnvironments	amplify:ListBackendEnvironments			List
ListBranches	amplify:ListBranches			List
ListDomainAssociations	amplify:ListDomainAssociations			List
ListJobs	amplify:ListJobs			List
ListTagsForResource	amplify:ListTagsForResource			Read
ListWebhooks	amplify:ListWebHooks			List
StartDeployment	amplify:StartDeployment			Write
StartJob	amplify:StartJob			Write
StopJob	amplify:StopJob			Write
TagResource	amplify:TagResource			Tagging, Write
UntagResource	amplify:UntagResource			Tagging, Write
UpdateApp	amplify:UpdateApp			Write
UpdateApp	iam:PassRole	iam:PassedToService	amplify.amazonaws.com	Write
UpdateBranch	amplify:UpdateBranch			Write
UpdateBranch	iam:PassRole	iam:PassedToService	amplify.amazonaws.com	Write
UpdateDomainAssociation	amplify:UpdateDomainAssociation			Write
UpdateDomainAssociation	iam:PassRole	iam:PassedToService	amplify.amazonaws.com	Write
UpdateWebhook	amplify:UpdateWebHook			Write

Actions defined by AWS Amplify

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateWebACL	Grants permission to associate a WebACL to a Resource	apps*	aws:ResourceTag/${TagKey}	Write
CreateApp	Grants permission to create a new Amplify App		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateBackendEnvironment	Grants permission to create a new backend environment for an Amplify App	apps*	aws:ResourceTag/${TagKey}	Write
CreateBranch	Grants permission to create a new Branch for an Amplify App	branches*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDeployment	Grants permission to create a deployment for manual deploy apps. (Apps are not connected to repository)	branches*	aws:ResourceTag/${TagKey}	Write
CreateDomainAssociation	Grants permission to create a new DomainAssociation on an App	domains*	aws:ResourceTag/${TagKey}	Write
CreateWebHook	Grants permission to create a new webhook on an App	branches*	aws:ResourceTag/${TagKey}	Write
DeleteApp	Grants permission to delete an existing Amplify App by appId	apps*	aws:ResourceTag/${TagKey}	Write
DeleteBackendEnvironment	Grants permission to delete a branch for an Amplify App	apps*	aws:ResourceTag/${TagKey}	Write
DeleteBranch	Grants permission to delete a branch for an Amplify App	branches*	aws:ResourceTag/${TagKey}	Write
DeleteDomainAssociation	Grants permission to delete a DomainAssociation	domains*