Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Signer

AWS Signer (service prefix: signer) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS Signer

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Access level
AddProfilePermission	signer	signer:AddProfilePermission	Permissions management, Write
CancelSigningProfile	signer	signer:CancelSigningProfile	Write
DescribeSigningJob	signer	signer:DescribeSigningJob	Read
GetRevocationStatus	signer	signer:GetRevocationStatus	Read
GetSigningPlatform	signer	signer:GetSigningPlatform	Read
GetSigningProfile	signer	signer:GetSigningProfile	Read
ListProfilePermissions	signer	signer:ListProfilePermissions	Read
ListSigningJobs	signer	signer:ListSigningJobs	List
ListSigningPlatforms	signer	signer:ListSigningPlatforms	List
ListSigningProfiles	signer	signer:ListSigningProfiles	List
ListTagsForResource	signer	signer:ListTagsForResource	Read
PutSigningProfile	signer	signer:PutSigningProfile	Write
PutSigningProfile	signer	signer:TagResource	Tagging, Write
RemoveProfilePermission	signer	signer:RemoveProfilePermission	Permissions management, Write
RevokeSignature	signer	signer:RevokeSignature	Write
RevokeSigningProfile	signer	signer:RevokeSigningProfile	Write
SignPayload	signer	signer:SignPayload	Write
StartSigningJob	signer	signer:StartSigningJob	Write
TagResource	signer	signer:TagResource	Tagging, Write
UntagResource	signer	signer:UntagResource	Tagging, Write
GetRevocationStatus	signer-data	signer:GetRevocationStatus	Read

Actions defined by AWS Signer

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddProfilePermission	Grants permission to add cross-account permissions to a Signing Profile	signing-profile*	aws:ResourceTag/${TagKey}	Permissions management, Write
CancelSigningProfile	Grants permission to change the state of a Signing Profile to CANCELED	signing-profile*	aws:ResourceTag/${TagKey} signer:ProfileVersion	Write
DescribeSigningJob	Grants permission to return information about a specific Signing Job	signing-job*		Read
GetRevocationStatus	Grants permission to query revocation info of signing resources	signing-job*		Read
GetRevocationStatus		signing-profile*	aws:ResourceTag/${TagKey}	Read
GetSigningPlatform	Grants permission to return information about a specific Signing Platform			Read
GetSigningProfile	Grants permission to return information about a specific Signing Profile	signing-profile*	aws:ResourceTag/${TagKey} signer:ProfileVersion	Read
ListProfilePermissions	Grants permission to list the cross-account permissions associated with a Signing Profile	signing-profile*	aws:ResourceTag/${TagKey}	Read
ListSigningJobs	Grants permission to list all Signing Jobs in your account			List
ListSigningPlatforms	Grants permission to list all available Signing Platforms			List
ListSigningProfiles	Grants permission to list all Signing Profiles in your account			List
ListTagsForResource	Grants permission to list the tags associated with a Signing Profile	signing-profile*	aws:ResourceTag/${TagKey}	Read
PutSigningProfile	Grants permission to create a new Signing Profile		aws:RequestTag/${TagKey} aws:TagKeys	Write
RemoveProfilePermission	Grants permission to remove cross-account permissions from a Signing Profile	signing-profile*	aws:ResourceTag/${TagKey}	Permissions management, Write
RevokeSignature	Grants permission to change the state of a Signing Job to REVOKED	signing-job*	signer:ProfileVersion	Write
RevokeSigningProfile	Grants permission to change the state of a Signing Profile to REVOKED	signing-profile*	aws:ResourceTag/${TagKey} signer:ProfileVersion	Write
SignPayload	Grants permission to initiate a Signing Job on the provided payload	signing-profile*	aws:ResourceTag/${TagKey} signer:ProfileVersion	Write
StartSigningJob	Grants permission to initiate a Signing Job on the provided code	signing-profile*	aws:ResourceTag/${TagKey} signer:ProfileVersion	Write