Actions, resources, and condition keys for AWS Security Agent - Service Authorization Reference
ActionsResource typesCondition keys

Actions, resources, and condition keys for AWS Security Agent

AWS Security Agent (service prefix: securityagent) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Actions defined by AWS Security Agent

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Access level column of the Actions table describes how the action is classified (List, Read, Permissions management, or Tagging). This classification can help you understand the level of access that an action grants when you use it in a policy. For more information about access levels, see Access levels in policy summaries.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

The Dependent actions column of the Actions table shows additional permissions that may be required to successfully call an action. These permissions may be needed in addition to the permission for the action itself. When an action specifies dependent actions, those dependencies may apply to additional resources defined for that action, not only the first resource listed in the table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.

Actions Description Access level Resource types (*required) Condition keys Dependent actions
AddArtifact Grants permission to add an Artifact for the given Agent Instance Write
AddControl Grants permission to add a customer managed Control Write
BatchDeletePentests Grants permission to delete multiple penetration tests in a single request Write
BatchGetAgentInstances Grants permission to retrieve multiple agent instances in a single request Read
BatchGetArtifactMetadata Grants permission to retrieve one or more Artifact Metadata records for the given Agent Instance Read
BatchGetFindings Grants permission to retrieve multiple security testing findings in a single request Read
BatchGetPentestJobs Grants permission to retrieve multiple security testing jobs in a single request Read
BatchGetPentests Grants permission to retrieve multiple penetration tests in a single request Read
BatchGetSecurityTestContentMetadata Grants permission to retrieve multiple security testing contents metadata in a single request Read
BatchGetTasks Grants permission to retrieve multiple security testing tasks in a single request Read
CreateAgentInstance Grants permission to create an agent instance record Write
CreateApplication Grants permission to create a new application Write

iam:PassRole

sso:CreateApplication

CreateDocumentReview Grants permission to create a document review Write
CreateIntegration Grants permission to create a security testing integration Write
CreateMembership Grants permission to add a single member to a agent instance with specified role Write
CreateOneTimeLoginSession Grants permission to create a one time login session Write
CreatePentest Grants permission to create a new penetration test configuration Write
DeleteAgentInstance Grants permission to delete an agent instance record Write
DeleteApplication Grants permission to delete application Write
DeleteArtifact Grants permission to delete an Artifact Write
DeleteControl Grants permission to delete a customer managed Control Write
DeleteIntegration Grants permission to delete the integration of an application Write
DeleteMembership Grants permission to remove a single member associated to an agent instance Write
DescribeFindings Grants permission to retrieve security findings for a penetration test or security testing tasks in a penetration test Read
GetApplication Grants permission to get application details by application ID Read
GetArtifact Grants permission to retrieve an Artifact for the given Agent Instance Read
GetCodeReviewTask Grants permission to retrieve a Code Review Task Read
GetControl Grants permission to retrieve a Control Read
GetDocReviewTask Grants permission to retrieve a document review task Read
GetDocumentReview Grants permission to get the status of the associated agent instance document review Read
GetDocumentReviewArtifact Grants permission to get document review artifact for a specific document Read
GetIntegration Grants permission to get the integration metadata by ID Read
GetLoginSessionCredentials Grants permission to retrieve credentials for a one time login session Read
HandleOneTimeLoginSession Grants permission to process and invalidate a one time login session Write
InitiateProviderRegistration Grants permission to initiate the registration of Security Agent App for the given provider (eg: GitHub) Write
ListAgentInstanceTasks Grants permission to list tasks for a specific agent instance List
ListAgentInstances Grants permission to list agent instances List
ListApplications Grants permission to list all applications in the account List
ListArtifacts Grants permission to list all artifacts for the given project List
ListControls Grants permission to list all Controls List
ListDiscoveredEndpoints Grants permission to list discovered endpoints associated with a pentest job with optional URI prefix filtering List
ListDocumentReviewComments Grants permission to list document review comments List
ListDocumentReviews Grants permission to list all document reviews for the given project List
ListFindings Grants permission to list findings with filtering and pagination support List
ListIntegratedResources Grants permission to list integrated resources for an agent instance List
ListIntegrations Grants permission to get the integrations owned by the caller's AWS account List
ListMemberships Grants permission to list all members associated to an agent instance with pagination support List
ListPentestJobsForPentest Grants permission to list penetration test jobs associated with a penetration test List
ListPentests Grants permission to list penetration tests with optional filtering by status List
ListResourcesFromIntegration Grants permission to list resources from Integration List
ListTasks Grants permission to list security testing tasks associated with a pentest job List
StartCodeRemediation Grants permission to start code remediation for the findings Write
StartPentestExecution Grants permission to initiate the execution of a penetration test Write
StopPentestExecution Grants permission to stop the execution of a running penetration test Write
ToggleManagedControl Grants permission to toggle the status Write
UpdateAgentInstance Grants permission to update an agent instance record Write
UpdateApplication Grants permission to update application configuration Write

iam:PassRole

UpdateControl Grants permission to update a customer managed Control Write
UpdateFinding Grants permission to update an existing security finding with new details or status Write
UpdateIntegratedResources Grants permission to update integrated resources for an agent instance Write
UpdatePentest Grants permission to update an existing penetration test with new configuration or settings Write
VerifyTargetDomain Grants permission to verify ownership for a registered target domain in an agent instance Write

Resource types defined by AWS Security Agent

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.

Resource types ARN Condition keys
Application arn:${Partition}:securityagent:${Region}:${Account}:application/${ApplicationId}
Control arn:${Partition}:securityagent:${Region}:${Account}:control/${ControlId}
Integration arn:${Partition}:securityagent:${Region}:${Account}:integration/${IntegrationId}
AgentInstance arn:${Partition}:securityagent:${Region}:${Account}:agent-instance/${AgentId}
Artifact arn:${Partition}:securityagent:${Region}:${Account}:agent-instance/${AgentId}/artifact/${ArtifactId}
Pentest arn:${Partition}:securityagent:${Region}:${Account}:agent-instance/${AgentId}/pentest/${PentestId}
PentestJob arn:${Partition}:securityagent:${Region}:${Account}:agent-instance/${AgentId}/pentest-job/${JobId}
PentestTask arn:${Partition}:securityagent:${Region}:${Account}:agent-instance/${AgentId}/pentest-task/${TaskId}
Finding arn:${Partition}:securityagent:${Region}:${Account}:agent-instance/${AgentId}/finding/${FindingId}

Condition keys for AWS Security Agent

securityagent has no service-specific context keys that can be used in the Condition element of policy statements. For the list of the global context keys that are available to all services, see AWS global condition context keys.