Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS App Mesh

AWS App Mesh (service prefix: appmesh) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS App Mesh

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateGatewayRoute	appmesh:CreateGatewayRoute			Write
CreateGatewayRoute	appmesh:TagResource			Tagging, Write
CreateMesh	appmesh:CreateMesh			Write
CreateMesh	appmesh:TagResource			Tagging, Write
CreateRoute	appmesh:CreateRoute			Write
CreateRoute	appmesh:TagResource			Tagging, Write
CreateVirtualGateway	appmesh:CreateVirtualGateway			Write
CreateVirtualGateway	appmesh:TagResource			Tagging, Write
CreateVirtualNode	appmesh:CreateVirtualNode			Write
	appmesh:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	appmesh.amazonaws.com	Write
CreateVirtualRouter	appmesh:CreateVirtualRouter			Write
CreateVirtualRouter	appmesh:TagResource			Tagging, Write
CreateVirtualService	appmesh:CreateVirtualService			Write
CreateVirtualService	appmesh:TagResource			Tagging, Write
DeleteGatewayRoute	appmesh:DeleteGatewayRoute			Write
DeleteMesh	appmesh:DeleteMesh			Write
DeleteRoute	appmesh:DeleteRoute			Write
DeleteVirtualGateway	appmesh:DeleteVirtualGateway			Write
DeleteVirtualNode	appmesh:DeleteVirtualNode			Write
DeleteVirtualRouter	appmesh:DeleteVirtualRouter			Write
DeleteVirtualService	appmesh:DeleteVirtualService			Write
DescribeGatewayRoute	appmesh:DescribeGatewayRoute			Read
DescribeMesh	appmesh:DescribeMesh			Read
DescribeRoute	appmesh:DescribeRoute			Read
DescribeVirtualGateway	appmesh:DescribeVirtualGateway			Read
DescribeVirtualNode	appmesh:DescribeVirtualNode			Read
DescribeVirtualRouter	appmesh:DescribeVirtualRouter			Read
DescribeVirtualService	appmesh:DescribeVirtualService			Read
ListGatewayRoutes	appmesh:ListGatewayRoutes			List
ListMeshes	appmesh:ListMeshes			List
ListRoutes	appmesh:ListRoutes			List
ListTagsForResource	appmesh:ListTagsForResource			List
ListVirtualGateways	appmesh:ListVirtualGateways			List
ListVirtualNodes	appmesh:ListVirtualNodes			List
ListVirtualRouters	appmesh:ListVirtualRouters			List
ListVirtualServices	appmesh:ListVirtualServices			List
TagResource	appmesh:TagResource			Tagging, Write
UntagResource	appmesh:UntagResource			Tagging, Write
UpdateGatewayRoute	appmesh:UpdateGatewayRoute			Write
UpdateMesh	appmesh:UpdateMesh			Write
UpdateRoute	appmesh:UpdateRoute			Write
UpdateVirtualGateway	appmesh:UpdateVirtualGateway			Write
UpdateVirtualNode	appmesh:UpdateVirtualNode			Write
UpdateVirtualRouter	appmesh:UpdateVirtualRouter			Write
UpdateVirtualService	appmesh:UpdateVirtualService			Write

Actions defined by AWS App Mesh

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateGatewayRoute	Grants permission to create a gateway route that is associated with a virtual gateway	gatewayRoute*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateGatewayRoute		virtualService	aws:ResourceTag/${TagKey}	Write
CreateMesh	Grants permission to create a service mesh	mesh*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRoute	Grants permission to create a route that is associated with a virtual router	route*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRoute		virtualNode	aws:ResourceTag/${TagKey}	Write
CreateVirtualGateway	Grants permission to create a virtual gateway within a service mesh	virtualGateway*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateVirtualNode	Grants permission to create a virtual node within a service mesh	virtualNode*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateVirtualNode		virtualService	aws:ResourceTag/${TagKey}	Write