# Actions, resources, and condition keys for Amazon DataZone Amazon DataZone (service prefix: `datazone`) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies. References: + Learn how to [configure this service](https://docs.aws.amazon.com/datazone/latest/userguide/). + View a list of the [API operations available for this service](https://docs.aws.amazon.com/datazone/latest/APIReference/). + Learn how to secure this service and its resources by [using IAM](https://docs.aws.amazon.com/datazone/latest/userguide/security-iam.html) permission policies. **Topics** + [Actions defined by Amazon DataZone](#amazondatazone-actions-as-permissions) + [Resource types defined by Amazon DataZone](#amazondatazone-resources-for-iam-policies) + [Condition keys for Amazon DataZone](#amazondatazone-policy-keys) ## Actions defined by Amazon DataZone You can specify the following actions in the `Action` element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions. The **Access level** column of the Actions table describes how the action is classified (List, Read, Permissions management, or Tagging). This classification can help you understand the level of access that an action grants when you use it in a policy. For more information about access levels, see [Access levels in policy summaries](https://docs.aws.amazon.com/IAM/latest/UserGuide/access_policies_understand-policy-summary-access-level-summaries.html). The **Resource types** column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("\*") to which the policy applies in the `Resource` element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (\*). If you limit resource access with the `Resource` element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types. The **Condition keys** column of the Actions table includes keys that you can specify in a policy statement's `Condition` element. For more information on the condition keys that are associated with resources for the service, see the **Condition keys** column of the Resource types table. The **Dependent actions** column of the Actions table shows additional permissions that may be required to successfully call an action. These permissions may be needed in addition to the permission for the action itself. When an action specifies dependent actions, those dependencies may apply to additional resources defined for that action, not only the first resource listed in the table. **Note** Resource condition keys are listed in the [Resource types](#amazondatazone-resources-for-iam-policies) table. You can find a link to the resource type that applies to an action in the **Resource types (\*required)** column of the Actions table. The resource type in the Resource types table includes the **Condition keys** column, which are the resource condition keys that apply to an action in the Actions table. For details about the columns in the following table, see [Actions table](reference_policies_actions-resources-contextkeys.html#actions_table). **** - ** [${APIReferenceDocPage}API_AcceptPredictions.html](${APIReferenceDocPage}API_AcceptPredictions.html) ** - **Description:** Grants permission to accept prediction - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_AcceptSubscriptionRequest.html](${APIReferenceDocPage}API_AcceptSubscriptionRequest.html) ** - **Description:** Grants permission to approve a subscription request for a Data Asset - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_AddEntityOwner.html](${APIReferenceDocPage}API_AddEntityOwner.html) ** - **Description:** Grants permission to add an owner to an entity like domain unit - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_AddPolicyGrant.html](${APIReferenceDocPage}API_AddPolicyGrant.html) ** - **Description:** Grants permission to add a policy grant - **Access level:** Permissions management - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_AssociateEnvironmentRole.html](${APIReferenceDocPage}API_AssociateEnvironmentRole.html) ** - **Description:** Grants permission to associate a role in a default service blueprint environment - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_AssociateGovernedTerms.html](${APIReferenceDocPage}API_AssociateGovernedTerms.html) ** - **Description:** Grants permission to associate governed terms to an asset - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_BatchDeleteLinkedTypes.html](${APIReferenceDocPage}API_BatchDeleteLinkedTypes.html) [permission only]** - **Description:** Grants permission to remove linked type items from an Amazon DataZone Domain - **Access level:** Write - **Resource types (\*required):** [#amazondatazone-domain](#amazondatazone-domain) - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_BatchGetAttributesMetadata.html](${APIReferenceDocPage}API_BatchGetAttributesMetadata.html) ** - **Description:** Grants permission to retrieve attributes metadata - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_BatchGetCell.html](${APIReferenceDocPage}API_BatchGetCell.html) ** - **Description:** Grants permission to batch get cells - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_BatchGetCellRun.html](${APIReferenceDocPage}API_BatchGetCellRun.html) ** - **Description:** Grants permission to batch get cell runs - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_BatchPutAttributesMetadata.html](${APIReferenceDocPage}API_BatchPutAttributesMetadata.html) ** - **Description:** Grants permission to create and update attributes metadata - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_BatchPutLinkedTypes.html](${APIReferenceDocPage}API_BatchPutLinkedTypes.html) [permission only]** - **Description:** Grants permission to put linked type items to an Amazon DataZone Domain - **Access level:** Write - **Resource types (\*required):** [#amazondatazone-domain](#amazondatazone-domain) - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CancelMessage.html](${APIReferenceDocPage}API_CancelMessage.html) ** - **Description:** Grants permission to cancel an in-progress agent response - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CancelMetadataGenerationRun.html](${APIReferenceDocPage}API_CancelMetadataGenerationRun.html) ** - **Description:** Grants permission to cancel metadata generation run - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CancelSubscription.html](${APIReferenceDocPage}API_CancelSubscription.html) ** - **Description:** Grants permission to revoke or unsubscribe an approved subscription to Data Asset - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateAccountPool.html](${APIReferenceDocPage}API_CreateAccountPool.html) ** - **Description:** Grants permission to create an account pool - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateAsset.html](${APIReferenceDocPage}API_CreateAsset.html) ** - **Description:** Grants permission to create asset - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateAssetFilter.html](${APIReferenceDocPage}API_CreateAssetFilter.html) ** - **Description:** Grants permission to create asset filter - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateAssetRevision.html](${APIReferenceDocPage}API_CreateAssetRevision.html) ** - **Description:** Grants permission to create new revision of an asset - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateAssetType.html](${APIReferenceDocPage}API_CreateAssetType.html) ** - **Description:** Grants permission to create an asset type - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateCell.html](${APIReferenceDocPage}API_CreateCell.html) ** - **Description:** Grants permission to create cells - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateCellRun.html](${APIReferenceDocPage}API_CreateCellRun.html) ** - **Description:** Grants permission to create cell runs - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateConnection.html](${APIReferenceDocPage}API_CreateConnection.html) ** - **Description:** Grants permission to create connections - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateDataProduct.html](${APIReferenceDocPage}API_CreateDataProduct.html) ** - **Description:** Grants permission to create data product - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateDataProductRevision.html](${APIReferenceDocPage}API_CreateDataProductRevision.html) ** - **Description:** Grants permission to create data product revision - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateDataSource.html](${APIReferenceDocPage}API_CreateDataSource.html) ** - **Description:** Grants permission to create a new DataSource - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateDomain.html](${APIReferenceDocPage}API_CreateDomain.html) ** - **Description:** Grants permission to provision a domain which is a top level entity that contains other Amazon DataZone resources - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** [#amazondatazone-aws_RequestTag___TagKey_](#amazondatazone-aws_RequestTag___TagKey_)
[#amazondatazone-aws_TagKeys](#amazondatazone-aws_TagKeys) - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateDomainUnit.html](${APIReferenceDocPage}API_CreateDomainUnit.html) ** - **Description:** Grants permission to create a domain unit - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateEnvironment.html](${APIReferenceDocPage}API_CreateEnvironment.html) ** - **Description:** Grants permission to create a collection of configurated resources used to publish and subscribe to data - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateEnvironmentAction.html](${APIReferenceDocPage}API_CreateEnvironmentAction.html) ** - **Description:** Grants permission to create an environment action in a default service blueprint environment - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateEnvironmentBlueprint.html](${APIReferenceDocPage}API_CreateEnvironmentBlueprint.html) ** - **Description:** Grants permission to create a custom Environment Blueprint that allow user to add Environments to their Project - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateEnvironmentProfile.html](${APIReferenceDocPage}API_CreateEnvironmentProfile.html) ** - **Description:** Grants permission to create a template from a Blueprint that can be used to create a Environment - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateFormType.html](${APIReferenceDocPage}API_CreateFormType.html) ** - **Description:** Grants permission to create a form type or a new revision of it - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateGlossary.html](${APIReferenceDocPage}API_CreateGlossary.html) ** - **Description:** Grants permission to create a business glossary - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateGlossaryTerm.html](${APIReferenceDocPage}API_CreateGlossaryTerm.html) ** - **Description:** Grants permission to create a glossary term - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateGroupProfile.html](${APIReferenceDocPage}API_CreateGroupProfile.html) ** - **Description:** Grants permission to create a DataZone group profile for an IAM Identity Center group - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateListingChangeSet.html](${APIReferenceDocPage}API_CreateListingChangeSet.html) ** - **Description:** Grants permission to create listing change set - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateNotebook.html](${APIReferenceDocPage}API_CreateNotebook.html) ** - **Description:** Grants permission to create notebooks - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateProject.html](${APIReferenceDocPage}API_CreateProject.html) ** - **Description:** Grants permission to create a Project to enable your team to publish and subscribe to data - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateProjectMembership.html](${APIReferenceDocPage}API_CreateProjectMembership.html) ** - **Description:** Grants permission to add a user to a Project - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateProjectProfile.html](${APIReferenceDocPage}API_CreateProjectProfile.html) ** - **Description:** Grants permission to create a project profile - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateRule.html](${APIReferenceDocPage}API_CreateRule.html) ** - **Description:** Grants permission to create rule - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateSubscriptionGrant.html](${APIReferenceDocPage}API_CreateSubscriptionGrant.html) ** - **Description:** Grants permission to create a grant for an approved subscription on a subscription target - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateSubscriptionRequest.html](${APIReferenceDocPage}API_CreateSubscriptionRequest.html) ** - **Description:** Grants permission to create a subscription request for a Data Asset - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateSubscriptionTarget.html](${APIReferenceDocPage}API_CreateSubscriptionTarget.html) ** - **Description:** Grants permission to create a subscription target for a Environment in the project - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_CreateUserProfile.html](${APIReferenceDocPage}API_CreateUserProfile.html) ** - **Description:** Grants permission to create a user profile for an existing user in the customers IAM Identity Center - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteAccountPool.html](${APIReferenceDocPage}API_DeleteAccountPool.html) ** - **Description:** Grants permission to delete an account pool - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteAsset.html](${APIReferenceDocPage}API_DeleteAsset.html) ** - **Description:** Grants permission to delete an asset - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteAssetFilter.html](${APIReferenceDocPage}API_DeleteAssetFilter.html) ** - **Description:** Grants permission to delete asset filter - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteAssetType.html](${APIReferenceDocPage}API_DeleteAssetType.html) ** - **Description:** Grants permission to delete an asset type - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteCell.html](${APIReferenceDocPage}API_DeleteCell.html) ** - **Description:** Grants permission to delete cells - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteCellRun.html](${APIReferenceDocPage}API_DeleteCellRun.html) ** - **Description:** Grants permission to delete cell runs - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteConnection.html](${APIReferenceDocPage}API_DeleteConnection.html) ** - **Description:** Grants permission to delete connections - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteDataExportConfiguration.html](${APIReferenceDocPage}API_DeleteDataExportConfiguration.html) ** - **Description:** Grants permission to delete DataZone catalog data export configuration - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteDataProduct.html](${APIReferenceDocPage}API_DeleteDataProduct.html) ** - **Description:** Grants permission to delete data product - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteDataSource.html](${APIReferenceDocPage}API_DeleteDataSource.html) ** - **Description:** Grants permission to update existing DataSource - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteDomain.html](${APIReferenceDocPage}API_DeleteDomain.html) ** - **Description:** Grants permission to delete a provisioned domain - **Access level:** Write - **Resource types (\*required):** [#amazondatazone-domain](#amazondatazone-domain) - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteDomainSharingPolicy.html](${APIReferenceDocPage}API_DeleteDomainSharingPolicy.html) [permission only]** - **Description:** Grants permission to delete a resource policy for a DataZone Domain - **Access level:** Permissions management - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteDomainUnit.html](${APIReferenceDocPage}API_DeleteDomainUnit.html) ** - **Description:** Grants permission to delete an existing domain unit - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteEnvironment.html](${APIReferenceDocPage}API_DeleteEnvironment.html) ** - **Description:** Grants permission to Delete Environment - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteEnvironmentAction.html](${APIReferenceDocPage}API_DeleteEnvironmentAction.html) ** - **Description:** Grants permission to delete an environment action in a default service blueprint environment - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteEnvironmentBlueprint.html](${APIReferenceDocPage}API_DeleteEnvironmentBlueprint.html) ** - **Description:** Grants permission to delete Environment Blueprint - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteEnvironmentBlueprintConfiguration.html](${APIReferenceDocPage}API_DeleteEnvironmentBlueprintConfiguration.html) ** - **Description:** Grants permission to delete environment blueprint configuration - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteEnvironmentProfile.html](${APIReferenceDocPage}API_DeleteEnvironmentProfile.html) ** - **Description:** Grants permission to delete Environment Profile - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteFormType.html](${APIReferenceDocPage}API_DeleteFormType.html) ** - **Description:** Grants permission to delete a form type - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteGlossary.html](${APIReferenceDocPage}API_DeleteGlossary.html) ** - **Description:** Grants permission to delete a business glossary - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteGlossaryTerm.html](${APIReferenceDocPage}API_DeleteGlossaryTerm.html) ** - **Description:** Grants permission to delete a glossary term - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteListing.html](${APIReferenceDocPage}API_DeleteListing.html) ** - **Description:** Grants permission to delete listing - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteNotebook.html](${APIReferenceDocPage}API_DeleteNotebook.html) ** - **Description:** Grants permission to delete notebooks - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteProject.html](${APIReferenceDocPage}API_DeleteProject.html) ** - **Description:** Grants permission to delete a Project that enables your team to publish and subscribe to data - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteProjectMembership.html](${APIReferenceDocPage}API_DeleteProjectMembership.html) ** - **Description:** Grants permission to remove a user from a project - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteProjectProfile.html](${APIReferenceDocPage}API_DeleteProjectProfile.html) ** - **Description:** Grants permission to delete a project profile - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteRule.html](${APIReferenceDocPage}API_DeleteRule.html) ** - **Description:** Grants permission to delete rule - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteSubscriptionGrant.html](${APIReferenceDocPage}API_DeleteSubscriptionGrant.html) ** - **Description:** Grants permission to delete a subscription grant from a subscription target - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteSubscriptionRequest.html](${APIReferenceDocPage}API_DeleteSubscriptionRequest.html) ** - **Description:** Grants permission to delete a pending subscription request for a Data Asset - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteSubscriptionTarget.html](${APIReferenceDocPage}API_DeleteSubscriptionTarget.html) ** - **Description:** Grants permission to delete a subscription target from a Environment in the project - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DeleteTimeSeriesDataPoints.html](${APIReferenceDocPage}API_DeleteTimeSeriesDataPoints.html) ** - **Description:** Grants permission to delete existing TimeSeriesDataPoints - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_AssociateEnvironmentRole.html](${APIReferenceDocPage}API_AssociateEnvironmentRole.html) ** - **Description:** Grants permission to disassociate a role in a default service blueprint environment - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_DisassociateGovernedTerms.html](${APIReferenceDocPage}API_DisassociateGovernedTerms.html) ** - **Description:** Grants permission to disassociate governed terms to an asset - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GenerateCode.html](${APIReferenceDocPage}API_GenerateCode.html) ** - **Description:** Grants permission to generate code - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetAccountPool.html](${APIReferenceDocPage}API_GetAccountPool.html) ** - **Description:** Grants permission to get account pool details - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetAsset.html](${APIReferenceDocPage}API_GetAsset.html) ** - **Description:** Grants permission to retrieve an asset - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetAssetFilter.html](${APIReferenceDocPage}API_GetAssetFilter.html) ** - **Description:** Grants permission to get asset filter - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetAssetType.html](${APIReferenceDocPage}API_GetAssetType.html) ** - **Description:** Grants permission to get an asset type - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetCell.html](${APIReferenceDocPage}API_GetCell.html) ** - **Description:** Grants permission to get cells - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetCellRun.html](${APIReferenceDocPage}API_GetCellRun.html) ** - **Description:** Grants permission to get cell runs - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetCellRunResult.html](${APIReferenceDocPage}API_GetCellRunResult.html) ** - **Description:** Grants permission to get cell run result - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetConnection.html](${APIReferenceDocPage}API_GetConnection.html) ** - **Description:** Grants permission to get connections - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetConversation.html](${APIReferenceDocPage}API_GetConversation.html) ** - **Description:** Grants permission to get conversations - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetDataExportConfiguration.html](${APIReferenceDocPage}API_GetDataExportConfiguration.html) ** - **Description:** Grants permission to retrieve DataZone catalog data export configuration - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetDataProduct.html](${APIReferenceDocPage}API_GetDataProduct.html) ** - **Description:** Grants permission to get data product - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetDataSource.html](${APIReferenceDocPage}API_GetDataSource.html) ** - **Description:** Grants permission to Get a existing DataSource in Amazon DataZone using its identifier - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetDataSourceRun.html](${APIReferenceDocPage}API_GetDataSourceRun.html) ** - **Description:** Grants permission to get DataSource run job in Amazon DataZone using it's identifier - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetDomain.html](${APIReferenceDocPage}API_GetDomain.html) ** - **Description:** Grants permission to retrieve information about a domain - **Access level:** Read - **Resource types (\*required):** [#amazondatazone-domain](#amazondatazone-domain) - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetDomainExecutionRoleCredentials.html](${APIReferenceDocPage}API_GetDomainExecutionRoleCredentials.html) [permission only]** - **Description:** Grants permission to use features that require access to domain execution role credentials - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetDomainSharingPolicy.html](${APIReferenceDocPage}API_GetDomainSharingPolicy.html) [permission only]** - **Description:** Grants permission to retrieve a resource policy for a DataZone Domain - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetDomainUnit.html](${APIReferenceDocPage}API_GetDomainUnit.html) ** - **Description:** Grants permission to get an existing domain unit - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetEnvironment.html](${APIReferenceDocPage}API_GetEnvironment.html) ** - **Description:** Grants permission to get Environment details - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetEnvironmentAction.html](${APIReferenceDocPage}API_GetEnvironmentAction.html) ** - **Description:** Grants permission to get an environment action in a default service blueprint environment - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetEnvironmentActionLink.html](${APIReferenceDocPage}API_GetEnvironmentActionLink.html) [permission only]** - **Description:** Grants permission to get environment action link - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetEnvironmentBlueprint.html](${APIReferenceDocPage}API_GetEnvironmentBlueprint.html) ** - **Description:** Grants permission to get Environment Blueprint details - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetEnvironmentBlueprintConfiguration.html](${APIReferenceDocPage}API_GetEnvironmentBlueprintConfiguration.html) ** - **Description:** Grants permission to get environment blueprint configuration - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetEnvironmentCredentials.html](${APIReferenceDocPage}API_GetEnvironmentCredentials.html) ** - **Description:** Grants permission to get short term credentials that assume the Environment user role - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetEnvironmentProfile.html](${APIReferenceDocPage}API_GetEnvironmentProfile.html) ** - **Description:** Grants permission to get Environment Profile details - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetFormType.html](${APIReferenceDocPage}API_GetFormType.html) ** - **Description:** Grants permission to get a form type - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetGlossary.html](${APIReferenceDocPage}API_GetGlossary.html) ** - **Description:** Grants permission to get a business glossary - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetGlossaryTerm.html](${APIReferenceDocPage}API_GetGlossaryTerm.html) ** - **Description:** Grants permission to get a glossary term - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetGroupProfile.html](${APIReferenceDocPage}API_GetGroupProfile.html) ** - **Description:** Grants permission to retrieve an existing DataZone group profile - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetIamPortalLoginUrl.html](${APIReferenceDocPage}API_GetIamPortalLoginUrl.html) ** - **Description:** Grants permission to an IAM principal to log into the DataZone Portal - **Access level:** Permissions management - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetJobRun.html](${APIReferenceDocPage}API_GetJobRun.html) ** - **Description:** Grants permission to get job runs - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetLineageEvent.html](${APIReferenceDocPage}API_GetLineageEvent.html) ** - **Description:** Grants permission to get lineage events - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetLineageNode.html](${APIReferenceDocPage}API_GetLineageNode.html) ** - **Description:** Grants permission to get the lineage node - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetListing.html](${APIReferenceDocPage}API_GetListing.html) ** - **Description:** Grants permission to get listing - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetMetadataGenerationRun.html](${APIReferenceDocPage}API_GetMetadataGenerationRun.html) ** - **Description:** Grants permission to get metadata generation run - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetNotebook.html](${APIReferenceDocPage}API_GetNotebook.html) ** - **Description:** Grants permission to get notebooks - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetNotebookCompute.html](${APIReferenceDocPage}API_GetNotebookCompute.html) ** - **Description:** Grants permission to get notebook compute - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetNotebookExport.html](${APIReferenceDocPage}API_GetNotebookExport.html) ** - **Description:** Grants permission to get notebook exports - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetProject.html](${APIReferenceDocPage}API_GetProject.html) ** - **Description:** Grants permission to get Project details - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetProjectProfile.html](${APIReferenceDocPage}API_GetProjectProfile.html) ** - **Description:** Grants permission to get project profile details - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetRule.html](${APIReferenceDocPage}API_GetRule.html) ** - **Description:** Grants permission to get rule - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetSubscription.html](${APIReferenceDocPage}API_GetSubscription.html) ** - **Description:** Grants permission to retrieve a subscription - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetSubscriptionEligibility.html](${APIReferenceDocPage}API_GetSubscriptionEligibility.html) [permission only]** - **Description:** Grants permission to get subscription eligibilty - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetSubscriptionGrant.html](${APIReferenceDocPage}API_GetSubscriptionGrant.html) ** - **Description:** Grants permission to retireve a subscription grant - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetSubscriptionRequestDetails.html](${APIReferenceDocPage}API_GetSubscriptionRequestDetails.html) ** - **Description:** Grants permission to reject a subscription request for a Data Asset - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetSubscriptionTarget.html](${APIReferenceDocPage}API_GetSubscriptionTarget.html) ** - **Description:** Grants permission to retireve details of subscription target - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetTimeSeriesDataPoint.html](${APIReferenceDocPage}API_GetTimeSeriesDataPoint.html) ** - **Description:** Grants permission to get an existing TimeSeriesDataPoints in Amazon DataZone using its identifier - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetUpdateEligibility.html](${APIReferenceDocPage}API_GetUpdateEligibility.html) ** - **Description:** Grants permission to get update eligibility status for project constructs - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_GetUserProfile.html](${APIReferenceDocPage}API_GetUserProfile.html) ** - **Description:** Grants permission to retrieve a user profile for an existing user in the DataZone Domain - **Access level:** Read - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListAccountEnvironments.html](${APIReferenceDocPage}API_ListAccountEnvironments.html) ** - **Description:** Grants permission to list Environments across all domains in an AWS Account - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [{APIReferenceDocPage}API_ListAccountPools.html]({APIReferenceDocPage}API_ListAccountPools.html) ** - **Description:** Grants permission to list account pools - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [{APIReferenceDocPage}API_ListAccountsInAccountPool.html]({APIReferenceDocPage}API_ListAccountsInAccountPool.html) ** - **Description:** Grants permission to list accounts in an account pool - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListAssetFilters.html](${APIReferenceDocPage}API_ListAssetFilters.html) ** - **Description:** Grants permission to list asset filters - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListAssetRevisions.html](${APIReferenceDocPage}API_ListAssetRevisions.html) ** - **Description:** Grants permission to list revisions of an asset - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListCellRuns.html](${APIReferenceDocPage}API_ListCellRuns.html) ** - **Description:** Grants permission to list cell runs - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListConnections.html](${APIReferenceDocPage}API_ListConnections.html) ** - **Description:** Grants permission to list connections - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListConversations.html](${APIReferenceDocPage}API_ListConversations.html) ** - **Description:** Grants permission to list conversations - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListDataProductRevisions.html](${APIReferenceDocPage}API_ListDataProductRevisions.html) ** - **Description:** Grants permission to list data product revisions - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListDataSourceRunActivities.html](${APIReferenceDocPage}API_ListDataSourceRunActivities.html) ** - **Description:** Grants permission to list DataSource runs job's activities on Asset - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListDataSourceRuns.html](${APIReferenceDocPage}API_ListDataSourceRuns.html) ** - **Description:** Grants permission to list DataSource runs job - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListDataSources.html](${APIReferenceDocPage}API_ListDataSources.html) ** - **Description:** Grants permission to list existing DataSources - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListDomainUnitsForParent.html](${APIReferenceDocPage}API_ListDomainUnitsForParent.html) ** - **Description:** Grants permission to list child domain units for a given parent domain unit - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListDomains.html](${APIReferenceDocPage}API_ListDomains.html) ** - **Description:** Grants permission to retrieve all domains - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListEntityOwners.html](${APIReferenceDocPage}API_ListEntityOwners.html) ** - **Description:** Grants permission to list owners of an entity like domain unit - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListEnvironmentActions.html](${APIReferenceDocPage}API_ListEnvironmentActions.html) ** - **Description:** Grants permission to list environment actions in a default service blueprint environment - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListEnvironmentBlueprintConfigurationSummaries.html](${APIReferenceDocPage}API_ListEnvironmentBlueprintConfigurationSummaries.html) [permission only]** - **Description:** Grants permission to list environment blueprint configuration summaries - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListEnvironmentBlueprintConfigurations.html](${APIReferenceDocPage}API_ListEnvironmentBlueprintConfigurations.html) ** - **Description:** Grants permission to list environment blueprint configurations - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListEnvironmentBlueprints.html](${APIReferenceDocPage}API_ListEnvironmentBlueprints.html) ** - **Description:** Grants permission to list Domain for Environment Blueprints - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListEnvironmentProfiles.html](${APIReferenceDocPage}API_ListEnvironmentProfiles.html) ** - **Description:** Grants permission to list Domain for Environment Profiles - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListEnvironments.html](${APIReferenceDocPage}API_ListEnvironments.html) ** - **Description:** Grants permission to show Environments in the Domain - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListGroupsForUser.html](${APIReferenceDocPage}API_ListGroupsForUser.html) ** - **Description:** Grants permission to list all the DataZone group profiles that the DataZone user profile is a member of - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListJobRuns.html](${APIReferenceDocPage}API_ListJobRuns.html) ** - **Description:** Grants permission to list job runs - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListLineageEvents.html](${APIReferenceDocPage}API_ListLineageEvents.html) ** - **Description:** Grants permission to list lineage events - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListLineageNodeHistory.html](${APIReferenceDocPage}API_ListLineageNodeHistory.html) ** - **Description:** Grants permission to list historical versions of lineage node - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListLinkedTypes.html](${APIReferenceDocPage}API_ListLinkedTypes.html) [permission only]** - **Description:** Grants permission to list linked type items linked to an Amazon DataZone Domain - **Access level:** List - **Resource types (\*required):** [#amazondatazone-domain](#amazondatazone-domain) - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListMetadataGenerationRuns.html](${APIReferenceDocPage}API_ListMetadataGenerationRuns.html) ** - **Description:** Grants permission to list metadata generation runs - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListNotebooks.html](${APIReferenceDocPage}API_ListNotebooks.html) ** - **Description:** Grants permission to list notebooks - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListNotifications.html](${APIReferenceDocPage}API_ListNotifications.html) ** - **Description:** Grants permission to list notifications and events for a datazone user - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListPolicyGrants.html](${APIReferenceDocPage}API_ListPolicyGrants.html) ** - **Description:** Grants permission to list policy grants - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListProjectMemberships.html](${APIReferenceDocPage}API_ListProjectMemberships.html) ** - **Description:** Grants permission to list Project Members - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListProjectProfiles.html](${APIReferenceDocPage}API_ListProjectProfiles.html) ** - **Description:** Grants permission to list project profiles - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListProjects.html](${APIReferenceDocPage}API_ListProjects.html) ** - **Description:** Grants permission to list Projects - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListRules.html](${APIReferenceDocPage}API_ListRules.html) ** - **Description:** Grants permission to list rules - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListSubscriptionGrants.html](${APIReferenceDocPage}API_ListSubscriptionGrants.html) ** - **Description:** Grants permission to List subscription grants for a subscribed principal - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListSubscriptionRequests.html](${APIReferenceDocPage}API_ListSubscriptionRequests.html) ** - **Description:** Grants permission to list subscription requests - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListSubscriptionTargets.html](${APIReferenceDocPage}API_ListSubscriptionTargets.html) ** - **Description:** Grants permission to list subscription targets - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListSubscriptions.html](${APIReferenceDocPage}API_ListSubscriptions.html) ** - **Description:** Grants permission to list subscriptions - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListTagsForResource.html](${APIReferenceDocPage}API_ListTagsForResource.html) ** - **Description:** Grants permission to retrieve all tags associated with a resource - **Access level:** Read - **Resource types (\*required):** [#amazondatazone-domain](#amazondatazone-domain) - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListTimeSeriesDataPoints.html](${APIReferenceDocPage}API_ListTimeSeriesDataPoints.html) ** - **Description:** Grants permission to list existing TimeSeriesDataPoints - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ListWarehouseMetadata.html](${APIReferenceDocPage}API_ListWarehouseMetadata.html) [permission only]** - **Description:** Grants permission to list available Manager Secrets - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_PostLineageEvent.html](${APIReferenceDocPage}API_PostLineageEvent.html) ** - **Description:** Grants permission to post lineage events - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_PostTimeSeriesDataPoints.html](${APIReferenceDocPage}API_PostTimeSeriesDataPoints.html) ** - **Description:** Grants permission to post a new TimeSeriesDataPoints - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ProvisionDomain.html](${APIReferenceDocPage}API_ProvisionDomain.html) [permission only]** - **Description:** Grants permission to provision domain with default project setup - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_PutCellRunResult.html](${APIReferenceDocPage}API_PutCellRunResult.html) ** - **Description:** Grants permission to put cell run results - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_PutDataExportConfiguration.html](${APIReferenceDocPage}API_PutDataExportConfiguration.html) ** - **Description:** Grants permission to create and update DataZone catalog data export configuration - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_PutDomainSharingPolicy.html](${APIReferenceDocPage}API_PutDomainSharingPolicy.html) [permission only]** - **Description:** Grants permission to add a resource policy for a DataZone Domain - **Access level:** Permissions management - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_PutEnvironmentBlueprintConfiguration.html](${APIReferenceDocPage}API_PutEnvironmentBlueprintConfiguration.html) ** - **Description:** Grants permission to put environment blueprint configuration - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_QueryGraph.html](${APIReferenceDocPage}API_QueryGraph.html) ** - **Description:** Grants permission to query graph - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_RefreshToken.html](${APIReferenceDocPage}API_RefreshToken.html) [permission only]** - **Description:** Grants permission to refresh token - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_RejectPredictions.html](${APIReferenceDocPage}API_RejectPredictions.html) ** - **Description:** Grants permission to reject prediction - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_RejectSubscriptionRequest.html](${APIReferenceDocPage}API_RejectSubscriptionRequest.html) ** - **Description:** Grants permission to reject a subscription request for a Data Asset - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_RemoveEntityOwner.html](${APIReferenceDocPage}API_RemoveEntityOwner.html) ** - **Description:** Grants permission to remove an existing owner of an entity like domain unit - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_RemovePolicyGrant.html](${APIReferenceDocPage}API_RemovePolicyGrant.html) ** - **Description:** Grants permission to remove a policy grant - **Access level:** Permissions management - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_RevokeSubscription.html](${APIReferenceDocPage}API_RevokeSubscription.html) ** - **Description:** Grants permission to revoke a subscription - **Access level:** Permissions management - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_Search.html](${APIReferenceDocPage}API_Search.html) ** - **Description:** Grants permission to search datazone entities - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_SearchGroupProfiles.html](${APIReferenceDocPage}API_SearchGroupProfiles.html) ** - **Description:** Grants permission to search DataZone group profiles and IAM Identity Center groups - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_SearchListings.html](${APIReferenceDocPage}API_SearchListings.html) ** - **Description:** Grants permission to search listings - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_SearchRules.html](${APIReferenceDocPage}API_SearchRules.html) [permission only]** - **Description:** Grants permission to search rules - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_SearchTypes.html](${APIReferenceDocPage}API_SearchTypes.html) ** - **Description:** Grants permission to search types such asset types and form types in a domain - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_SearchUserProfiles.html](${APIReferenceDocPage}API_SearchUserProfiles.html) ** - **Description:** Grants permission to search DataZone user profiles, IAM Identity Center users, and DataZone IAM principal profiles - **Access level:** List - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_SendMessage.html](${APIReferenceDocPage}API_SendMessage.html) ** - **Description:** Grants permission to send messages - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_SsoLogin.html](${APIReferenceDocPage}API_SsoLogin.html) [permission only]** - **Description:** Grants permission to login using SSO - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_SsoLogout.html](${APIReferenceDocPage}API_SsoLogout.html) [permission only]** - **Description:** Grants permission to logout as SSO user - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_StartAccountBootstrapAction.html](${APIReferenceDocPage}API_StartAccountBootstrapAction.html) [permission only]** - **Description:** Grants permission to start account bootstrap action for a domain - **Access level:** Write - **Resource types (\*required):** [#amazondatazone-domain](#amazondatazone-domain) - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_StartConversation.html](${APIReferenceDocPage}API_StartConversation.html) ** - **Description:** Grants permission to start conversations - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_StartDataSourceRun.html](${APIReferenceDocPage}API_StartDataSourceRun.html) ** - **Description:** Grants permission to start a DataSource run job - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_StartMetadataGenerationRun.html](${APIReferenceDocPage}API_StartMetadataGenerationRun.html) ** - **Description:** Grants permission to start metadata generation run - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_StartNotebookCompute.html](${APIReferenceDocPage}API_StartNotebookCompute.html) ** - **Description:** Grants permission to start notebook compute - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_StartNotebookExport.html](${APIReferenceDocPage}API_StartNotebookExport.html) ** - **Description:** Grants permission to export notebooks - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_StartNotebookImport.html](${APIReferenceDocPage}API_StartNotebookImport.html) ** - **Description:** Grants permission to import notebooks - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_StopMetadataGenerationRun.html](${APIReferenceDocPage}API_StopMetadataGenerationRun.html) ** - **Description:** Grants permission to stop metadata generation run - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_StopNotebookCompute.html](${APIReferenceDocPage}API_StopNotebookCompute.html) ** - **Description:** Grants permission to stop notebook compute - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_TagResource.html](${APIReferenceDocPage}API_TagResource.html) ** - **Description:** Grants permission to add or update tags to a resource - **Access level:** Tagging - **Resource types (\*required):** [#amazondatazone-domain](#amazondatazone-domain) / **Condition keys:** / **Dependent actions:** - **Resource types (\*required):** / **Condition keys:** [#amazondatazone-aws_RequestTag___TagKey_](#amazondatazone-aws_RequestTag___TagKey_)
[#amazondatazone-aws_TagKeys](#amazondatazone-aws_TagKeys) / **Dependent actions:** - ** [${APIReferenceDocPage}API_UntagResource.html](${APIReferenceDocPage}API_UntagResource.html) ** - **Description:** Grants permission to remove tags associated with a resource - **Access level:** Tagging - **Resource types (\*required):** [#amazondatazone-domain](#amazondatazone-domain) / **Condition keys:** / **Dependent actions:** - **Resource types (\*required):** / **Condition keys:** [#amazondatazone-aws_TagKeys](#amazondatazone-aws_TagKeys) / **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateAccountPool.html](${APIReferenceDocPage}API_UpdateAccountPool.html) ** - **Description:** Grants permission to update an account pool - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateAssetFilter.html](${APIReferenceDocPage}API_UpdateAssetFilter.html) ** - **Description:** Grants permission to update asset filter - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateCell.html](${APIReferenceDocPage}API_UpdateCell.html) ** - **Description:** Grants permission to update cells - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateCellRun.html](${APIReferenceDocPage}API_UpdateCellRun.html) ** - **Description:** Grants permission to update cell runs - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateConnection.html](${APIReferenceDocPage}API_UpdateConnection.html) ** - **Description:** Grants permission to update connections - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateDataSource.html](${APIReferenceDocPage}API_UpdateDataSource.html) ** - **Description:** Grants permission to update existing DataSource - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateDataSourceRunActivities.html](${APIReferenceDocPage}API_UpdateDataSourceRunActivities.html) [permission only]** - **Description:** Grants permission to update data source run activities - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateDomain.html](${APIReferenceDocPage}API_UpdateDomain.html) ** - **Description:** Grants permission to update information for a domain - **Access level:** Write - **Resource types (\*required):** [#amazondatazone-domain](#amazondatazone-domain) - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateDomainUnit.html](${APIReferenceDocPage}API_UpdateDomainUnit.html) ** - **Description:** Grants permission to update an existing domain unit - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateEnvironment.html](${APIReferenceDocPage}API_UpdateEnvironment.html) ** - **Description:** Grants permission to update Environment settings - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateEnvironmentAction.html](${APIReferenceDocPage}API_UpdateEnvironmentAction.html) ** - **Description:** Grants permission to update an environment action in a default service blueprint environment - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateEnvironmentBlueprint.html](${APIReferenceDocPage}API_UpdateEnvironmentBlueprint.html) ** - **Description:** Grants permission to update Environment Blueprint settings - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateEnvironmentConfiguration.html](${APIReferenceDocPage}API_UpdateEnvironmentConfiguration.html) [permission only]** - **Description:** Grants permission to update environment configuration - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateEnvironmentDeploymentStatus.html](${APIReferenceDocPage}API_UpdateEnvironmentDeploymentStatus.html) [permission only]** - **Description:** Grants permission to update status of the Environment deployment - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateEnvironmentProfile.html](${APIReferenceDocPage}API_UpdateEnvironmentProfile.html) ** - **Description:** Grants permission to update EnvironmentProfile configuration - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateGlossary.html](${APIReferenceDocPage}API_UpdateGlossary.html) ** - **Description:** Grants permission to update a business glossary - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateGlossaryTerm.html](${APIReferenceDocPage}API_UpdateGlossaryTerm.html) ** - **Description:** Grants permission to update a glossary term - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateGroupProfile.html](${APIReferenceDocPage}API_UpdateGroupProfile.html) ** - **Description:** Grants permission to update a DataZone group profile - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateNotebook.html](${APIReferenceDocPage}API_UpdateNotebook.html) ** - **Description:** Grants permission to update notebooks - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateProject.html](${APIReferenceDocPage}API_UpdateProject.html) ** - **Description:** Grants permission to update a Project that enables your team to publish and subscribe to data - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateProjectProfile.html](${APIReferenceDocPage}API_UpdateProjectProfile.html) ** - **Description:** Grants permission to update a project profile - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateRule.html](${APIReferenceDocPage}API_UpdateRule.html) ** - **Description:** Grants permission to update rule - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateSubscriptionGrantStatus.html](${APIReferenceDocPage}API_UpdateSubscriptionGrantStatus.html) ** - **Description:** Grants permission to update a subscription grant status for custom grants - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateSubscriptionRequest.html](${APIReferenceDocPage}API_UpdateSubscriptionRequest.html) ** - **Description:** Grants permission to update business reason for subscription request for a Data Asset - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateSubscriptionTarget.html](${APIReferenceDocPage}API_UpdateSubscriptionTarget.html) ** - **Description:** Grants permission to update a subscription target - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_UpdateUserProfile.html](${APIReferenceDocPage}API_UpdateUserProfile.html) ** - **Description:** Grants permission to update a DataZone user profile - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** - ** [${APIReferenceDocPage}API_ValidatePassRole.html](${APIReferenceDocPage}API_ValidatePassRole.html) [permission only]** - **Description:** Grants permission to validate pass role - **Access level:** Write - **Resource types (\*required):** - **Condition keys:** - **Dependent actions:** ## Resource types defined by Amazon DataZone The following resource types are defined by this service and can be used in the `Resource` element of IAM permission policy statements. Each action in the [Actions table](#amazondatazone-actions-as-permissions) identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see [Resource types table](reference_policies_actions-resources-contextkeys.html#resources_table). **** | Resource types | ARN | Condition keys | | --- | --- | --- | | [https://docs.aws.amazon.com/datazone/latest/userguide/create-domain.html](https://docs.aws.amazon.com/datazone/latest/userguide/create-domain.html) | arn:${Partition}:datazone:${Region}:${Account}:domain/${DomainId} | [#amazondatazone-aws_ResourceTag___TagKey_](#amazondatazone-aws_ResourceTag___TagKey_) | ## Condition keys for Amazon DataZone Amazon DataZone defines the following condition keys that can be used in the `Condition` element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see [Condition keys table](reference_policies_actions-resources-contextkeys.html#context_keys_table). To view the global condition keys that are available to all services, see [AWS global condition context keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html). **** | Condition keys | Description | Type | | --- | --- | --- | | [https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requesttag](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requesttag) | Filters access by the tags that are passed in the request | String | | [https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag) | Filters access by the tags associated with the resource | String | | [https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-tagkeys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-tagkeys) | Filters access by the tag keys that are passed in the request | ArrayOfString | | [https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#amazondatazone-policy-keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#amazondatazone-policy-keys) | Filters access by the domain ID passed in the request | String | | [https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#amazondatazone-policy-keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#amazondatazone-policy-keys) | Filters access by the project ID passed in the request | String | | [https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#amazondatazone-policy-keys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#amazondatazone-policy-keys) | Filters access by the user ID passed in the request | String |