Las traducciones son generadas a través de traducción automática. En caso de conflicto entre la traducción y la version original de inglés, prevalecerá la version en inglés.
# Directory Service Permisos de API: referencia a acciones, recursos y condiciones
Puede usar la tabla [Directory Service Permisos de API: referencia a acciones, recursos y condiciones](#UsingWithDS_IAM_ResourcePermissions) como referencia cuando configure [Control de acceso](iam_auth_access.md#access_control) y escriba políticas de permisos que vaya a asociar a una identidad de IAM (políticas basadas en identidad). Cada entrada de la API de la tabla incluye lo siguiente:
+ El nombre de cada operación de la API.
+ Cada acción o acciones correspondientes a las operaciones de las API en las que puede conceder permisos para realizar la acción.
+ El AWS recurso en el que puedes conceder los permisos
Las acciones se especifican en el campo `Action` de la política y el valor del recurso se especifica en el campo `Resource` de la política. Para especificar una acción, use el prefijo `ds:` seguido del nombre de operación de la API (por ejemplo, `ds:CreateDirectory`). Es posible que algunas AWS aplicaciones requieran el uso de operaciones de Directory Service API no públicas `ds:AuthorizeApplication``ds:CheckAlias`, como`ds:CreateIdentityPoolDirectory`,`ds:GetAuthorizedApplicationDetails`,`ds:UpdateAuthorizedApplication`, y `ds:UnauthorizeApplication` en sus políticas.
A algunos solo se les Directory Service APIs puede llamar a través del Consola de administración de AWS. No son públicos APIs, en el sentido de que no se pueden llamar mediante programación y ningún SDK los proporciona. Aceptan credenciales de usuario. Estas operaciones de API incluyen `ds:DisableRoleAccess`, `ds:EnableRoleAccess` y`ds:UpdateDirectory`.
Puede utilizar claves de condición AWS globales en sus políticas de datos Directory Service y de Directory Service para expresar las condiciones. Para obtener una lista completa de AWS claves, consulte las [claves de condición globales disponibles](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#AvailableKeys) en la *Guía del usuario de IAM*.
## Directory Service API y permisos necesarios para realizar acciones
| Directory Service Operaciones de API | Permisos necesarios (acciones de la API) | Recursos |
| --- | --- | --- |
| [AcceptSharedDirectory](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_AcceptSharedDirectory.html) | ds:AcceptSharedDirectory | \* |
| [AddIpRoutes](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_AddIpRoutes.html) | `ds:AddIpRoutes`
`ec2:DescribeSecurityGroup`
`ec2:AuthorizeSecurityGroupIngress`
`ec2:AuthorizeSecurityGroupEgress` | \* |
| [AddTagsToResource](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_AddTagsToResource.html) | ds:AddTagsToResource`ec2:CreateTags` | \* |
| [CancelSchemaExtension](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CancelSchemaExtension.html) | ds:CancelSchemaExtension | \* |
| [ConnectDirectory](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ConnectDirectory.html) | `ds:ConnectDirectory`
`ec2:DescribeSubnets`
`ec2:DescribeVpcs`
`ec2:CreateSecurityGroup`
`ec2:CreateNetworkInterface`
`ec2:DescribeNetworkInterfaces`
`ec2:AuthorizeSecurityGroupIngress`
`ec2:AuthorizeSecurityGroupEgress`
`ec2:CreateTags` | \* |
| [CreateAlias](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateAlias.html) | `ds:CreateAlias` | \* |
| [CreateComputer](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateComputer.html) | `ds:CreateComputer` | \* |
| [CreateConditionalForwarder](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateConditionalForwarder.html) | `ds:CreateConditionalForwarder` | \* |
| [CreateDirectory](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateDirectory.html) | `ds:CreateDirectory`
`ec2:DescribeSubnets`
`ec2:DescribeVpcs`
`ec2:CreateSecurityGroup`
`ec2:CreateNetworkInterface`
`ec2:DescribeNetworkInterfaces`
`ec2:AuthorizeSecurityGroupIngress`
`ec2:AuthorizeSecurityGroupEgress`
`ec2:CreateTags` | \* |
| [CreateLogSubscription](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateLogSubscription.html) | ds:CreateLogSubscription | \* |
| [CreateMicrosoftAD](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateMicrosoftAD.html) | `ds:CreateMicrosoftAD`
`ec2:DescribeSubnets`
`ec2:DescribeVpcs`
`ec2:CreateSecurityGroup`
`ec2:CreateNetworkInterface`
`ec2:DescribeNetworkInterfaces`
`ec2:AuthorizeSecurityGroupIngress`
`ec2:AuthorizeSecurityGroupEgress`
`ec2:RevokeSecurityGroupEgress`
`ec2:CreateTags` | \* |
| [CreateSnapshot](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateSnapshot.html) | `ds:CreateSnapshot` | \* |
| [CreateTrust](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_CreateTrust.html) | `ds:CreateTrust` | \* |
| [DeleteConditionalForwarder](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteConditionalForwarder.html) | `ds:DeleteConditionalForwarder` | \* |
| [DeleteDirectory](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteDirectory.html) | `ds:DeleteDirectory`
`ec2:DescribeNetworkInterfaces`
`ec2:DeleteSecurityGroup`
`ec2:DeleteNetworkInterface`
`ec2:RevokeSecurityGroupIngress`
`ec2:RevokeSecurityGroupEgress`
`ec2:DeleteTags` | \* |
| [DeleteLogSubscription](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteLogSubscription.html) | ds:DeleteLogSubscription | \* |
| [DeleteSnapshot](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteSnapshot.html) | `ds:DeleteSnapshot` | \* |
| [DeleteTrust](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeleteTrust.html) | `ds:DeleteTrust` | \* |
| [DeregisterEventTopic](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DeregisterEventTopic.html) | `ds:DeregisterEventTopic` | \* |
| [DescribeConditionalForwarders](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeConditionalForwarders.html) | `ds:DescribeConditionalForwarders` | \* |
| [DescribeDirectories](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeDirectories.html) | `ds:DescribeDirectories` | \* |
| [DescribeDomainControllers](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeDomainControllers.html) | ds:DescribeDomainControllers | \* |
| [DescribeEventTopics](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeEventTopics.html) | `ds:DescribeEventTopics` | \* |
| [DescribeSharedDirectories](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeSharedDirectories.html) | ds:DescribeSharedDirectories | \* |
| [DescribeSnapshots](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeSnapshots.html) | `ds:DescribeSnapshots` | \* |
| [DescribeTrusts](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DescribeTrusts.html) | `ds:DescribeTrusts` | \* |
| [DisableRadius](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DisableRadius.html) | `ds:DisableRadius` | \* |
| [DisableSso](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_DisableSso.html) | `ds:DisableSso` | \* |
| [EnableRadius](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_EnableRadius.html) | `ds:EnableRadius` | \* |
| [EnableSso](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_EnableSso.html) | `ds:EnableSso` | \* |
| [GetDirectoryLimits](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_GetDirectoryLimits.html) | `ds:GetDirectoryLimits` | \* |
| [GetSnapshotLimits](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_GetSnapshotLimits.html) | `ds:GetSnapshotLimits` | \* |
| [ListIpRoutes](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListIpRoutes.html) | `ds:ListIpRoutes` | \* |
| [ListLogSubscriptions](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListLogSubscriptions.html) | ds:ListLogSubscriptions | \* |
| [ListSchemaExtensions](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListSchemaExtensions.html) | `ds:ListSchemaExtensions` | \* |
| [ListTagsForResource](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ListTagsForResource.html) | `ds:ListTagsForResource` | \* |
| [RegisterEventTopic](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RegisterEventTopic.html) | `ds:RegisterEventTopic`
`sns:GetTopicAttributes` | \* |
| [RejectSharedDirectory](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RejectSharedDirectory.html) | ds:RejectSharedDirectory | \* |
| [RemoveIpRoutes](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RemoveIpRoutes.html) | `ds:RemoveIpRoutes` | \* |
| [RemoveTagsFromResource](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RemoveTagsFromResource.html) | `ds:RemoveTagsFromResource`
`ec2:DeleteTags` | \* |
| [ResetUserPassword](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ResetUserPassword.html) | ds:ResetUserPassword | \* |
| [RestoreFromSnapshot](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_RestoreFromSnapshot.html) | `ds:RestoreFromSnapshot` | \* |
| [ShareDirectory](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_ShareDirectory.html) | `ds:ShareDirectory`
`organizations:DescribeAccount`
`organizations:DescribeOrganization`
`organizations:ListAWSServiceAccessForOrganization` | \* |
| [StartSchemaExtension](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_StartSchemaExtension.html) | `ds:StartSchemaExtension` | \* |
| [UnshareDirectory](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UnshareDirectory.html) | ds:UnshareDirectory | \* |
| [UpdateConditionalForwarder](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateConditionalForwarder.html) | `ds:UpdateConditionalForwarder` | \* |
| [UpdateNumberOfDomainControllers](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateNumberOfDomainControllers.html) | `ds:UpdateNumberOfDomainControllers`
`ec2:DescribeSubnets`
`ec2:DescribeVpcs`
`ec2:CreateNetworkInterface`
`ec2:DescribeNetworkInterfaces`
`ec2:DeleteNetworkInterface` | \* |
| [UpdateRadius](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateRadius.html) | `ds:UpdateRadius` | \* |
| [UpdateTrust](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_UpdateTrust.html) | ds:UpdateTrust | \* |
| [VerifyTrust](https://docs.aws.amazon.com/directoryservice/latest/devguide/API_VerifyTrust.html) | `ds:VerifyTrust` | \* |
## AWS API de datos de Directory Service y permisos necesarios para las acciones
**nota**
Para especificar una acción, use el prefijo `ds-data:` seguido del nombre de operación de la API (por ejemplo, `ds-data:AddGroupMember`).
| Operaciones de la API de Directory Service Data | Permisos necesarios (acciones de la API) | Recursos |
| --- | --- | --- |
| [AddGroupMember](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_AddGroupMember.html) | `ds-data:AddGroupMember` | \* |
| [CreateGroup](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_CreateGroup.html) | `ds-data:CreateGroup` | \* |
| [CreateUser](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_CreateUser.html) | `ds-data:CreateUser` | \* |
| [DeleteGroup](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_DeleteGroup.html) | `ds-data:DeleteGroup` | \* |
| [DeleteUser](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/DeleteUser.html) | `ds-data:DeleteUser` | \* |
| [DescribeGroup](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_DescribeGroup.html) | `ds-data:DescribeGroup` | \* |
| [DescribeUser](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_DescribeUser.html) | `ds-data:DescribeUser` | \* |
| [DisableUser](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_DisableUser.html) | `ds-data:DisableUser` | \* |
| [ListGroups](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_ListGroups.html) | `ds-data:ListGroups` | \* |
| [ListGroupMembers](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_ListGroupMembers.html) | `ds-data:ListGroupMembers` | \* |
| [ListGroupsForMember](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_ListGroupsForMember.html) | `ds-data:ListGroupsForMember` | \* |
| [ListUsers](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_ListUsers.html) | `ds-data:ListUsers` | \* |
| [RemoveGroupMember](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_RemoveGroupMember.html) | `ds-data:RemoveGroupMember` | \* |
| [SearchGroups](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_SearchGroups.html) | `ds-data:DescribeGroup`
`ds-data:SearchGroups` | \* |
| [SearchUsers](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_SearchUsers.html) | `ds-data:DescribeUser`
`ds-data:SearchUsers` | \* |
| [UpdateGroup](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_UpdateGroup.html) | `ds-data:UpdateGroup` | \* |
| [UpdateUser](https://docs.aws.amazon.com/directoryservicedata/latest/DirectoryServiceDataAPIReference/API_UpdateUser.html) | `ds-data:UpdateUser` | \* |
## Temas relacionados
+ [Control de acceso](iam_auth_access.md#access_control)