Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS CloudTrail

AWS CloudTrail (service prefix: cloudtrail) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS CloudTrail
Actions defined by AWS CloudTrail
Permission-only actions for AWS CloudTrail
Resource types defined by AWS CloudTrail
Condition keys for AWS CloudTrail

API operations defined by AWS CloudTrail

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AddTags	cloudtrail:AddTags			Tagging, Write
CancelQuery	cloudtrail:CancelQuery			Write
CreateChannel	cloudtrail:AddTags			Tagging, Write
CreateChannel	cloudtrail:CreateChannel			Write
CreateDashboard	cloudtrail:AddTags			Tagging, Write
	cloudtrail:CreateDashboard			Write
	cloudtrail:StartDashboardRefresh			Write
	cloudtrail:StartQuery			Write
CreateEventDataStore	cloudtrail:AddTags			Tagging, Write
CreateEventDataStore	cloudtrail:CreateEventDataStore			Write
CreateTrail	cloudtrail:AddTags			Tagging, Write
	cloudtrail:CreateTrail			Write
	iam:PassRole	iam:PassedToService	cloudtrail.amazonaws.com, cloudtrail.preprod.amazonaws.com	Write
DeleteChannel	cloudtrail:DeleteChannel			Write
DeleteDashboard	cloudtrail:DeleteDashboard			Write
DeleteEventDataStore	cloudtrail:DeleteEventDataStore			Write
DeleteResourcePolicy	cloudtrail:DeleteResourcePolicy			Write
DeleteTrail	cloudtrail:DeleteTrail			Write
DeregisterOrganizationDelegatedAdmin	cloudtrail:DeregisterOrganizationDelegatedAdmin			Write
DescribeQuery	cloudtrail:DescribeQuery			Read
DescribeTrails	cloudtrail:DescribeTrails			Read
DisableFederation	cloudtrail:DisableFederation			Write
EnableFederation	cloudtrail:EnableFederation			Write
EnableFederation	iam:PassRole	iam:PassedToService	cloudtrail.amazonaws.com, cloudtrail.preprod.amazonaws.com	Write
GenerateQuery	cloudtrail:GenerateQuery			Write
GetChannel	cloudtrail:GetChannel			Read
GetDashboard	cloudtrail:GetDashboard			Read
GetEventConfiguration	cloudtrail:GetEventConfiguration			Read
GetEventDataStore	cloudtrail:GetEventDataStore			Read
GetEventSelectors	cloudtrail:GetEventSelectors			Read
GetImport	cloudtrail:GetImport			Read
GetInsightSelectors	cloudtrail:GetInsightSelectors			Read
GetQueryResults	cloudtrail:GetQueryResults			Read
GetResourcePolicy	cloudtrail:GetResourcePolicy			Read
GetTrail	cloudtrail:GetTrail			Read
GetTrailStatus	cloudtrail:GetTrailStatus			Read
ListChannels	cloudtrail:ListChannels			List
ListDashboards	cloudtrail:ListDashboards			List
ListEventDataStores	cloudtrail:ListEventDataStores			List
ListImportFailures	cloudtrail:ListImportFailures			Read
ListImports	cloudtrail:ListImports			List
ListInsightsData	cloudtrail:ListInsightsData			List
ListInsightsMetricData	cloudtrail:ListInsightsData			List
ListInsightsMetricData	cloudtrail:LookupEvents			Read
ListPublicKeys	cloudtrail:ListPublicKeys			Read
ListQueries	cloudtrail:ListQueries			List
ListTags	cloudtrail:ListTags			Read
ListTrails	cloudtrail:ListTrails			List
LookupEvents	cloudtrail:LookupEvents			Read
PutEventConfiguration	cloudtrail:PutEventConfiguration			Write
PutEventSelectors	cloudtrail:PutEventSelectors			Write
PutInsightSelectors	cloudtrail:PutInsightSelectors			Write
PutResourcePolicy	cloudtrail:PutResourcePolicy			Write
RegisterOrganizationDelegatedAdmin	cloudtrail:RegisterOrganizationDelegatedAdmin			Write
RemoveTags	cloudtrail:RemoveTags			Tagging, Write
RestoreEventDataStore	cloudtrail:RestoreEventDataStore			Write
SearchSampleQueries	cloudtrail:SearchSampleQueries			Read
StartDashboardRefresh	cloudtrail:StartDashboardRefresh			Write
StartDashboardRefresh	cloudtrail:StartQuery			Write
StartEventDataStoreIngestion	cloudtrail:StartEventDataStoreIngestion			Write
StartImport	cloudtrail:StartImport			Write
StartImport	iam:PassRole	iam:PassedToService	cloudtrail.amazonaws.com, cloudtrail.preprod.amazonaws.com	Write
StartLogging	cloudtrail:StartLogging			Write
StartQuery	cloudtrail:StartQuery			Write
StopEventDataStoreIngestion	cloudtrail:StopEventDataStoreIngestion			Write
StopImport	cloudtrail:StopImport			Write
StopLogging	cloudtrail:StopLogging			Write
UpdateChannel	cloudtrail:UpdateChannel			Write
UpdateDashboard	cloudtrail:StartDashboardRefresh			Write
	cloudtrail:StartQuery			Write
	cloudtrail:UpdateDashboard			Write
UpdateEventDataStore	cloudtrail:UpdateEventDataStore			Write
UpdateTrail	cloudtrail:UpdateTrail			Write
UpdateTrail	iam:PassRole	iam:PassedToService	cloudtrail.amazonaws.com, cloudtrail.preprod.amazonaws.com	Write

Actions defined by AWS CloudTrail

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddTags	Grants permission to add one or more tags to a trail, event data store, channel or dashboard, up to a limit of 50	channel	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
dashboard

Actions

Description

Resource types (*required)

Condition keys

Access level

AddTags

Grants permission to add one or more tags to a trail, event data store, channel or dashboard, up to a limit of 50

channel

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Tagging, Write

dashboard