Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Identity and Access Management (IAM)

AWS Identity and Access Management (IAM) (service prefix: iam) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Identity and Access Management (IAM)
Actions defined by AWS Identity and Access Management (IAM)
Permission-only actions for AWS Identity and Access Management (IAM)
Resource types defined by AWS Identity and Access Management (IAM)
Condition keys for AWS Identity and Access Management (IAM)

API operations defined by AWS Identity and Access Management (IAM)

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
AcceptDelegationRequest	iam	iam:AcceptDelegationRequest			Write
AcquireRole	iam	iam:AttachRolePolicy			Permissions management, Write
		iam:CreateRole			Write
		iam:GetRole			Read
		iam:GetRoleTemplateVersion			Read
		iam:PutRolePermissionsBoundary			Permissions management, Write
		iam:PutRolePolicy			Permissions management, Write
		iam:TagRole			Tagging, Write
AddClientIDToOpenIDConnectProvider	iam	iam:AddClientIDToOpenIDConnectProvider			Write
AddRoleToInstanceProfile	iam	iam:AddRoleToInstanceProfile			Write
AddRoleToInstanceProfile	iam	iam:PassRole	iam:PassedToService	ec2.amazonaws.com	Write
AddUserToGroup	iam	iam:AddUserToGroup			Write
AssociateDelegationRequest	iam	iam:AssociateDelegationRequest			Write
AttachGroupPolicy	iam	iam:AttachGroupPolicy			Permissions management, Write
AttachRolePolicy	iam	iam:AttachRolePolicy			Permissions management, Write
AttachUserPolicy	iam	iam:AttachUserPolicy			Permissions management, Write
ChangePassword	iam	iam:ChangePassword			Write
CreateAccessKey	iam	iam:CreateAccessKey			Write
CreateAccountAlias	iam	iam:CreateAccountAlias			Write
CreateDelegationRequest	iam	iam:CreateDelegationRequest			Write
CreateGroup	iam	iam:CreateGroup			Write
CreateInstanceProfile	iam	iam:CreateInstanceProfile			Write
CreateInstanceProfile	iam	iam:TagInstanceProfile			Tagging, Write
CreateLoginProfile	iam	iam:CreateLoginProfile			Write
CreateOpenIDConnectProvider	iam	iam:CreateOpenIDConnectProvider			Write
CreateOpenIDConnectProvider	iam	iam:TagOpenIDConnectProvider			Tagging, Write
CreatePolicy	iam	iam:CreatePolicy			Permissions management, Write
CreatePolicy	iam	iam:TagPolicy			Tagging, Write
CreatePolicyVersion	iam	iam:CreatePolicyVersion			Permissions management, Write
CreateRole	iam	iam:CreateRole			Write
CreateRole	iam	iam:TagRole			Tagging, Write
CreateSAMLProvider	iam	iam:CreateSAMLProvider			Write
CreateSAMLProvider	iam	iam:TagSAMLProvider			Tagging, Write
CreateServiceLinkedRole	iam	iam:CreateServiceLinkedRole			Write
CreateServiceLinkedRole	iam	iam:PutRolePolicy			Permissions management, Write
CreateServiceSpecificCredential	iam	iam:CreateServiceSpecificCredential			Write
CreateUser	iam	iam:CreateUser			Write
CreateUser	iam	iam:TagUser			Tagging, Write
CreateVirtualMFADevice	iam	iam:CreateVirtualMFADevice			Write
CreateVirtualMFADevice	iam	iam:TagMFADevice			Tagging, Write
DeactivateMFADevice	iam	iam:DeactivateMFADevice			Write
DeleteAccessKey	iam	iam:DeleteAccessKey			Write
DeleteAccountAlias	iam	iam:DeleteAccountAlias			Write
DeleteAccountPasswordPolicy	iam	iam:DeleteAccountPasswordPolicy			Permissions management, Write
DeleteGroup	iam	iam:DeleteGroup			Write
DeleteGroupPolicy	iam	iam:DeleteGroupPolicy			Permissions management, Write
DeleteInstanceProfile	iam	iam:DeleteInstanceProfile			Write
DeleteLoginProfile	iam	iam:DeleteLoginProfile			Write
DeleteOpenIDConnectProvider	iam	iam:DeleteOpenIDConnectProvider			Write
DeletePolicy	iam	iam:DeletePolicy			Permissions management, Write
DeletePolicyVersion	iam	iam:DeletePolicyVersion			Permissions management, Write
DeleteRole	iam	iam:DeleteRole			Write
DeleteRolePermissionsBoundary	iam	iam:DeleteRolePermissionsBoundary			Permissions management, Write
DeleteRolePolicy	iam	iam:DeleteRolePolicy			Permissions management, Write
DeleteSAMLProvider	iam	iam:DeleteSAMLProvider			Write
DeleteSSHPublicKey	iam	iam:DeleteSSHPublicKey			Write
DeleteServerCertificate	iam	iam:DeleteServerCertificate			Write
DeleteServiceLinkedRole	iam	iam:DeleteServiceLinkedRole			Write
DeleteServiceSpecificCredential	iam	iam:DeleteServiceSpecificCredential			Write
DeleteSigningCertificate	iam	iam:DeleteSigningCertificate			Write
DeleteUser	iam	iam:DeleteUser			Write
DeleteUserPermissionsBoundary	iam	iam:DeleteUserPermissionsBoundary			Permissions management, Write
DeleteUserPolicy	iam	iam:DeleteUserPolicy			Permissions management, Write
DeleteVirtualMFADevice	iam	iam:DeleteVirtualMFADevice			Write
DetachGroupPolicy	iam	iam:DetachGroupPolicy			Permissions management, Write
DetachRolePolicy	iam	iam:DetachRolePolicy			Permissions management, Write
DetachUserPolicy	iam	iam:DetachUserPolicy			Permissions management, Write
DisableOutboundWebIdentityFederation	iam	iam:DisableOutboundWebIdentityFederation			Write
EnableMFADevice	iam	iam:EnableMFADevice			Write
EnableOutboundWebIdentityFederation	iam	iam:EnableOutboundWebIdentityFederation			Write
GenerateCredentialReport	iam	iam:GenerateCredentialReport			Read
GenerateOrganizationsAccessReport	iam	iam:GenerateOrganizationsAccessReport			Read
GenerateServiceLastAccessedDetails	iam	iam:GenerateServiceLastAccessedDetails			Read
GetAccessKeyLastUsed	iam	iam:GetAccessKeyLastUsed			Read
GetAccountAuthorizationDetails	iam	iam:GetAccountAuthorizationDetails			Read
GetAccountPasswordPolicy	iam	iam:GetAccountPasswordPolicy			Read
GetAccountProperties	iam	iam:GetAccountProperties			Read
GetAccountSummary	iam	iam:GetAccountSummary			List
GetContextKeysForCustomPolicy	iam	iam:GetContextKeysForCustomPolicy			Read
GetContextKeysForPrincipalPolicy	iam	iam:GetContextKeysForPrincipalPolicy			Read
GetCredentialReport	iam	iam:GetCredentialReport			Read
GetDelegationRequest	iam	iam:GetDelegationRequest			Read
GetGroup	iam	iam:GetGroup			Read
GetGroupPolicy	iam	iam:GetGroupPolicy			Read
GetHumanReadableSummary	iam	iam:GetHumanReadableSummary			Read
GetInstanceProfile	iam	iam:GetInstanceProfile			Read
GetLoginProfile	iam	iam:GetLoginProfile			List
GetMFADevice	iam	iam:GetMFADevice			Read
GetOpenIDConnectProvider	iam	iam:GetOpenIDConnectProvider			Read
GetOrganizationsAccessReport	iam	iam:GetOrganizationsAccessReport			Read
GetOutboundWebIdentityFederationInfo	iam	iam:GetOutboundWebIdentityFederationInfo			Read
GetPolicy	iam	iam:GetPolicy			Read
GetPolicyVersion	iam	iam:GetPolicyVersion			Read
GetRole	iam	iam:GetRole			Read
GetRolePolicy	iam	iam:GetRolePolicy			Read
GetRoleTemplateVersion	iam	iam:GetRoleTemplateVersion			Read
GetSAMLProvider	iam	iam:GetSAMLProvider			Read
GetSSHPublicKey	iam	iam:GetSSHPublicKey			Read
GetServerCertificate	iam	iam:GetServerCertificate			Read
GetServiceLastAccessedDetails	iam	iam:GetServiceLastAccessedDetails			Read
GetServiceLastAccessedDetailsWithEntities	iam	iam:GetServiceLastAccessedDetailsWithEntities			Read
GetServiceLinkedRoleDeletionStatus	iam	iam:GetServiceLinkedRoleDeletionStatus			Read
GetUser	iam	iam:GetUser			Read
GetUserPolicy	iam	iam:GetUserPolicy			Read
ListAccessKeys	iam	iam:ListAccessKeys			List
ListAccountAliases	iam	iam:ListAccountAliases			List
ListAttachedGroupPolicies	iam	iam:ListAttachedGroupPolicies			List
ListAttachedRolePolicies	iam	iam:ListAttachedRolePolicies			List
ListAttachedUserPolicies	iam	iam:ListAttachedUserPolicies			List
ListDelegationRequests	iam	iam:ListDelegationRequests			List
ListEntitiesForPolicy	iam	iam:ListEntitiesForPolicy			List
ListGroupPolicies	iam	iam:ListGroupPolicies			List
ListGroups	iam	iam:ListGroups			List
ListGroupsForUser	iam	iam:ListGroupsForUser			List
ListInstanceProfileTags	iam	iam:ListInstanceProfileTags			List
ListInstanceProfiles	iam	iam:ListInstanceProfiles			List
ListInstanceProfilesForRole	iam	iam:ListInstanceProfilesForRole			List
ListMFADeviceTags	iam	iam:ListMFADeviceTags			List
ListMFADevices	iam	iam:ListMFADevices			List
ListOpenIDConnectProviderTags	iam	iam:ListOpenIDConnectProviderTags			List
ListOpenIDConnectProviders	iam	iam:ListOpenIDConnectProviders			List
ListPolicies	iam	iam:ListPolicies			List
ListPoliciesGrantingServiceAccess	iam	iam:ListPoliciesGrantingServiceAccess			List
ListPolicyTags	iam	iam:ListPolicyTags			List
ListPolicyVersions	iam	iam:ListPolicyVersions			List
ListRolePolicies	iam	iam:ListRolePolicies			List
ListRoleTags	iam	iam:ListRoleTags			List
ListRoles	iam	iam:ListRoles			List
ListSAMLProviderTags	iam	iam:ListSAMLProviderTags			List
ListSAMLProviders	iam	iam:ListSAMLProviders			List
ListSSHPublicKeys	iam	iam:ListSSHPublicKeys			List
ListServerCertificateTags	iam	iam:ListServerCertificateTags			List
ListServerCertificates	iam	iam:ListServerCertificates			List
ListServiceSpecificCredentials	iam	iam:ListServiceSpecificCredentials			List
ListSigningCertificates	iam	iam:ListSigningCertificates			List
ListUserPolicies	iam	iam:ListUserPolicies			List
ListUserTags	iam	iam:ListUserTags			List
ListUsers	iam	iam:ListUsers			List
ListVirtualMFADevices	iam	iam:ListVirtualMFADevices			List
PutAccountProperties	iam	iam:CreateServiceLinkedRole			Write
PutAccountProperties	iam	iam:PutAccountProperties			Write
PutGroupPolicy	iam	iam:PutGroupPolicy			Permissions management, Write
PutRolePermissionsBoundary	iam	iam:PutRolePermissionsBoundary			Permissions management, Write
PutRolePolicy	iam	iam:PutRolePolicy			Permissions management, Write
PutUserPermissionsBoundary	iam	iam:PutUserPermissionsBoundary			Permissions management, Write
PutUserPolicy	iam	iam:PutUserPolicy			Permissions management, Write
RejectDelegationRequest	iam	iam:RejectDelegationRequest			Write
RemoveClientIDFromOpenIDConnectProvider	iam	iam:RemoveClientIDFromOpenIDConnectProvider			Write
RemoveRoleFromInstanceProfile	iam	iam:RemoveRoleFromInstanceProfile			Write
RemoveUserFromGroup	iam	iam:RemoveUserFromGroup			Write
ResetServiceSpecificCredential	iam	iam:ResetServiceSpecificCredential			Write
ResyncMFADevice	iam	iam:ResyncMFADevice			Write
SendDelegationToken	iam	iam:SendDelegationToken			Write
SetDefaultPolicyVersion	iam	iam:SetDefaultPolicyVersion			Permissions management, Write
SetSecurityTokenServicePreferences	iam	iam:SetSecurityTokenServicePreferences			Write
SimulateCustomPolicy	iam	iam:SimulateCustomPolicy			Read
SimulatePrincipalPolicy	iam	iam:SimulatePrincipalPolicy			Read
TagInstanceProfile	iam	iam:TagInstanceProfile			Tagging, Write
TagMFADevice	iam	iam:TagMFADevice			Tagging, Write
TagOpenIDConnectProvider	iam	iam:TagOpenIDConnectProvider			Tagging, Write
TagPolicy	iam	iam:TagPolicy			Tagging, Write
TagRole	iam	iam:TagRole			Tagging, Write
TagSAMLProvider	iam	iam:TagSAMLProvider			Tagging, Write
TagServerCertificate	iam	iam:TagServerCertificate			Tagging, Write
TagUser	iam	iam:TagUser			Tagging, Write
UntagInstanceProfile	iam	iam:UntagInstanceProfile			Tagging, Write
UntagMFADevice	iam	iam:UntagMFADevice			Tagging, Write
UntagOpenIDConnectProvider	iam	iam:UntagOpenIDConnectProvider			Tagging, Write
UntagPolicy	iam	iam:UntagPolicy			Tagging, Write
UntagRole	iam	iam:UntagRole			Tagging, Write
UntagSAMLProvider	iam	iam:UntagSAMLProvider			Tagging, Write
UntagServerCertificate	iam	iam:UntagServerCertificate			Tagging, Write
UntagUser	iam	iam:UntagUser			Tagging, Write
UpdateAccessKey	iam	iam:UpdateAccessKey			Write
UpdateAccountPasswordPolicy	iam	iam:UpdateAccountPasswordPolicy			Write
UpdateAssumeRolePolicy	iam	iam:UpdateAssumeRolePolicy			Permissions management, Write
UpdateGroup	iam	iam:UpdateGroup			Write
UpdateLoginProfile	iam	iam:UpdateLoginProfile			Write
UpdateOpenIDConnectProviderThumbprint	iam	iam:UpdateOpenIDConnectProviderThumbprint			Write
UpdateRole	iam	iam:UpdateRole			Write
UpdateRoleDescription	iam	iam:UpdateRoleDescription			Write
UpdateSAMLProvider	iam	iam:UpdateSAMLProvider			Write
UpdateSSHPublicKey	iam	iam:UpdateSSHPublicKey			Write
UpdateServerCertificate	iam	iam:UpdateServerCertificate			Write
UpdateServiceSpecificCredential	iam	iam:UpdateServiceSpecificCredential			Write
UpdateSigningCertificate	iam	iam:UpdateSigningCertificate			Write
UpdateUser	iam	iam:UpdateUser			Write
UploadSSHPublicKey	iam	iam:UploadSSHPublicKey			Write
UploadServerCertificate	iam	iam:TagServerCertificate			Tagging, Write
UploadServerCertificate	iam	iam:UploadServerCertificate			Write
UploadSigningCertificate	iam	iam:UploadSigningCertificate			Write

Actions defined by AWS Identity and Access Management (IAM)

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptDelegationRequest	Accepts a delegation request resource, granting the requested temporary access	delegation-request*	iam:DelegationRequestOwner	Write
AddClientIDToOpenIDConnectProvider	Grants permission to add a new client ID (audience) to the list of registered IDs for the specified IAM OpenID Connect (OIDC) provider resource	oidc-provider*	aws:ResourceTag/${TagKey}	Write
AddRoleToInstanceProfile	Grants permission to add an IAM role to the specified instance profile	instance-profile*	aws:ResourceTag/${TagKey}	Write
AddUserToGroup	Grants permission to add an IAM user to the specified IAM group	group*		Write
AssociateDelegationRequest	Associates a delegation request resource with the calling identity	delegation-request*	iam:DelegationRequestOwner	Write
AttachGroupPolicy	Grants permission to attach a managed policy to the specified IAM group	group*	iam:PolicyARN	Permissions management, Write
AttachRolePolicy	Grants permission to attach a managed policy to the specified IAM role	role*	aws:ResourceTag/${TagKey} iam:PermissionsBoundary iam:PolicyARN iam:ResourceTag/${TagKey} iam:RoleTemplateARN	Permissions management, Write
AttachUserPolicy	Grants permission to attach a managed policy to the specified IAM user	user*	aws:ResourceTag/${TagKey} iam:PermissionsBoundary iam:PolicyARN iam:ResourceTag/${TagKey}	Permissions management, Write
ChangePassword	Grants permission to an IAM user to change their own password	user*	aws:ResourceTag/${TagKey} iam:ResourceTag/${TagKey}	Write
CreateAccessKey	Grants permission to create access key and secret access key for the specified IAM user	user*	aws:ResourceTag/${TagKey} iam:ResourceTag/${TagKey}	Write
CreateAccountAlias	Grants permission to create an alias for your AWS account			Write
CreateDelegationRequest	Creates an IAM delegation request resource for temporary access delegation	delegation-request*	iam:DelegationDuration iam:DelegationRequestOwner iam:NotificationChannel iam:TemplateArn	Write
CreateGroup	Grants permission to create a new group	group*		Write
CreateInstanceProfile	Grants permission to create a new instance profile	instance-profile*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateLoginProfile	Grants permission to create a password for the specified IAM user	user*	aws:ResourceTag/${TagKey} iam:ResourceTag/${TagKey}	Write
CreateOpenIDConnectProvider	Grants permission to create an IAM resource that describes an identity provider (IdP) that supports OpenID Connect (OIDC)	oidc-provider*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePolicy	Grants permission to create a new managed policy	policy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Permissions management, Write
CreatePolicyVersion	Grants permission to create a new version of the specified managed policy	policy*	aws:ResourceTag/${TagKey}	Permissions management, Write
CreateRole	Grants permission to create a new role	role*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys iam:PermissionsBoundary iam:ResourceTag/${TagKey} iam:RoleTemplateARN	Write
CreateSAMLProvider	Grants permission to create an IAM resource that describes an identity provider (IdP) that supports SAML 2.0	saml-provider*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateServiceLinkedRole	Grants permission to create an IAM role that allows an AWS service to perform actions on your behalf	role*	aws:ResourceTag/${TagKey} iam:AWSServiceName iam:ResourceTag/${TagKey}	Write
CreateServiceSpecificCredential	Grants permission to create a new service-specific credential for an IAM user	user*	aws:ResourceTag/${TagKey} iam:ResourceTag/${TagKey} iam:ServiceSpecificCredentialAgeDays iam:ServiceSpecificCredentialServiceName	Write
CreateUser	Grants permission to create a new IAM user	user*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys iam:PermissionsBoundary iam:ResourceTag/${TagKey}	Write
CreateVirtualMFADevice	Grants permission to create a new virtual MFA device	mfa*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeactivateMFADevice	Grants permission to deactivate the specified MFA device and remove its association with the IAM user for which it was originally enabled	user*	aws:ResourceTag/${TagKey} iam:ResourceTag/${TagKey}	Write