Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Step Functions

AWS Step Functions (service prefix: states) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Step Functions
Actions defined by AWS Step Functions
Permission-only actions for AWS Step Functions
Resource types defined by AWS Step Functions
Condition keys for AWS Step Functions

API operations defined by AWS Step Functions

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateActivity	states:CreateActivity			Write
CreateActivity	states:TagResource			Tagging, Write
CreateStateMachine	states:CreateStateMachine			Write
	states:PublishStateMachineVersion			Write
	states:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	states.amazonaws.com	Write
CreateStateMachineAlias	states:CreateStateMachineAlias			Write
DeleteActivity	states:DeleteActivity			Write
DeleteStateMachine	states:DeleteStateMachine			Write
DeleteStateMachineAlias	states:DeleteStateMachineAlias			Write
DeleteStateMachineVersion	states:DeleteStateMachineVersion			Write
DescribeActivity	states:DescribeActivity			Read
DescribeExecution	states:DescribeExecution			Read
DescribeMapRun	states:DescribeMapRun			Read
DescribeStateMachine	states:DescribeStateMachine			Read
DescribeStateMachineAlias	states:DescribeStateMachineAlias			Read
DescribeStateMachineForExecution	states:DescribeStateMachineForExecution			Read
GetActivityTask	states:GetActivityTask			Write
GetExecutionHistory	states:GetExecutionHistory			Read
ListActivities	states:ListActivities			List
ListExecutions	states:ListExecutions			List
ListMapRuns	states:ListMapRuns			List
ListStateMachineAliases	states:ListStateMachineAliases			List
ListStateMachineVersions	states:ListStateMachineVersions			List
ListStateMachines	states:ListStateMachines			List
ListTagsForResource	states:ListTagsForResource			List
PublishStateMachineVersion	states:PublishStateMachineVersion			Write
RedriveExecution	states:RedriveExecution			Write
SendTaskFailure	states:SendTaskFailure			Write
SendTaskHeartbeat	states:SendTaskHeartbeat			Write
SendTaskSuccess	states:SendTaskSuccess			Write
StartExecution	states:DescribeExecution			Read
StartExecution	states:StartExecution			Write
StartSyncExecution	states:StartSyncExecution			Write
StopExecution	states:StopExecution			Write
TagResource	states:TagResource			Tagging, Write
TestState	states:RevealSecrets			Read
	states:TestState			Write
	iam:PassRole	iam:PassedToService	states.amazonaws.com	Write
UntagResource	states:UntagResource			Tagging, Write
UpdateMapRun	states:UpdateMapRun