Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS CloudHSM

AWS CloudHSM (service prefix: cloudhsm) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS CloudHSM

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Access level
CreateHsm	cloudhsm	cloudhsm:CreateHsm	Write
		ec2:AuthorizeSecurityGroupEgress	Write
		ec2:AuthorizeSecurityGroupIngress	Write
		ec2:CreateNetworkInterface	Write
		ec2:CreateSecurityGroup	Write
		ec2:DeleteNetworkInterface	Write
		ec2:DescribeNetworkInterfaces	List
		ec2:DescribeSecurityGroups	List
		ec2:DescribeSubnets	List
		ec2:RevokeSecurityGroupEgress	Write
DeleteHsm	cloudhsm	cloudhsm:DeleteHsm	Write
DeleteHsm	cloudhsm	ec2:DeleteNetworkInterface	Write
CopyBackupToRegion	cloudhsmv2	cloudhsm:CopyBackupToRegion	Write
		cloudhsm:TagResource	Tagging, Write
		cloudhsm:UntagResource	Tagging, Write
CreateCluster	cloudhsmv2	cloudhsm:CreateCluster	Write
		cloudhsm:TagResource	Tagging, Write
		ec2:AuthorizeSecurityGroupEgress	Write
		ec2:AuthorizeSecurityGroupIngress	Write
		ec2:CreateSecurityGroup	Write
		ec2:DescribeSecurityGroups	List
		ec2:DescribeSubnets	List
		ec2:RevokeSecurityGroupEgress	Write
CreateHsm	cloudhsmv2	cloudhsm:CreateHsm	Write
		ec2:AuthorizeSecurityGroupEgress	Write
		ec2:AuthorizeSecurityGroupIngress	Write
		ec2:CreateNetworkInterface	Write
		ec2:CreateSecurityGroup	Write
		ec2:DeleteNetworkInterface	Write
		ec2:DescribeNetworkInterfaces	List
		ec2:DescribeSecurityGroups	List
		ec2:DescribeSubnets	List
		ec2:RevokeSecurityGroupEgress	Write
DeleteBackup	cloudhsmv2	cloudhsm:DeleteBackup	Write
DeleteCluster	cloudhsmv2	cloudhsm:DeleteCluster	Write
DeleteHsm	cloudhsmv2	cloudhsm:DeleteHsm	Write
DeleteHsm	cloudhsmv2	ec2:DeleteNetworkInterface	Write
DeleteResourcePolicy	cloudhsmv2	cloudhsm:DeleteResourcePolicy	Permissions management, Write
DescribeBackups	cloudhsmv2	cloudhsm:DescribeBackups	Read