Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Identity and Access Management (IAM)

AWS Identity and Access Management (IAM) (service prefix: iam) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Identity and Access Management (IAM)
Actions defined by AWS Identity and Access Management (IAM)
Permission-only actions for AWS Identity and Access Management (IAM)
Resource types defined by AWS Identity and Access Management (IAM)
Condition keys for AWS Identity and Access Management (IAM)

API operations defined by AWS Identity and Access Management (IAM)

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
AcceptDelegationRequest	iam	iam:AcceptDelegationRequest			Write
AcquireRole	iam	iam:AttachRolePolicy			Permissions management, Write
		iam:CreateRole			Write
		iam:GetRole			Read
		iam:GetRoleTemplateVersion			Read
		iam:PutRolePermissionsBoundary			Permissions management, Write
		iam:PutRolePolicy			Permissions management, Write
		iam:TagRole			Tagging, Write
AddClientIDToOpenIDConnectProvider	iam	iam:AddClientIDToOpenIDConnectProvider			Write
AddRoleToInstanceProfile	iam	iam:AddRoleToInstanceProfile			Write
AddRoleToInstanceProfile	iam	iam:PassRole	iam:PassedToService	ec2.amazonaws.com	Write
AddUserToGroup	iam	iam:AddUserToGroup			Write
AssociateDelegationRequest	iam	iam:AssociateDelegationRequest			Write
AttachGroupPolicy	iam	iam:AttachGroupPolicy			Permissions management, Write
AttachRolePolicy	iam	iam:AttachRolePolicy			Permissions management, Write
AttachUserPolicy	iam	iam:AttachUserPolicy			Permissions management, Write
ChangePassword	iam	iam:ChangePassword			Write
CreateAccessKey	iam	iam:CreateAccessKey			Write
CreateAccountAlias	iam	iam:CreateAccountAlias			Write
CreateDelegationRequest	iam	iam:CreateDelegationRequest			Write
CreateGroup	iam	iam:CreateGroup			Write
CreateInstanceProfile	iam	iam:CreateInstanceProfile			Write
CreateInstanceProfile	iam	iam:TagInstanceProfile			Tagging, Write
CreateLoginProfile	iam	iam:CreateLoginProfile			Write
CreateOpenIDConnectProvider	iam	iam:CreateOpenIDConnectProvider			Write
CreateOpenIDConnectProvider	iam	iam:TagOpenIDConnectProvider			Tagging, Write
CreatePolicy	iam	iam:CreatePolicy			Permissions management, Write
CreatePolicy	iam	iam:TagPolicy			Tagging, Write
CreatePolicyVersion	iam	iam:CreatePolicyVersion			Permissions management, Write
CreateRole	iam	iam:CreateRole			Write
CreateRole	iam	iam:TagRole			Tagging, Write
CreateSAMLProvider	iam	iam:CreateSAMLProvider			Write
CreateSAMLProvider	iam	iam:TagSAMLProvider			Tagging, Write
CreateServiceLinkedRole	iam	iam:CreateServiceLinkedRole			Write
CreateServiceLinkedRole	iam	iam:PutRolePolicy			Permissions management, Write
CreateServiceSpecificCredential