Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Resource Groups

AWS Resource Groups (service prefix: resource-groups) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Resource Groups
Actions defined by AWS Resource Groups
Permission-only actions for AWS Resource Groups
Resource types defined by AWS Resource Groups
Condition keys for AWS Resource Groups

API operations defined by AWS Resource Groups

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CancelTagSyncTask	resource-groups:CancelTagSyncTask			Write
CancelTagSyncTask	resource-groups:DeleteGroup			Write
CreateGroup	resource-groups:CreateGroup			Write
CreateGroup	resource-groups:Tag			Tagging, Write
DeleteGroup	resource-groups:DeleteGroup			Write
GetAccountSettings	resource-groups:GetAccountSettings			Read
GetGroup	resource-groups:GetGroup			Read
GetGroupConfiguration	resource-groups:GetGroupConfiguration			Read
GetGroupQuery	resource-groups:GetGroupQuery			Read
GetTagSyncTask	resource-groups:GetTagSyncTask			Read
GetTags	resource-groups:GetTags			Read
GroupResources	resource-groups:GroupResources			Write
ListGroupResources	resource-groups:ListGroupResources			List
ListGroupingStatuses	resource-groups:ListGroupingStatuses			List
ListGroups	resource-groups:ListGroups			List
ListTagSyncTasks	resource-groups:ListTagSyncTasks			List
PutGroupConfiguration	resource-groups:PutGroupConfiguration			Write
SearchResources	resource-groups:SearchResources			List
StartTagSyncTask	resource-groups:CreateGroup			Write
	resource-groups:StartTagSyncTask			Write
	iam:PassRole	iam:PassedToService	resource-groups.amazonaws.com	Write
Tag	resource-groups:Tag			Tagging, Write
UngroupResources	resource-groups:UngroupResources			Write
Untag	resource-groups:Untag			Tagging, Write
UpdateAccountSettings	resource-groups:UpdateAccountSettings			Write
UpdateGroup	resource-groups:UpdateGroup			Write
UpdateGroupQuery	resource-groups:UpdateGroupQuery			Write

Actions defined by AWS Resource Groups

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CancelTagSyncTask	Grants permission to cancel a tag-sync task for an application group	group*	aws:ResourceTag/${TagKey}	Write
CreateGroup	Grants permission to create a resource group with a specified name, description, and resource query		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteGroup	Grants permission to delete a specified resource group	group*	aws:ResourceTag/${TagKey}	Write
GetAccountSettings	Grants permission to get the current status of optional features in Resource Groups			Read
GetGroup	Grants permission to get information of a specified resource group	group*	aws:ResourceTag/${TagKey}	Read
GetGroupConfiguration	Grants permission to get the service configuration associated with the specified resource group	group*	aws:ResourceTag/${TagKey}	Read
GetGroupQuery	Grants permission to get the query associated with a specified resource group	group*	aws:ResourceTag/${TagKey}	Read
GetTagSyncTask	Grants permission to get information of a specified tag-sync task	group*	aws:ResourceTag/${TagKey}	Read
GetTags	Grants permission to get the tags associated with a specified resource group	group*	aws:ResourceTag/${TagKey}	Read
GroupResources	Grants permission to add the specified resources to the specified group	group*	aws:ResourceTag/${TagKey}	Write
ListGroupResources	Grants permission to list the resources that are members of a specified resource group	group*	aws:ResourceTag/${TagKey}	List
ListGroupingStatuses	Grants permission to list grouping statuses for a specified application group	group*	aws:ResourceTag/${TagKey}	List
ListGroups	Grants permission to list all resource groups in your account			List
ListTagSyncTasks	Grants permission to list all tag-sync tasks in your account	group*	aws:ResourceTag/${TagKey}	List
PutGroupConfiguration	Grants permission to put the service configuration associated with the specified resource group	group*	aws:ResourceTag/${TagKey}	Write
SearchResources	Grants permission to search for AWS resources matching the given query			List
StartTagSyncTask	Grants permission to create a tag-sync task for an application group