Actions, resources, and condition keys for Amazon DataZone - Service Authorization Reference

# Actions, resources, and condition keys for Amazon DataZone

Amazon DataZone (service prefix: `datazone` ) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

- Learn how to configure this service .

- View a list of the API operations available for this service .

- Learn how to secure this service and its resources by using IAM permission policies.

###### Topics

- Actions defined by Amazon DataZone
- Resource types defined by Amazon DataZone
- Condition keys for Amazon DataZone

## Actions defined by Amazon DataZone

You can specify the following actions in the `Action` element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the `Resource` element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the `Resource` element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's `Condition` element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

###### Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table .

Actions | Description | Access level | Resource types (*required) | Condition keys | Dependent actions
--- | --- | --- | --- | --- | ---
AcceptPredictions | Grants permission to accept prediction | Write |  |  |
AcceptSubscriptionRequest | Grants permission to approve a subscription request for a Data Asset | Write |  |  |
CancelMetadataGenerationRun | Grants permission to cancel metadata generation run | Write |  |  |
CancelSubscription | Grants permission to revoke or unsubscribe an approved subscription to Data Asset | Write |  |  |
CreateAsset | Grants permission to create asset | Write |  |  |
CreateAssetRevision | Grants permission to create new revision of an asset | Write |  |  |
CreateAssetType | Grants permission to create an asset type | Write |  |  |
CreateDataSource | Grants permission to create a new DataSource | Write |  |  |
CreateDomain | Grants permission to provision a domain which is a top level entity that contains other Amazon DataZone resources | Write |  | aws:RequestTag/${TagKey} aws:TagKeys |
CreateEnvironment | Grants permission to create a collection of configurated resources used to publish and subscribe to data | Write |  |  |
CreateEnvironmentBlueprint [permission only] | Grants permission to create a custom Environment Blueprint that allow user to add Environments to their Project | Write |  |  |
CreateEnvironmentProfile | Grants permission to create a template from a Blueprint that can be used to create a Environment | Write |  |  |
CreateFormType | Grants permission to create a form type or a new revision of it | Write |  |  |
CreateGlossary | Grants permission to create a business glossary | Write |  |  |
CreateGlossaryTerm | Grants permission to create a glossary term | Write |  |  |
CreateGroupProfile | Grants permission to create a DataZone group profile for an IAM Identity Center group | Write |  |  |
CreateListingChangeSet | Grants permission to create listing change set | Write |  |  |
CreateProject | Grants permission to create a Project to enable your team to publish and subscribe to data | Write |  |  |
CreateProjectMembership | Grants permission to add a user to a Project | Write |  |  |
CreateSubscriptionGrant | Grants permission to create a grant for an approved subscription on a subscription target | Write |  |  |
CreateSubscriptionRequest | Grants permission to create a subscription request for a Data Asset | Write |  |  |
CreateSubscriptionTarget | Grants permission to create a subscription target for a Environment in the project | Write |  |  |
CreateUserProfile | Grants permission to create a user profile for an existing user in the customers IAM Identity Center | Write |  |  |
DeleteAsset | Grants permission to delete an asset | Write |  |  |
DeleteAssetType | Grants permission to delete an asset type | Write |  |  |
DeleteDataSource | Grants permission to update existing DataSource | Write |  |  |
DeleteDomain | Grants permission to delete a provisioned domain | Write | domain* |  |
DeleteDomainSharingPolicy [permission only] | Grants permission to delete a resource policy for a DataZone Domain | Permissions management |  |  |
DeleteEnvironment | Grants permission to Delete Environment | Write |  |  |
DeleteEnvironmentBlueprint [permission only] | Grants permission to delete Environment Blueprint | Write |  |  |
DeleteEnvironmentBlueprintConfiguration | Grants permission to delete environment blueprint configuration | Write |  |  |
DeleteEnvironmentProfile | Grants permission to delete Environment Profile | Write |  |  |
DeleteFormType | Grants permission to delete a form type | Write |  |  |
DeleteGlossary | Grants permission to delete a business glossary | Write |  |  |
DeleteGlossaryTerm | Grants permission to delete a glossary term | Write |  |  |
DeleteListing | Grants permission to delete listing | Write |  |  |
DeleteProject | Grants permission to delete a Project that enables your team to publish and subscribe to data | Write |  |  |
DeleteProjectMembership | Grants permission to remove a user from a project | Write |  |  |
DeleteSubscriptionGrant | Grants permission to delete a subscription grant from a subscription target | Write |  |  |
DeleteSubscriptionRequest | Grants permission to delete a pending subscription request for a Data Asset | Write |  |  |
DeleteSubscriptionTarget | Grants permission to delete a subscription target from a Environment in the project | Write |  |  |
GetAsset | Grants permission to retrieve an asset | Read |  |  |
GetAssetType | Grants permission to get an asset type | Read |  |  |
GetDataSource | Grants permission to Get a existing DataSource in Amazon DataZone using its identifier | Read |  |  |
GetDataSourceRun | Grants permission to get DataSource run job in Amazon DataZone using it's identifier | Read |  |  |
GetDomain | Grants permission to retrieve information about a domain | Read | domain* |  |
GetDomainSharingPolicy [permission only] | Grants permission to retrieve a resource policy for a DataZone Domain | Read |  |  |
GetEnvironment | Grants permission to get Environment details | Read |  |  |
GetEnvironmentActionLink [permission only] | Grants permission to get environment action link | Read |  |  |
GetEnvironmentBlueprint | Grants permission to get Environment Blueprint details | Read |  |  |
GetEnvironmentBlueprintConfiguration | Grants permission to get environment blueprint configuration | Read |  |  |
GetEnvironmentCredentials | Grants permission to get short term credentials that assume the Environment user role | Read |  |  |
GetEnvironmentProfile | Grants permission to get Environment Profile details | Read |  |  |
GetFormType | Grants permission to get a form type | Read |  |  |
GetGlossary | Grants permission to get a business glossary | Read |  |  |
GetGlossaryTerm | Grants permission to get a glossary term | Read |  |  |
GetGroupProfile | Grants permission to retrieve an existing DataZone group profile | Read |  |  |
GetIamPortalLoginUrl | Grants permission to an IAM principal to log into the DataZone Portal | Permissions management |  |  |
GetListing | Grants permission to get listing | Read |  |  |
GetMetadataGenerationRun | Grants permission to get metadata generation run | Read |  |  |
GetProject | Grants permission to get Project details | Read |  |  |
GetSubscription | Grants permission to retrieve a subscription | Read |  |  |
GetSubscriptionEligibility [permission only] | Grants permission to get subscription eligibilty | Read |  |  |
GetSubscriptionGrant | Grants permission to retireve a subscription grant | Read |  |  |
GetSubscriptionRequestDetails | Grants permission to reject a subscription request for a Data Asset | Read |  |  |
GetSubscriptionTarget | Grants permission to retireve details of subscription target | Read |  |  |
GetUserProfile | Grants permission to retrieve a user profile for an existing user in the DataZone Domain | Read |  |  |
ListAccountEnvironments | Grants permission to list Environments across all domains in an AWS Account | List |  |  |
ListAssetRevisions | Grants permission to list revisions of an asset | List |  |  |
ListDataSourceRunActivities | Grants permission to list DataSource runs job's activities on Asset | List |  |  |
ListDataSourceRuns | Grants permission to list DataSource runs job | List |  |  |
ListDataSources | Grants permission to list existing DataSources | List |  |  |
ListDomains | Grants permission to retrieve all domains | List |  |  |
ListEnvironmentBlueprintConfigurationSummaries [permission only] | Grants permission to list environment blueprint configuration summaries | List |  |  |
ListEnvironmentBlueprintConfigurations | Grants permission to list environment blueprint configurations | List |  |  |
ListEnvironmentBlueprints | Grants permission to list Domain for Environment Blueprints | List |  |  |
ListEnvironmentProfiles | Grants permission to list Domain for Environment Profiles | List |  |  |
ListEnvironments | Grants permission to show Environments in the Domain | List |  |  |
ListGroupsForUser | Grants permission to list all the DataZone group profiles that the DataZone user profile is a member of | List |  |  |
ListMetadataGenerationRuns | Grants permission to list metadata generation runs | List |  |  |
ListNotifications | Grants permission to list notifications and events for a datazone user | List |  |  |
ListProjectMemberships | Grants permission to list Project Members | List |  |  |
ListProjects | Grants permission to list Projects | List |  |  |
ListSubscriptionGrants | Grants permission to List subscription grants for a subscribed principal | List |  |  |
ListSubscriptionRequests | Grants permission to list subscription requests | List |  |  |
ListSubscriptionTargets | Grants permission to list subscription targets | List |  |  |
ListSubscriptions | Grants permission to list subscriptions | List |  |  |
ListTagsForResource | Grants permission to retrieve all tags associated with a resource | Read | domain |  |
ListWarehouseMetadata [permission only] | Grants permission to list available Manager Secrets | List |  |  |
ProvisionDomain [permission only] | Grants permission to provision domain with default project setup | Write |  |  |
PutDomainSharingPolicy [permission only] | Grants permission to add a resource policy for a DataZone Domain | Permissions management |  |  |
PutEnvironmentBlueprintConfiguration | Grants permission to put environment blueprint configuration | Write |  |  |
RefreshToken [permission only] | Grants permission to refresh token | Write |  |  |
RejectPredictions | Grants permission to reject prediction | Write |  |  |
RejectSubscriptionRequest | Grants permission to reject a subscription request for a Data Asset | Write |  |  |
RevokeSubscription | Grants permission to revoke a subscription | Write |  |  |
Search | Grants permission to search datazone entities | List |  |  |
SearchGroupProfiles | Grants permission to search DataZone group profiles and IAM Identity Center groups | List |  |  |
SearchListings | Grants permission to search listings | List |  |  |
SearchTypes | Grants permission to search types such asset types and form types in a domain | List |  |  |
SearchUserProfiles | Grants permission to search DataZone user profiles, IAM Identity Center users, and DataZone IAM principal profiles | List |  |  |
SsoLogin [permission only] | Grants permission to login using SSO | Write |  |  |
SsoLogout [permission only] | Grants permission to logout as SSO user | Write |  |  |
StartDataSourceRun | Grants permission to start a DataSource run job | Write |  |  |
StartMetadataGenerationRun | Grants permission to start metadata generation run | Write |  |  |
StopMetadataGenerationRun | Grants permission to stop metadata generation run | Write |  |  |
TagResource | Grants permission to add or update tags to a resource | Tagging | domain* |  |
| aws:RequestTag/${TagKey} aws:TagKeys |
UntagResource | Grants permission to remove tags associated with a resource | Tagging | domain* |  |
| aws:TagKeys |
UpdateDataSource | Grants permission to update existing DataSource | Write |  |  |
UpdateDomain | Grants permission to update information for a domain | Write | domain* |  |
UpdateEnvironment | Grants permission to update Environment settings | Write |  |  |
UpdateEnvironmentBlueprint [permission only] | Grants permission to update Environment Blueprint settings | Write |  |  |
UpdateEnvironmentConfiguration [permission only] | Grants permission to update environment configuration | Write |  |  |
UpdateEnvironmentDeploymentStatus [permission only] | Grants permission to update status of the Environment deployment | Write |  |  |
UpdateEnvironmentProfile | Grants permission to update EnvironmentProfile configuration | Write |  |  |
UpdateGlossary | Grants permission to update a business glossary | Write |  |  |
UpdateGlossaryTerm | Grants permission to update a glossary term | Write |  |  |
UpdateGroupProfile | Grants permission to update a DataZone group profile | Write |  |  |
UpdateProject | Grants permission to update a Project that enables your team to publish and subscribe to data | Write |  |  |
UpdateSubscriptionGrantStatus | Grants permission to update a subscription grant status for custom grants | Write |  |  |
UpdateSubscriptionRequest | Grants permission to update business reason for subscription request for a Data Asset | Write |  |  |
UpdateSubscriptionTarget | Grants permission to update a subscription target | Write |  |  |
UpdateUserProfile | Grants permission to update a DataZone user profile | Write |  |  |
ValidatePassRole [permission only] | Grants permission to validate pass role | Write |  |  |

## Resource types defined by Amazon DataZone

The following resource types are defined by this service and can be used in the `Resource` element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table .

Resource types | ARN | Condition keys
--- | --- | ---
domain | `arn:$ { Partition}:datazone:$ { Region}:$ { Account}:domain/$ { DomainId}` | aws:ResourceTag/${TagKey}

## Condition keys for Amazon DataZone

Amazon DataZone defines the following condition keys that can be used in the `Condition` element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table .

To view the global condition keys that are available to all services, see Available global condition keys .

Condition keys | Description | Type
--- | --- | ---
aws:RequestTag/${TagKey} | Filters access by the tags that are passed in the request | String
aws:ResourceTag/${TagKey} | Filters access by the tags associated with the resource | String
aws:TagKeys | Filters access by the tag keys that are passed in the request | ArrayOfString

Did this page help you? - Yes

Thanks for letting us know we're doing a good job!

If you've got a moment, please tell us what we did right so we can do more of it.

Did this page help you? - No

Thanks for letting us know this page needs work. We're sorry we let you down.

If you've got a moment, please tell us how we can make the documentation better.