Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Directory Service

AWS Directory Service (service prefix: ds) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Directory Service
Actions defined by AWS Directory Service
Permission-only actions for AWS Directory Service
Resource types defined by AWS Directory Service
Condition keys for AWS Directory Service

API operations defined by AWS Directory Service

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AcceptSharedDirectory	ds:AcceptSharedDirectory	Write
AddIpRoutes	ds:AddIpRoutes	Write
AddRegion	ds:AddRegion	Write
AddTagsToResource	ds:AddTagsToResource	Tagging, Write
CancelSchemaExtension	ds:CancelSchemaExtension	Write
ConnectDirectory	ds:AddTagsToResource	Tagging, Write
ConnectDirectory	ds:ConnectDirectory	Write
CreateAlias	ds:CreateAlias	Write
CreateComputer	ds:CreateComputer	Write
CreateConditionalForwarder	ds:CreateConditionalForwarder	Write
CreateDirectory	ds:AddTagsToResource	Tagging, Write
CreateDirectory	ds:CreateDirectory	Write
CreateHybridAD	ds:AddTagsToResource	Tagging, Write
CreateHybridAD	ds:CreateHybridAD	Write
CreateLogSubscription	ds:CreateLogSubscription	Write
CreateMicrosoftAD	ds:AddTagsToResource	Tagging, Write
CreateMicrosoftAD	ds:CreateMicrosoftAD	Write
CreateSnapshot	ds:CreateSnapshot	Write
CreateTrust	ds:CreateTrust	Write
DeleteADAssessment	ds:DeleteADAssessment	Write
DeleteConditionalForwarder	ds:DeleteConditionalForwarder	Write
DeleteDirectory	ds:DeleteDirectory	Write
DeleteLogSubscription	ds:DeleteLogSubscription	Write
DeleteSnapshot	ds:DeleteSnapshot	Write
DeleteTrust	ds:DeleteTrust	Write
DeregisterCertificate	ds:DeregisterCertificate	Write
DeregisterEventTopic	ds:DeregisterEventTopic	Write
DescribeADAssessment	ds:DescribeADAssessment	Read
DescribeCAEnrollmentPolicy	ds:DescribeCAEnrollmentPolicy	Read
DescribeCertificate	ds:DescribeCertificate	Read
DescribeClientAuthenticationSettings	ds:DescribeClientAuthenticationSettings	Read
DescribeConditionalForwarders	ds:DescribeConditionalForwarders	Read
DescribeDirectories	ds:DescribeDirectories	List
DescribeDirectoryDataAccess	ds:DescribeDirectoryDataAccess	Read
DescribeDomainControllers	ds:DescribeDomainControllers	Read
DescribeEventTopics	ds:DescribeEventTopics	Read
DescribeHybridADUpdate	ds:DescribeHybridADUpdate	Read
DescribeLDAPSSettings	ds:DescribeLDAPSSettings	Read
DescribeRegions	ds:DescribeRegions	Read