Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS X-Ray

AWS X-Ray (service prefix: xray) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS X-Ray

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
BatchGetTraces	xray:BatchGetTraces	List
CancelTraceRetrieval	xray:CancelTraceRetrieval	Read
CreateGroup	xray:CreateGroup	Write
CreateGroup	xray:TagResource	Tagging, Write
CreateSamplingRule	xray:CreateSamplingRule	Write
CreateSamplingRule	xray:TagResource	Tagging, Write
DeleteGroup	xray:DeleteGroup	Write
DeleteResourcePolicy	xray:DeleteResourcePolicy	Write
DeleteSamplingRule	xray:DeleteSamplingRule	Write
GetEncryptionConfig	xray:GetEncryptionConfig	Read
GetGroup	xray:GetGroup	Read
GetGroups	xray:GetGroups	Read
GetIndexingRules	xray:GetIndexingRules	Read
GetInsight	xray:GetInsight	Read
GetInsightEvents	xray:GetInsightEvents	Read
GetInsightImpactGraph	xray:GetInsightImpactGraph	Read
GetInsightSummaries	xray:GetInsightSummaries	Read
GetRetrievedTracesGraph	xray:GetRetrievedTracesGraph	Read
GetSamplingRules	xray:GetSamplingRules	Read
GetSamplingStatisticSummaries	xray:GetSamplingStatisticSummaries	Read
GetSamplingTargets	xray:GetSamplingTargets	Read
GetServiceGraph	xray:GetServiceGraph	Read
GetTimeSeriesServiceStatistics	xray:GetTimeSeriesServiceStatistics	Read
GetTraceGraph	xray:GetTraceGraph	Read
GetTraceSegmentDestination	xray:GetTraceSegmentDestination	Read
GetTraceSummaries	xray:GetTraceSummaries	Read
ListResourcePolicies	xray:ListResourcePolicies	List
ListRetrievedTraces	xray:ListRetrievedTraces	List
ListTagsForResource	xray:ListTagsForResource	List
PutEncryptionConfig	xray:PutEncryptionConfig	Permissions management, Write
PutResourcePolicy	xray:PutResourcePolicy	Write
PutTelemetryRecords	xray:PutTelemetryRecords	Write
PutTraceSegments	xray:PutTraceSegments	Write
StartTraceRetrieval	xray:StartTraceRetrieval	Read
TagResource	xray:TagResource	Tagging, Write
UntagResource	xray:UntagResource	Tagging, Write
UpdateGroup	xray:UpdateGroup	Write
UpdateIndexingRule	xray:UpdateIndexingRule	Write
UpdateSamplingRule	xray:UpdateSamplingRule	Write
UpdateTraceSegmentDestination	xray:UpdateTraceSegmentDestination	Write

Actions defined by AWS X-Ray

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchGetTraces	Grants permission to retrieve a list of traces specified by ID. Each trace is a collection of segment documents that originates from a single request. Use GetTraceSummaries to get a list of trace IDs			List
CancelTraceRetrieval	Grants permission to cancel an ongoing trace retrieval job initiated by StartTraceRetrieval using the provided RetrievalToken. A successful cancellation will return an HTTP 200 response			Read
CreateGroup	Grants permission to create a group resource with a name and a filter expression	group*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSamplingRule	Grants permission to create a rule to control sampling behavior for instrumented applications	sampling-rule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteGroup	Grants permission to delete a group resource	group*	aws:ResourceTag/${TagKey}	Write
DeleteResourcePolicy	Grants permission to delete resource policies		xray:ResourcePolicyName	Write
DeleteSamplingRule	Grants permission to delete a sampling rule	sampling-rule*	aws:ResourceTag/${TagKey}	Write
GetEncryptionConfig	Grants permission to retrieve the current encryption configuration for X-Ray data			Read
GetGroup	Grants permission to retrieve group resource details	group*	aws:ResourceTag/${TagKey}	Read
GetGroups	Grants permission to retrieve all active group details			Read
GetIndexingRules	Grants permission to retrieve all indexing rules. Indexing rules are used to determine the server-side sampling rate for spans ingested through the CloudWatchLogs destination and indexed by X-Ray			Read
GetInsight	Grants permission to retrieve the details of a specific insight			Read
GetInsightEvents	Grants permission to retrieve the events of a specific insight			Read
GetInsightImpactGraph	Grants permission to retrieve the part of the service graph which is impacted for a specific insight			Read
GetInsightSummaries	Grants permission to retrieve the summary of all insights for a group and time range with optional filters			Read
GetRetrievedTracesGraph	Grants permission to retrieve a service graph for traces based on the specified RetrievalToken from the Transaction Search CloudWatch log group			Read
GetSamplingRules	Grants permission to retrieve all sampling rules			Read
GetSamplingStatisticSummaries	Grants permission to retrieve information about recent sampling results for all sampling rules			Read
GetSamplingTargets	Grants permission to request a sampling quota for rules that the service is using to sample requests			Read
GetServiceGraph	Grants permission to retrieve a document that describes services that process incoming requests, and downstream services that they call as a result			Read
GetTimeSeriesServiceStatistics	Grants permission to retrieve an aggregation of service statistics defined by a specific time range bucketed into time intervals			Read
GetTraceGraph	Grants permission to retrieve a service graph for one or more specific trace IDs			Read
GetTraceSegmentDestination	Grants permission to retrieve the current destination of data sent to PutTraceSegments and OpenTelemetry API			Read
GetTraceSummaries	Grants permission to retrieve IDs and metadata for traces available for a specified time frame using an optional filter. To get the full traces, pass the trace IDs to BatchGetTraces			Read
ListResourcePolicies	Grants permission to list resource policies			List
ListRetrievedTraces	Grants permission to retrieve a list of traces for a given RetrievalToken from the Transaction Search CloudWatch log group			List
ListTagsForResource	Grants permission to list tags for an X-Ray resource	group	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags for an X-Ray resource	sampling-rule	aws:ResourceTag/${TagKey}	List
PutEncryptionConfig	Grants permission to update the encryption configuration for X-Ray data			Permissions management, Write
PutResourcePolicy	Grants permission to create or update resource policies		xray:ResourcePolicyName