Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Config

AWS Config (service prefix: config) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS Config

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AssociateResourceTypes	config:AssociateResourceTypes	Write
BatchGetAggregateResourceConfig	config:BatchGetAggregateResourceConfig	Read
BatchGetResourceConfig	config:BatchGetResourceConfig	Read
DeleteAggregationAuthorization	config:DeleteAggregationAuthorization	Write
DeleteConfigRule	config:DeleteConfigRule	Write
DeleteConfigurationAggregator	config:DeleteConfigurationAggregator	Write
DeleteConfigurationRecorder	config:DeleteConfigurationRecorder	Write
DeleteConformancePack	config:DeleteConformancePack	Write
DeleteConnector	config:DeleteConnector	Write
DeleteDeliveryChannel	config:DeleteDeliveryChannel	Write
DeleteEvaluationResults	config:DeleteEvaluationResults	Write
DeleteOrganizationConfigRule	config:DeleteOrganizationConfigRule	Write
DeleteOrganizationConformancePack	config:DeleteOrganizationConformancePack	Write
DeletePendingAggregationRequest	config:DeletePendingAggregationRequest	Write
DeleteRemediationConfiguration	config:DeleteRemediationConfiguration	Write
DeleteRemediationExceptions	config:DeleteRemediationExceptions	Write
DeleteResourceConfig	config:DeleteResourceConfig	Write
DeleteRetentionConfiguration	config:DeleteRetentionConfiguration	Write
DeleteServiceLinkedConfigurationRecorder	config:DeleteServiceLinkedConfigurationRecorder	Write
DeleteStoredQuery	config:DeleteStoredQuery	Write
DeliverConfigSnapshot	config:DeliverConfigSnapshot	Read
DescribeAggregateComplianceByConfigRules	config:DescribeAggregateComplianceByConfigRules	Read
DescribeAggregateComplianceByConformancePacks	config:DescribeAggregateComplianceByConformancePacks	Read
DescribeAggregationAuthorizations	config:DescribeAggregationAuthorizations	List
DescribeComplianceByConfigRule	config:DescribeComplianceByConfigRule	Read
DescribeComplianceByResource	config:DescribeComplianceByResource	Read
DescribeConfigRuleEvaluationStatus	config:DescribeConfigRuleEvaluationStatus	Read
DescribeConfigRules	config:DescribeConfigRules	List
DescribeConfigurationAggregatorSourcesStatus	config:DescribeConfigurationAggregatorSourcesStatus	Read
DescribeConfigurationAggregators	config:DescribeConfigurationAggregators	List
DescribeConfigurationRecorderStatus	config:DescribeConfigurationRecorderStatus	Read
DescribeConfigurationRecorders	config:DescribeConfigurationRecorders	Read
DescribeConformancePackCompliance	config:DescribeConformancePackCompliance	Read
DescribeConformancePackStatus	config:DescribeConformancePackStatus	Read
DescribeConformancePacks	config:DescribeConformancePacks	List
DescribeDeliveryChannelStatus	config:DescribeDeliveryChannelStatus	Read
DescribeDeliveryChannels	config:DescribeDeliveryChannels	List
DescribeOrganizationConfigRuleStatuses	config:DescribeOrganizationConfigRuleStatuses	Read
DescribeOrganizationConfigRules	config:DescribeOrganizationConfigRules	List
DescribeOrganizationConformancePackStatuses	config:DescribeOrganizationConformancePackStatuses	Read
DescribeOrganizationConformancePacks	config:DescribeOrganizationConformancePacks	List
DescribePendingAggregationRequests	config:DescribePendingAggregationRequests	List
DescribeRemediationConfigurations	config:DescribeRemediationConfigurations	List
DescribeRemediationExceptions	config:DescribeRemediationExceptions	List
DescribeRemediationExecutionStatus	config:DescribeRemediationExecutionStatus	Read
DescribeRetentionConfigurations	config:DescribeRetentionConfigurations	List
DisassociateResourceTypes	config:DisassociateResourceTypes	Write
GetAggregateComplianceDetailsByConfigRule	config:GetAggregateComplianceDetailsByConfigRule	Read
GetAggregateConfigRuleComplianceSummary	config:GetAggregateConfigRuleComplianceSummary	Read
GetAggregateConformancePackComplianceSummary	config:GetAggregateConformancePackComplianceSummary	Read
GetAggregateDiscoveredResourceCounts	config:GetAggregateDiscoveredResourceCounts	Read
GetAggregateResourceConfig	config:GetAggregateResourceConfig	Read
GetComplianceDetailsByConfigRule	config:GetComplianceDetailsByConfigRule	Read
GetComplianceDetailsByResource	config:GetComplianceDetailsByResource	Read
GetComplianceSummaryByConfigRule	config:GetComplianceSummaryByConfigRule	Read