Actions, resources, and condition keys for AWS CodeArtifact

AWS CodeArtifact (service prefix: codeartifact) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

Actions defined by AWS CodeArtifact
Resource types defined by AWS CodeArtifact
Condition keys for AWS CodeArtifact

Actions defined by AWS CodeArtifact

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateExternalConnection	Grants permission to add an external connection to a repository	repository*	aws:ResourceTag/${TagKey}	Write
AssociateWithDownstreamRepository	Grants permission to associate an existing repository as an upstream repository to another repository	repository*	aws:ResourceTag/${TagKey}	Write
CopyPackageVersions	Grants permission to copy package versions from one repository to another repository in the same domain	package*		Write
CopyPackageVersions		repository*	aws:ResourceTag/${TagKey}	Write
CreateDomain	Grants permission to create a new domain		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreatePackageGroup	Grants permission to create a package group		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateRepository	Grants permission to create a new repository		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteDomain	Grants permission to delete a domain	domain*	aws:ResourceTag/${TagKey}	Write
DeleteDomainPermissionsPolicy	Grants permission to delete the resource policy set on a domain	domain*	aws:ResourceTag/${TagKey}	Permissions management, Write
DeletePackage	Grants permission to delete a package	package*		Write
DeletePackageGroup	Grants permission to delete a package group	package-group*	aws:ResourceTag/${TagKey}	Write
DeletePackageVersions	Grants permission to delete package versions	package*		Write
DeleteRepository	Grants permission to delete a repository	repository*	aws:ResourceTag/${TagKey}	Write
DeleteRepositoryPermissionsPolicy	Grants permission to delete the resource policy set on a repository	repository*	aws:ResourceTag/${TagKey}	Permissions management, Write
DescribeDomain	Grants permission to return information about a domain	domain*	aws:ResourceTag/${TagKey}	Read
DescribePackage	Grants permission to retrieve information about a package	package*		Read
DescribePackageGroup	Grants permission to return detailed information about a package group	package-group*	aws:ResourceTag/${TagKey}	Read
DescribePackageVersion	Grants permission to return information about a package version	package*		Read
DescribeRepository	Grants permission to return detailed information about a repository	repository*	aws:ResourceTag/${TagKey}	Read
DisassociateExternalConnection	Grants permission to disassociate an external connection from a repository	repository*	aws:ResourceTag/${TagKey}	Write
DisposePackageVersions	Grants permission to set the status of package versions to Disposed and delete their assets	package*		Write
GetAssociatedPackageGroup	Grants permission to return a package's associated package group	package-group*	aws:ResourceTag/${TagKey}	Read
GetAuthorizationToken	Grants permission to generate a temporary authentication token for accessing repositories in a domain	domain*	aws:ResourceTag/${TagKey}	Read
GetDomainPermissionsPolicy	Grants permission to return a domain's resource policy	domain*	aws:ResourceTag/${TagKey}	Read
GetPackageVersionAsset	Grants permission to return an asset (or file) that is part of a package version	package*		Read
GetPackageVersionReadme	Grants permission to return a package version's readme file	package*		Read
GetRepositoryEndpoint	Grants permission to return an endpoint for a repository	repository*	aws:ResourceTag/${TagKey}	Read
GetRepositoryPermissionsPolicy	Grants permission to return a repository's resource policy	repository*	aws:ResourceTag/${TagKey}	Read
ListAllowedRepositoriesForGroup	Grants permission to list the allowed repositories for a package group	package-group*	aws:ResourceTag/${TagKey}	List