Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS App Runner

AWS App Runner (service prefix: apprunner) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS App Runner
Actions defined by AWS App Runner
Permission-only actions for AWS App Runner
Resource types defined by AWS App Runner
Condition keys for AWS App Runner

API operations defined by AWS App Runner

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateCustomDomain	apprunner:AssociateCustomDomain			Write
CreateAutoScalingConfiguration	apprunner:CreateAutoScalingConfiguration			Write
CreateAutoScalingConfiguration	apprunner:TagResource			Tagging, Write
CreateConnection	apprunner:CreateConnection			Write
CreateConnection	apprunner:TagResource			Tagging, Write
CreateObservabilityConfiguration	apprunner:CreateObservabilityConfiguration			Write
CreateObservabilityConfiguration	apprunner:TagResource			Tagging, Write
CreateService	apprunner:CreateService			Write
	apprunner:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	bullet.amazonaws.com	Write
CreateVpcConnector	apprunner:CreateVpcConnector			Write
CreateVpcConnector	apprunner:TagResource			Tagging, Write
CreateVpcIngressConnection	apprunner:CreateVpcIngressConnection			Write
CreateVpcIngressConnection	apprunner:TagResource			Tagging, Write
DeleteAutoScalingConfiguration	apprunner:DeleteAutoScalingConfiguration			Write
DeleteConnection	apprunner:DeleteConnection			Write
DeleteObservabilityConfiguration	apprunner:DeleteObservabilityConfiguration			Write
DeleteService	apprunner:DeleteService			Write
DeleteService	apprunner:DisassociateCustomDomain			Write
DeleteVpcConnector	apprunner:DeleteVpcConnector			Write
DeleteVpcIngressConnection	apprunner:DeleteVpcIngressConnection			Write
DescribeAutoScalingConfiguration	apprunner:DescribeAutoScalingConfiguration			Read
DescribeCustomDomains	apprunner:DescribeCustomDomains			Read
DescribeObservabilityConfiguration	apprunner:DescribeObservabilityConfiguration			Read
DescribeService	apprunner:DescribeService			Read
DescribeVpcConnector	apprunner:DescribeVpcConnector			Read
DescribeVpcIngressConnection	apprunner:DescribeVpcIngressConnection			Read
DisassociateCustomDomain	apprunner:DisassociateCustomDomain			Write
ListAutoScalingConfigurations	apprunner:ListAutoScalingConfigurations			List
ListConnections	apprunner:ListConnections			List
ListObservabilityConfigurations	apprunner:ListObservabilityConfigurations			List
ListOperations	apprunner:ListOperations			List
ListServices	apprunner:ListServices			List
ListServicesForAutoScalingConfiguration	apprunner:ListServicesForAutoScalingConfiguration			List
ListTagsForResource	apprunner:ListTagsForResource			Read
ListVpcConnectors	apprunner:ListVpcConnectors			List
ListVpcIngressConnections	apprunner:ListVpcIngressConnections			List
PauseService	apprunner:PauseService			Write
ResumeService	apprunner:ResumeService			Write
StartDeployment	apprunner:StartDeployment			Write
TagResource	apprunner:TagResource			Tagging, Write
UntagResource	apprunner:UntagResource			Tagging, Write
UpdateDefaultAutoScalingConfiguration	apprunner:UpdateDefaultAutoScalingConfiguration			Write
UpdateService	apprunner:UpdateService			Write
UpdateService	iam:PassRole	iam:PassedToService	bullet.amazonaws.com	Write
UpdateVpcIngressConnection	apprunner:UpdateVpcIngressConnection			Write

Actions defined by AWS App Runner

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateCustomDomain	Grants permission to associate your own domain name with the AWS App Runner subdomain URL of your App Runner service	service*	aws:ResourceTag/${TagKey}	Write
CreateAutoScalingConfiguration	Grants permission to create an AWS App Runner automatic scaling configuration resource	autoscalingconfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConnection	Grants permission to create an AWS App Runner connection resource	connection*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateObservabilityConfiguration	Grants permission to create an AWS App Runner observability configuration resource	observabilityconfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateService	Grants permission to create an AWS App Runner service resource	autoscalingconfiguration	apprunner:AutoScalingConfigurationArn apprunner:ConnectionArn apprunner:ObservabilityConfigurationArn apprunner:VpcConnectorArn aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		connection	apprunner:AutoScalingConfigurationArn apprunner:ConnectionArn apprunner:ObservabilityConfigurationArn apprunner:VpcConnectorArn aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		observabilityconfiguration	apprunner:AutoScalingConfigurationArn apprunner:ConnectionArn apprunner:ObservabilityConfigurationArn apprunner:VpcConnectorArn aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		service*	apprunner:AutoScalingConfigurationArn apprunner:ConnectionArn apprunner:ObservabilityConfigurationArn apprunner:VpcConnectorArn aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		vpcconnector	apprunner:AutoScalingConfigurationArn apprunner:ConnectionArn apprunner:ObservabilityConfigurationArn apprunner:VpcConnectorArn aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateVpcConnector	Grants permission to create an AWS App Runner VPC connector resource	vpcconnector*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateVpcIngressConnection	Grants permission to create an AWS App Runner VpcIngressConnection resource	vpcingressconnection*	apprunner:ServiceArn apprunner:VpcEndpointId apprunner:VpcId aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAutoScalingConfiguration	Grants permission to delete an AWS App Runner automatic scaling configuration resource	autoscalingconfiguration*	aws:ResourceTag/${TagKey}	Write
DeleteConnection	Grants permission to delete an AWS App Runner connection resource	connection*	aws:ResourceTag/${TagKey}	Write
DeleteObservabilityConfiguration	Grants permission to delete an AWS App Runner observability configuration resource	observabilityconfiguration*	aws:ResourceTag/${TagKey}	Write
DeleteService	Grants permission to delete an AWS App Runner service resource	service*	aws:ResourceTag/${TagKey}	Write
DeleteVpcConnector	Grants permission to delete an AWS App Runner VPC connector resource	vpcconnector*	aws:ResourceTag/${TagKey}	Write
DeleteVpcIngressConnection	Grants permission to delete an AWS App Runner VpcIngressConnection resource	vpcingressconnection*	aws:ResourceTag/${TagKey}	Write
DescribeAutoScalingConfiguration	Grants permission to retrieve the description of an AWS App Runner automatic scaling configuration resource	autoscalingconfiguration*	aws:ResourceTag/${TagKey}	Read
DescribeCustomDomains	Grants permission to retrieve descriptions of custom domain names associated with an AWS App Runner service	service*	aws:ResourceTag/${TagKey}	Read
DescribeObservabilityConfiguration	Grants permission to retrieve the description of an AWS App Runner observability configuration resource	observabilityconfiguration*	aws:ResourceTag/${TagKey}	Read
DescribeOperation	Grants permission to retrieve the description of an operation that occurred on an AWS App Runner service	service*	aws:ResourceTag/${TagKey}	Read
DescribeService	Grants permission to retrieve the description of an AWS App Runner service resource	service*	aws:ResourceTag/${TagKey}	Read
DescribeVpcConnector	Grants permission to retrieve the description of an AWS App Runner VPC connector resource	vpcconnector*	aws:ResourceTag/${TagKey}	Read
DescribeVpcIngressConnection	Grants permission to retrieve the description of an AWS App Runner VpcIngressConnection resource	vpcingressconnection*	aws:ResourceTag/${TagKey}	Read
DisassociateCustomDomain	Grants permission to disassociate a custom domain name from an AWS App Runner service	service*	aws:ResourceTag/${TagKey}	Write
ListAutoScalingConfigurations	Grants permission to retrieve a list of AWS App Runner automatic scaling configurations in your AWS account			List
ListConnections	Grants permission to retrieve a list of AWS App Runner connections in your AWS account			List
ListObservabilityConfigurations	Grants permission to retrieve a list of AWS App Runner observability configurations in your AWS account			List
ListOperations	Grants permission to retrieve a list of operations that occurred on an AWS App Runner service resource	service*	aws:ResourceTag/${TagKey}	List
ListServices	Grants permission to retrieve a list of running AWS App Runner services in your AWS account			List
ListServicesForAutoScalingConfiguration	Grants permission to retrieve a list of associated AppRunner services of an AWS App Runner automatic scaling configuration in your AWS account	autoscalingconfiguration*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags associated with an AWS App Runner resource	autoscalingconfiguration	aws:ResourceTag/${TagKey}	Read
		connection	aws:ResourceTag/${TagKey}
		observabilityconfiguration	aws:ResourceTag/${TagKey}
		service	aws:ResourceTag/${TagKey}
		vpcconnector	aws:ResourceTag/${TagKey}
ListVpcConnectors	Grants permission to retrieve a list of AWS App Runner VPC connectors in your AWS account			List
ListVpcIngressConnections	Grants permission to retrieve a list of AWS App Runner VpcIngressConnections in your AWS account			List
PauseService	Grants permission to pause an active AWS App Runner service	service*	aws:ResourceTag/${TagKey}	Write
ResumeService	Grants permission to resume an active AWS App Runner service	service*	aws:ResourceTag/${TagKey}	Write
StartDeployment	Grants permission to initiate a manual deployemnt to an AWS App Runner service	service*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add tags to, or update tag values of, an AWS App Runner resource	autoscalingconfiguration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		connection	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		observabilityconfiguration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		service	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		vpcconnector	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		vpcingressconnection	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from an AWS App Runner resource	autoscalingconfiguration	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		connection	aws:ResourceTag/${TagKey} aws:TagKeys
		observabilityconfiguration	aws:ResourceTag/${TagKey} aws:TagKeys
		service	aws:ResourceTag/${TagKey} aws:TagKeys
		vpcconnector	aws:ResourceTag/${TagKey} aws:TagKeys
		vpcingressconnection	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateDefaultAutoScalingConfiguration	Grants permission to update an AWS App Runner automatic scaling configuration to be the default in your AWS account	autoscalingconfiguration*	aws:ResourceTag/${TagKey}	Write
UpdateService	Grants permission to update an AWS App Runner service resource	autoscalingconfiguration	apprunner:AutoScalingConfigurationArn apprunner:ConnectionArn apprunner:ObservabilityConfigurationArn apprunner:VpcConnectorArn aws:ResourceTag/${TagKey}	Write
		connection	apprunner:AutoScalingConfigurationArn apprunner:ConnectionArn apprunner:ObservabilityConfigurationArn apprunner:VpcConnectorArn aws:ResourceTag/${TagKey}
		observabilityconfiguration	apprunner:AutoScalingConfigurationArn apprunner:ConnectionArn apprunner:ObservabilityConfigurationArn apprunner:VpcConnectorArn aws:ResourceTag/${TagKey}
		service*	apprunner:AutoScalingConfigurationArn apprunner:ConnectionArn apprunner:ObservabilityConfigurationArn apprunner:VpcConnectorArn aws:ResourceTag/${TagKey}
		vpcconnector	apprunner:AutoScalingConfigurationArn apprunner:ConnectionArn apprunner:ObservabilityConfigurationArn apprunner:VpcConnectorArn aws:ResourceTag/${TagKey}
UpdateVpcIngressConnection	Grants permission to update an AWS App Runner VpcIngressConnection resource	vpcingressconnection*	apprunner:VpcEndpointId apprunner:VpcId aws:ResourceTag/${TagKey}	Write

Permission-only actions for AWS App Runner

The following actions are defined by AWS App Runner but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateWebAcl	Grants permission to associate the service with an AWS WAF web ACL	service*	aws:ResourceTag/${TagKey}	Write
AssociateWebAcl		webacl*		Write
DescribeWebAclForService	Grants permission to get the AWS WAF web ACL that is associated with an AWS App Runner service	service*	aws:ResourceTag/${TagKey}	Read
DisassociateWebAcl	Grants permission to disassociate the service with an AWS WAF web ACL	service*	aws:ResourceTag/${TagKey}	Write
ListAssociatedServicesForWebAcl	Grants permission to list the services that are associated with an AWS WAF web ACL	webacl*		List

Resource types defined by AWS App Runner

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
autoscalingconfiguration	arn:${Partition}:apprunner:${Region}:${Account}:autoscalingconfiguration/${AutoscalingConfigurationName}/${AutoscalingConfigurationVersion}/${AutoscalingConfigurationId}	aws:ResourceTag/${TagKey}
connection	arn:${Partition}:apprunner:${Region}:${Account}:connection/${ConnectionName}/${ConnectionId}	aws:ResourceTag/${TagKey}
observabilityconfiguration	arn:${Partition}:apprunner:${Region}:${Account}:observabilityconfiguration/${ObservabilityConfigurationName}/${ObservabilityConfigurationVersion}/${ObservabilityConfigurationId}	aws:ResourceTag/${TagKey}
service	arn:${Partition}:apprunner:${Region}:${Account}:service/${ServiceName}/${ServiceId}	aws:ResourceTag/${TagKey}
vpcconnector	arn:${Partition}:apprunner:${Region}:${Account}:vpcconnector/${VpcConnectorName}/${VpcConnectorVersion}/${VpcConnectorId}	aws:ResourceTag/${TagKey}
vpcingressconnection	arn:${Partition}:apprunner:${Region}:${Account}:vpcingressconnection/${VpcIngressConnectionName}/${VpcIngressConnectionId}	aws:ResourceTag/${TagKey}
webacl	arn:${Partition}:wafv2:${Region}:${Account}:${Scope}/webacl/${Name}/${Id}

Condition keys for AWS App Runner

AWS App Runner defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
apprunner:AutoScalingConfigurationArn	Filters access by the CreateService and UpdateService actions based on the ARN of an associated AutoScalingConfiguration resource	ARN
apprunner:ConnectionArn	Filters access by the CreateService and UpdateService actions based on the ARN of an associated Connection resource	ARN
apprunner:ObservabilityConfigurationArn	Filters access by the CreateService and UpdateService actions based on the ARN of an associated ObservabilityConfiguration resource	ARN
apprunner:ServiceArn	Filters access by the CreateVpcIngressConnection action based on the ARN of an associated Service resource	ARN
apprunner:VpcConnectorArn	Filters access by the CreateService and UpdateService actions based on the ARN of an associated VpcConnector resource	ARN
apprunner:VpcEndpointId	Filters access by the CreateVpcIngressConnection and UpdateVpcIngressConnection actions based on the VPC Endpoint in the request	String
apprunner:VpcId	Filters access by the CreateVpcIngressConnection and UpdateVpcIngressConnection actions based on the VPC in the request	String
aws:RequestTag/${TagKey}	Filters access by actions based on the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by actions based on tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by actions based on the presence of tag keys in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS App Mesh Preview (appmesh-preview)

AWS App Studio (appstudio)