Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Global Accelerator

AWS Global Accelerator (service prefix: globalaccelerator) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Global Accelerator
Actions defined by AWS Global Accelerator
Resource types defined by AWS Global Accelerator
Condition keys for AWS Global Accelerator

API operations defined by AWS Global Accelerator

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AddCustomRoutingEndpoints	globalaccelerator:AddCustomRoutingEndpoints	Write
AddEndpoints	globalaccelerator:AddEndpoints	Write
AddEndpoints	globalaccelerator:UpdateEndpointGroup	Write
AdvertiseByoipCidr	globalaccelerator:AdvertiseByoipCidr	Write
AllowCustomRoutingTraffic	globalaccelerator:AllowCustomRoutingTraffic	Write
CreateAccelerator	globalaccelerator:CreateAccelerator	Write
CreateAccelerator	globalaccelerator:TagResource	Tagging, Write
CreateCrossAccountAttachment	globalaccelerator:CreateCrossAccountAttachment	Write
CreateCrossAccountAttachment	globalaccelerator:TagResource	Tagging, Write
CreateCustomRoutingAccelerator	globalaccelerator:CreateCustomRoutingAccelerator	Write
CreateCustomRoutingAccelerator	globalaccelerator:TagResource	Tagging, Write
CreateCustomRoutingEndpointGroup	globalaccelerator:CreateCustomRoutingEndpointGroup	Write
CreateCustomRoutingListener	globalaccelerator:CreateCustomRoutingListener	Write
CreateEndpointGroup	globalaccelerator:CreateEndpointGroup	Write
CreateListener	globalaccelerator:CreateListener	Write
DeleteAccelerator	globalaccelerator:DeleteAccelerator	Write
DeleteCrossAccountAttachment	globalaccelerator:DeleteCrossAccountAttachment	Write
DeleteCustomRoutingAccelerator	globalaccelerator:DeleteCustomRoutingAccelerator	Write
DeleteCustomRoutingEndpointGroup	globalaccelerator:DeleteCustomRoutingEndpointGroup	Write
DeleteCustomRoutingListener	globalaccelerator:DeleteCustomRoutingListener	Write
DeleteEndpointGroup	globalaccelerator:DeleteEndpointGroup	Write
DeleteListener	globalaccelerator:DeleteListener	Write
DenyCustomRoutingTraffic	globalaccelerator:DenyCustomRoutingTraffic	Write
DeprovisionByoipCidr	globalaccelerator:DeprovisionByoipCidr	Write
DescribeAccelerator	globalaccelerator:DescribeAccelerator	Read
DescribeAcceleratorAttributes	globalaccelerator:DescribeAcceleratorAttributes	Read
DescribeCrossAccountAttachment	globalaccelerator:DescribeCrossAccountAttachment	Read
DescribeCustomRoutingAccelerator	globalaccelerator:DescribeCustomRoutingAccelerator	Read
DescribeCustomRoutingAcceleratorAttributes	globalaccelerator:DescribeCustomRoutingAcceleratorAttributes	Read
DescribeCustomRoutingEndpointGroup	globalaccelerator:DescribeCustomRoutingEndpointGroup	Read
DescribeCustomRoutingListener	globalaccelerator:DescribeCustomRoutingListener	Read
DescribeEndpointGroup	globalaccelerator:DescribeEndpointGroup	Read
DescribeListener	globalaccelerator:DescribeListener	Read
ListAccelerators	globalaccelerator:ListAccelerators	List
ListByoipCidrs	globalaccelerator:ListByoipCidrs	List
ListCrossAccountAttachments	globalaccelerator:ListCrossAccountAttachments	List
ListCrossAccountResourceAccounts	globalaccelerator:ListCrossAccountResourceAccounts	List
ListCrossAccountResources	globalaccelerator:ListCrossAccountResources	List
ListCustomRoutingAccelerators	globalaccelerator:ListCustomRoutingAccelerators	List
ListCustomRoutingEndpointGroups	globalaccelerator:ListCustomRoutingEndpointGroups	List
ListCustomRoutingListeners	globalaccelerator:ListCustomRoutingListeners	List
ListCustomRoutingPortMappings	globalaccelerator:ListCustomRoutingPortMappings	List
ListCustomRoutingPortMappingsByDestination	globalaccelerator:ListCustomRoutingPortMappingsByDestination	List
ListEndpointGroups	globalaccelerator:ListEndpointGroups	List
ListListeners	globalaccelerator:ListListeners	List
ListTagsForResource	globalaccelerator:ListTagsForResource	Read
ProvisionByoipCidr	globalaccelerator:ProvisionByoipCidr	Write
RemoveCustomRoutingEndpoints	globalaccelerator:RemoveCustomRoutingEndpoints	Write
RemoveEndpoints	globalaccelerator:RemoveEndpoints	Write
RemoveEndpoints	globalaccelerator:UpdateEndpointGroup	Write
TagResource	globalaccelerator:TagResource	Tagging, Write
UntagResource	globalaccelerator:UntagResource	Tagging, Write
UpdateAccelerator	globalaccelerator:UpdateAccelerator	Write
UpdateAcceleratorAttributes	globalaccelerator:UpdateAcceleratorAttributes	Write
UpdateCrossAccountAttachment	globalaccelerator:UpdateCrossAccountAttachment	Write
UpdateCustomRoutingAccelerator	globalaccelerator:UpdateCustomRoutingAccelerator	Write
UpdateCustomRoutingAcceleratorAttributes	globalaccelerator:UpdateCustomRoutingAcceleratorAttributes	Write
UpdateCustomRoutingListener	globalaccelerator:UpdateCustomRoutingListener	Write
UpdateEndpointGroup	globalaccelerator:UpdateEndpointGroup	Write
UpdateListener	globalaccelerator:UpdateListener	Write
WithdrawByoipCidr	globalaccelerator:WithdrawByoipCidr	Write

Actions defined by AWS Global Accelerator

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddCustomRoutingEndpoints	Grants permission to add a virtual private cloud (VPC) subnet endpoint to a custom routing accelerator endpoint group	endpointgroup*	aws:ResourceTag/${TagKey}	Write
AddEndpoints	Grants permission to add an endpoint to a standard accelerator endpoint group	endpointgroup*	aws:ResourceTag/${TagKey}	Write
AdvertiseByoipCidr	Grants permission to advertises an IPv4 address range that is provisioned for use with your accelerator through bring your own IP addresses (BYOIP)			Write
AllowCustomRoutingTraffic	Grants permission to allows custom routing of user traffic to a private destination IP:PORT in a specific VPC subnet	endpointgroup*	aws:ResourceTag/${TagKey}	Write
CreateAccelerator	Grants permission to create a standard accelerator		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateCrossAccountAttachment	Grants permission to create a CrossAccountAttachment		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateCustomRoutingAccelerator	Grants permission to create a Custom Routing accelerator		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateCustomRoutingEndpointGroup	Grants permission to create an endpoint group for the specified listener for a custom routing accelerator	listener*	aws:ResourceTag/${TagKey}	Write
CreateCustomRoutingListener	Grants permission to create a listener to process inbound connections from clients to a custom routing accelerator	accelerator*	aws:ResourceTag/${TagKey}	Write
CreateEndpointGroup	Grants permission to add an endpoint group to a standard accelerator listener	listener*	aws:ResourceTag/${TagKey}	Write
CreateListener	Grants permission to add a listener to a standard accelerator	accelerator*	aws:ResourceTag/${TagKey}	Write
DeleteAccelerator	Grants permission to delete a standard accelerator	accelerator*	aws:ResourceTag/${TagKey}	Write
DeleteCrossAccountAttachment	Grants permission to delete a CrossAccountAttachment	attachment*	aws:ResourceTag/${TagKey}	Write
DeleteCustomRoutingAccelerator	Grants permission to delete a custom routing accelerator	accelerator*	aws:ResourceTag/${TagKey}	Write
DeleteCustomRoutingEndpointGroup	Grants permission to delete an endpoint group from a listener for a custom routing accelerator	endpointgroup*	aws:ResourceTag/${TagKey}	Write
DeleteCustomRoutingListener	Grants permission to delete a listener for a custom routing accelerator	listener*	aws:ResourceTag/${TagKey}	Write
DeleteEndpointGroup	Grants permission to delete an endpoint group associated with a standard accelerator listener	endpointgroup*	aws:ResourceTag/${TagKey}	Write
DeleteListener	Grants permission to delete a listener from a standard accelerator	listener*	aws:ResourceTag/${TagKey}	Write
DenyCustomRoutingTraffic	Grants permission to disallows custom routing of user traffic to a private destination IP:PORT in a specific VPC subnet	endpointgroup*	aws:ResourceTag/${TagKey}	Write
DeprovisionByoipCidr	Grants permission to releases the specified address range that you provisioned for use with your accelerator through bring your own IP addresses (BYOIP)			Write
DescribeAccelerator	Grants permissions to describe a standard accelerator