Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Step Functions

AWS Step Functions (service prefix: states) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Step Functions
Actions defined by AWS Step Functions
Permission-only actions for AWS Step Functions
Resource types defined by AWS Step Functions
Condition keys for AWS Step Functions

API operations defined by AWS Step Functions

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateActivity	states:CreateActivity			Write
CreateActivity	states:TagResource			Tagging, Write
CreateStateMachine	states:CreateStateMachine			Write
	states:PublishStateMachineVersion			Write
	states:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	states.amazonaws.com	Write
CreateStateMachineAlias	states:CreateStateMachineAlias			Write
DeleteActivity	states:DeleteActivity			Write
DeleteStateMachine	states:DeleteStateMachine			Write
DeleteStateMachineAlias	states:DeleteStateMachineAlias			Write
DeleteStateMachineVersion	states:DeleteStateMachineVersion			Write
DescribeActivity	states:DescribeActivity			Read
DescribeExecution	states:DescribeExecution			Read
DescribeMapRun	states:DescribeMapRun			Read
DescribeStateMachine	states:DescribeStateMachine			Read
DescribeStateMachineAlias	states:DescribeStateMachineAlias			Read
DescribeStateMachineForExecution	states:DescribeStateMachineForExecution			Read
GetActivityTask	states:GetActivityTask			Write
GetExecutionHistory	states:GetExecutionHistory			Read
ListActivities	states:ListActivities			List
ListExecutions	states:ListExecutions			List
ListMapRuns	states:ListMapRuns			List
ListStateMachineAliases	states:ListStateMachineAliases			List
ListStateMachineVersions	states:ListStateMachineVersions			List
ListStateMachines	states:ListStateMachines			List
ListTagsForResource	states:ListTagsForResource			List
PublishStateMachineVersion	states:PublishStateMachineVersion			Write
RedriveExecution	states:RedriveExecution			Write
SendTaskFailure	states:SendTaskFailure			Write
SendTaskHeartbeat	states:SendTaskHeartbeat			Write
SendTaskSuccess	states:SendTaskSuccess			Write
StartExecution	states:DescribeExecution			Read
StartExecution	states:StartExecution			Write
StartSyncExecution	states:StartSyncExecution			Write
StopExecution	states:StopExecution			Write
TagResource	states:TagResource			Tagging, Write
TestState	states:RevealSecrets			Read
	states:TestState			Write
	iam:PassRole	iam:PassedToService	states.amazonaws.com	Write
UntagResource	states:UntagResource			Tagging, Write
UpdateMapRun	states:UpdateMapRun			Write
UpdateStateMachine	states:PublishStateMachineVersion			Write
	states:UpdateStateMachine			Write
	iam:PassRole	iam:PassedToService	states.amazonaws.com	Write
UpdateStateMachineAlias	states:UpdateStateMachineAlias			Write
ValidateStateMachineDefinition	states:ValidateStateMachineDefinition			Read

Actions defined by AWS Step Functions

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateActivity	Grants permission to create an activity	activity*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateStateMachine	Grants permission to create a state machine	statemachine*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateStateMachineAlias	Grants permission to create a state machine alias	statemachine*	aws:ResourceTag/${TagKey} states:StateMachineQualifier	Write
DeleteActivity	Grants permission to delete an activity	activity*	aws:ResourceTag/${TagKey}	Write
DeleteStateMachine	Grants permission to delete a state machine	statemachine*	aws:ResourceTag/${TagKey}	Write
DeleteStateMachineAlias	Grants permission to delete a state machine alias	statemachine*	aws:ResourceTag/${TagKey} states:StateMachineQualifier	Write
DeleteStateMachineVersion	Grants permission to delete a state machine version	statemachine*	aws:ResourceTag/${TagKey} states:StateMachineQualifier	Write
DescribeActivity	Grants permission to describe an activity	activity*	aws:ResourceTag/${TagKey}	Read
DescribeExecution	Grants permission to describe an execution	execution*	aws:ResourceTag/${TagKey}	Read
DescribeExecution	Grants permission to describe an execution	express*		Read
DescribeMapRun	Grants permission to describe a map run	maprun*		Read
DescribeStateMachine	Grants permission to describe a state machine	statemachine*	aws:ResourceTag/${TagKey} states:StateMachineQualifier	Read
DescribeStateMachineAlias	Grants permission to describe a state machine alias	statemachine*	aws:ResourceTag/${TagKey} states:StateMachineQualifier	Read
DescribeStateMachineForExecution	Grants permission to describe the state machine for an execution	execution*	aws:ResourceTag/${TagKey}	Read
GetActivityTask	Grants permission to be used by workers to retrieve a task (with the specified activity ARN) which has been scheduled for execution by a running state machine	activity*	aws:ResourceTag/${TagKey}	Write
GetExecutionHistory	Grants permission to return the history of the specified execution as a list of events	execution*	aws:ResourceTag/${TagKey}	Read
ListActivities	Grants permission to list the existing activities			List
ListExecutions	Grants permission to list the executions of a state machine	maprun*	states:StateMachineQualifier	List
ListExecutions	Grants permission to list the executions of a state machine	statemachine*	aws:ResourceTag/${TagKey} states:StateMachineQualifier	List