AWS IAM documentation change
Summary
Added an 'Operations' table section, updated descriptions for Actions, Resource types, and Condition keys tables, clarified multivalued condition key handling, and refreshed the service list with updated naming conventions and links.
Security assessment
The changes involve structural updates to documentation tables, clarifications on IAM policy elements (like condition keys and operations), and service list maintenance. There is no evidence of addressing a specific security vulnerability, incident, or weakness. The updates improve clarity but do not introduce new security features or address security flaws.
Diff
diff --git a/IAM/latest/UserGuide/reference_policies_actions-resources-contextkeys.md b/IAM/latest/UserGuide/reference_policies_actions-resources-contextkeys.md index 3e226056d..afd7dcf80 100644 --- a//IAM/latest/UserGuide/reference_policies_actions-resources-contextkeys.md +++ b//IAM/latest/UserGuide/reference_policies_actions-resources-contextkeys.md @@ -7 +7 @@ -Actions tableResource types tableCondition keys table +Operations tableActions tableResource types tableCondition keys table @@ -11 +11,17 @@ Actions tableResource types tableCondition keys table -Each AWS service can define actions, resources, and condition context keys for use in IAM policies. This topic describes how the elements provided for each service are documented. +Each AWS service can define API operations, actions, resources, and condition context keys for use in IAM policies. This topic describes how the elements provided for each service are documented. + +Each topic consists of tables that provide the list of available operations, actions, resources, and condition keys. + +## The operations table + +The **Operations** table lists the API operations defined by the service and maps each one to the IAM actions that authorize it. A single operation can authorize more than one IAM action. Some services do not yet have an operations table. This does not mean there are no operations for that service. This table does not yet include actions that downstream services authorize through [forward access sessions](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_forward_access_sessions.html). + + * The **Operation** column lists the name of the API operation. When an operation authorizes multiple actions, the operation name spans the rows for all of its authorized actions. + + * The **IAM action** column lists each IAM action authorized by the operation, in the form `service:ActionName`. When the action belongs to the same service as the operation, the entry links to that action's row in the **Actions** table on the same page. When the action belongs to a different service, the entry links to that service's authorization reference page. + + * The **Condition key** and **Possible value(s)** columns list only the condition keys that this operation sets to a fixed, known value when it authorizes this action, along with the value it sets. This is not the full set of condition keys that may be available during authorization. The keys shown are the ones with values determined statically by the API itself. For the full set of condition keys supported by the action, see the Actions table and the Condition keys table on the same page. + + * The **Access level** column shows the access level classification of the authorized action. For more information about access levels, see [Understanding access level summaries within policy summaries](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_understand-policy-summary-access-level-summaries.html). + + @@ -13 +28,0 @@ Each AWS service can define actions, resources, and condition context keys for u -Each topic consists of tables that provide the list of available actions, resources, and condition keys. @@ -17 +32 @@ Each topic consists of tables that provide the list of available actions, resour -The **Actions** table lists all the actions that you can use in an IAM policy statement's `Action` element. Not all API operations that are defined by a service can be used as an action in an IAM policy. Some services include permission-only actions that don't directly correspond to an API operation. These actions are indicated with **[permission only]**. Use this list to determine which actions you can use in an IAM policy. For more information about the `Action`, `Resource`, or `Condition` elements, see [IAM JSON policy elements reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html). The **Actions** and **Description** table columns are self-descriptive. +The **Actions** table lists all the actions that you can use in an IAM policy statement's `Action` element. Some services include permission-only actions that don't directly correspond to an API operation. These actions are listed in a separate **Permission-only actions** table on the same page. Use these tables to determine which actions you can use in an IAM policy. For more information about the `Action`, `Resource`, or `Condition` elements, see [IAM JSON policy elements reference](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements.html). The **Actions** and **Description** table columns are self-descriptive. @@ -25,5 +40 @@ Required resources are indicated in the table with an asterisk (*). If you speci - * The **Condition keys** column includes keys that you can specify in a policy statement's `Condition` element. Condition keys might be supported with an action, or with an action and a specific resource. Pay close attention to whether the key is in the same row as a specific resource type. This table does not include global condition keys that are available for any action or under unrelated circumstances. For more information about global condition keys, see [AWS global condition context keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html). - - * The **Dependent actions** column of the Actions table shows additional permissions that may be required to successfully call an action. These permissions may be needed in addition to the permission for the action itself. When an action specifies dependent actions, those dependencies may apply to additional resources defined for that action, not only the first resource listed in the table. - -Dependent actions are not required in all scenarios. Refer to the individual service's documentation for more information about providing granular permissions to users. + * The **Condition keys** column includes keys that you can specify in a policy statement's `Condition` element. Condition keys might be supported with an action, or with an action and a specific resource. Pay close attention to whether the key is in the same row as a specific resource type. This table does not include global condition keys that are available for any action or under unrelated circumstances. For more information about global condition keys, see [AWS global condition keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html). @@ -36 +47 @@ Dependent actions are not required in all scenarios. Refer to the individual ser -The **Resource types** table lists all the resource types that you can specify as an ARN in the `Resource` policy element. Not every resource type can be specified with every action. Some resource types work with only certain actions. If you specify a resource type in a statement with an action that does not support that resource type, then the statement doesn't allow access. For more information about the `Resource` element, see [IAM JSON policy elements: Resource](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_resource.html). +The **Resource types** table lists all the resource types that you can specify as an ARN in the `Resource` policy element. Not every resource type can be specified with every action. Some resource types work with only certain actions. For more information about the `Resource` element, see [IAM JSON policy elements: Resource](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_resource.html). @@ -47 +58 @@ The **Resource types** table lists all the resource types that you can specify a -The **condition keys** table lists all of the condition context keys that you can use in an IAM policy statement's `Condition` element. Not every key can be specified with every action or resource. Certain keys only work with certain types of actions and resources. For more information about the `Condition` element, see [IAM JSON policy elements: Condition](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html). +The **condition keys** table lists all of the condition keys that you can use in an IAM policy statement's `Condition` element. Not every key can be specified with every action or resource. Certain keys only work with certain types of actions and resources. For more information about the `Condition` element, see [IAM JSON policy elements: Condition](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_elements_condition.html). @@ -51 +62 @@ The **condition keys** table lists all of the condition context keys that you ca -If the **Type** column specifies a "List of …" one of the simple types, then you can use [multiple keys and values](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_multi-value-conditions.html#reference_policies_multi-key-or-value-conditions) in your policies. Do this using condition set prefixes with your operators. Use the `ForAllValues` prefix to specify that **all** values in the request must match a value in the policy statement. Use the `ForAnyValue` prefix to specify that **at least one** value in the request matches one of the values in the policy statement. +If the **Type** column specifies "ArrayOf.." one of the simple types, then you must use [multivalued set operators](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-single-vs-multi-valued-context-keys.html#reference_policies_condition-multi-valued-context-keys) in your policies. Use the `ForAllValues` prefix to specify that **all** values in the request must match a value in the policy statement. Use the `ForAnyValue` prefix to specify that **at least one** value in the request matches one of the values in the policy statement. @@ -58 +69,3 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Account Management](./list_awsaccountmanagement.html) + * [AWS Billing Conductor (billingconductor)](./list_billingconductor.html) + + * [AWS Cloud Control API (cloudformation)](./list_cloudcontrol.html) @@ -60 +73 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Action Recommendations](./list_awsactionrecommendations.html) + * [AWS Cloud Map (servicediscovery)](./list_servicediscovery.html) @@ -62 +75 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Activate](./list_awsactivate.html) + * [AWS Account Management (account)](./list_account.html) @@ -64 +77 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Amazon AI Operations](./list_amazonaioperations.html) + * [AWS Action Recommendations (action-recommendations)](./list_action-recommendations.html) @@ -66 +79 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Alexa for Business](./list_alexaforbusiness.html) + * [AWS Activate (activate)](./list_activate.html) @@ -68 +81 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AmazonMediaImport](./list_amazonmediaimport.html) + * [AWS Amplify (amplify)](./list_amplify.html) @@ -70 +83 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Amplify](./list_awsamplify.html) + * [AWS Amplify Admin (amplifybackend)](./list_amplifybackend.html) @@ -72 +85 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Amplify Admin](./list_awsamplifyadmin.html) + * [AWS Amplify UI Builder (amplifyuibuilder)](./list_amplifyuibuilder.html) @@ -74 +87 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Amplify UI Builder](./list_awsamplifyuibuilder.html) + * [AWS App Mesh (appmesh)](./list_appmesh.html) @@ -76 +89 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Apache Kafka APIs for Amazon MSK clusters](./list_apachekafkaapisforamazonmskclusters.html) + * [AWS App Mesh Preview (appmesh-preview)](./list_appmesh-preview.html) @@ -78 +91 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Amazon API Gateway](./list_amazonapigateway.html) + * [AWS App Runner (apprunner)](./list_apprunner.html) @@ -80 +93 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Amazon API Gateway Management](./list_amazonapigatewaymanagement.html) + * [AWS App Studio (appstudio)](./list_appstudio.html) @@ -82 +95 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Amazon API Gateway Management V2](./list_amazonapigatewaymanagementv2.html) + * [AWS App2Container (a2c)](./list_a2c.html) @@ -84 +97 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS App Mesh](./list_awsappmesh.html) + * [AWS AppConfig (appconfig)](./list_appconfig.html) @@ -86 +99 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS App Mesh Preview](./list_awsappmeshpreview.html) + * [AWS AppFabric (appfabric)](./list_appfabric.html) @@ -88 +101 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS App Runner](./list_awsapprunner.html) + * [AWS Application Auto Scaling (application-autoscaling)](./list_application-autoscaling.html) @@ -90 +103 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS App Studio](./list_awsappstudio.html) + * [AWS Application Discovery Service (discovery)](./list_discovery.html) @@ -92 +105 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS App2Container](./list_awsapp2container.html) + * [AWS Application Migration Service (mgn)](./list_mgn.html) @@ -94 +107 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS AppConfig](./list_awsappconfig.html) + * [AWS Application Transformation Service (application-transformation)](./list_application-transformation.html) @@ -96 +109 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS AppFabric](./list_awsappfabric.html) + * [AWS AppSync (appsync)](./list_appsync.html) @@ -98 +111 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Amazon AppFlow](./list_amazonappflow.html) + * [AWS Artifact (artifact)](./list_artifact.html) @@ -100 +113 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Amazon AppIntegrations](./list_amazonappintegrations.html) + * [AWS Audit Manager (auditmanager)](./list_auditmanager.html) @@ -102 +115 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Application Auto Scaling](./list_awsapplicationautoscaling.html) + * [AWS Auto Scaling (autoscaling-plans)](./list_autoscaling-plans.html) @@ -104 +117 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Application Discovery Arsenal](./list_applicationdiscoveryarsenal.html) + * [AWS B2B Data Interchange (b2bi)](./list_b2bi.html) @@ -106 +119 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Application Discovery Service](./list_awsapplicationdiscoveryservice.html) + * [AWS Backup (backup)](./list_backup.html) @@ -108 +121 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Application Migration Service](./list_awsapplicationmigrationservice.html) + * [AWS Backup Gateway (backup-gateway)](./list_backup-gateway.html) @@ -110 +123 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Amazon Application Recovery Controller - Zonal Shift](./list_amazonapplicationrecoverycontroller-zonalshift.html) + * [AWS Backup Search (backup-search)](./list_backupsearch.html) @@ -112 +125 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Application Transformation Service](./list_awsapplicationtransformationservice.html) + * [AWS Backup storage (backup-storage)](./list_backup-storage.html) @@ -114 +127 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Amazon AppStream 2.0](./list_amazonappstream2.0.html) + * [AWS Batch (batch)](./list_batch.html) @@ -116 +129 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS AppSync](./list_awsappsync.html) + * [AWS Budget Service (budgets)](./list_budgets.html) @@ -118 +131 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Amazon ARC Region switch](./list_amazonarcregionswitch.html) + * [AWS BugBust (bugbust)](./list_bugbust.html) @@ -120 +133 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Artifact](./list_awsartifact.html) + * [AWS Certificate Manager (acm)](./list_acm.html) @@ -122 +135 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Amazon Athena](./list_amazonathena.html) + * [AWS Chatbot (chatbot)](./list_chatbot.html) @@ -124 +137 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Audit Manager](./list_awsauditmanager.html) + * [AWS Clean Rooms (cleanrooms)](./list_cleanrooms.html) @@ -126 +139 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Amazon Aurora DSQL](./list_amazonauroradsql.html) + * [AWS Clean Rooms ML (cleanrooms-ml)](./list_cleanroomsml.html) @@ -128 +141 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Auto Scaling](./list_awsautoscaling.html) + * [AWS Cloud9 (cloud9)](./list_cloud9.html) @@ -130 +143 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS B2B Data Interchange](./list_awsb2bdatainterchange.html) + * [AWS CloudFormation (cloudformation)](./list_cloudformation.html) @@ -132 +145 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Backup](./list_awsbackup.html) + * [AWS CloudHSM (cloudhsm)](./list_cloudhsm.html) @@ -134 +147 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Backup Gateway](./list_awsbackupgateway.html) + * [AWS CloudShell (cloudshell)](./list_cloudshell.html) @@ -136 +149 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Backup Search](./list_awsbackupsearch.html) + * [AWS CloudTrail (cloudtrail)](./list_cloudtrail.html) @@ -138 +151 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Backup storage](./list_awsbackupstorage.html) + * [AWS CloudTrail Data (cloudtrail-data)](./list_cloudtrail-data.html) @@ -140 +153 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Batch](./list_awsbatch.html) + * [AWS CloudWatch RUM (rum)](./list_rum.html) @@ -142 +155 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Amazon Bedrock](./list_amazonbedrock.html) + * [AWS CodeArtifact (codeartifact)](./list_codeartifact.html) @@ -144 +157 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Amazon Bedrock Agentcore](./list_amazonbedrockagentcore.html) + * [AWS CodeBuild (codebuild)](./list_codebuild.html) @@ -146 +159 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [Amazon Bedrock Powered by AWS Mantle](./list_amazonbedrockpoweredbyawsmantle.html) + * [AWS CodeCommit (codecommit)](./list_codecommit.html) @@ -148 +161 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Billing](./list_awsbilling.html) + * [AWS CodeConnections (codeconnections)](./list_codeconnections.html) @@ -150 +163 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Billing and Cost Management Dashboards](./list_awsbillingandcostmanagementdashboards.html) + * [AWS CodeDeploy (codedeploy)](./list_codedeploy.html) @@ -152 +165 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Billing And Cost Management Data Exports](./list_awsbillingandcostmanagementdataexports.html) + * [AWS CodeDeploy secure host commands service (codedeploy-commands-secure)](./list_codedeploy-commands-secure.html) @@ -154 +167 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Billing And Cost Management Pricing Calculator](./list_awsbillingandcostmanagementpricingcalculator.html) + * [AWS CodePipeline (codepipeline)](./list_codepipeline.html) @@ -156 +169 @@ If the **Type** column specifies a "List of …" one of the simple types, then y - * [AWS Billing And Cost Management Recommended Actions](./list_awsbillingandcostmanagementrecommendedactions.html) + * [AWS CodeStar (codestar)](./list_codestar.html) @@ -158 +171 @@ If the **Type** column specifies a "List of …" one of the simple types, then y