Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Data Exchange

AWS Data Exchange (service prefix: dataexchange) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Data Exchange
Actions defined by AWS Data Exchange
Permission-only actions for AWS Data Exchange
Resource types defined by AWS Data Exchange
Condition keys for AWS Data Exchange

API operations defined by AWS Data Exchange

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AcceptDataGrant	dataexchange:AcceptDataGrant			Write
CancelJob	dataexchange:CancelJob			Write
CreateDataGrant	dataexchange:CreateDataGrant			Write
	dataexchange:CreateJob			Write
	dataexchange:PublishDataSet			Write
	dataexchange:PublishToDataGrant			Write
	dataexchange:StartJob			Write
	dataexchange:TagResource			Tagging, Write
CreateDataSet	dataexchange:CreateDataSet			Write
CreateDataSet	dataexchange:TagResource			Tagging, Write
CreateEventAction	dataexchange:CreateEventAction			Write
CreateEventAction	dataexchange:TagResource			Tagging, Write
CreateJob	dataexchange:CreateJob			Write
CreateJob	iam:PassRole	iam:PassedToService	dataexchange.amazonaws.com	Write
CreateRevision	dataexchange:CreateRevision			Write
CreateRevision	dataexchange:TagResource			Tagging, Write
DeleteAsset	dataexchange:DeleteAsset			Write
DeleteDataGrant	dataexchange:DeleteDataGrant			Write
DeleteDataSet	dataexchange:DeleteDataSet			Write
DeleteEventAction	dataexchange:DeleteEventAction			Write
DeleteRevision	dataexchange:DeleteRevision			Write
GetAsset	dataexchange:GetAsset			Read
GetDataGrant	dataexchange:GetDataGrant			Read
GetDataGrant	dataexchange:GetDataSet			Read
GetDataSet	dataexchange:GetDataSet			Read
GetEventAction	dataexchange:GetEventAction			Read
GetJob	dataexchange:GetJob			Read
GetReceivedDataGrant	dataexchange:GetDataSet			Read
GetReceivedDataGrant	dataexchange:GetReceivedDataGrant			Read
GetRevision	dataexchange:GetRevision			Read
ListDataGrants	dataexchange:ListDataGrants			List
ListDataGrants	dataexchange:ListDataSets			List
ListDataSetRevisions	dataexchange:ListDataSetRevisions			List
ListDataSets	dataexchange:ListDataSets			List
ListEventActions	dataexchange:ListEventActions			List
ListJobs	dataexchange:ListJobs			List
ListReceivedDataGrants	dataexchange:ListDataSets			List
ListReceivedDataGrants	dataexchange:ListReceivedDataGrants			List
ListRevisionAssets	dataexchange:ListRevisionAssets			List
ListTagsForResource	dataexchange:ListTagsForResource			List
RevokeRevision	dataexchange:RevokeRevision			Write
SendApiAsset	dataexchange:SendApiAsset			Write
SendDataSetNotification	dataexchange:SendDataSetNotification			Write
StartJob	dataexchange:CreateAsset			Write
	dataexchange:StartJob			Write
	dataexchange:TagResource			Tagging, Write
TagResource	dataexchange:TagResource			Tagging, Write
UntagResource	dataexchange:UntagResource			Tagging, Write
UpdateAsset	dataexchange:UpdateAsset			Write
UpdateDataSet	dataexchange:UpdateDataSet			Write
UpdateEventAction	dataexchange:UpdateEventAction			Write
UpdateRevision	dataexchange:PublishDataSet			Write
	dataexchange:PublishToDataGrant			Write
	dataexchange:UpdateRevision			Write

Actions defined by AWS Data Exchange

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptDataGrant	Grants permission to accept a data grant	data-grants*	aws:ResourceTag/${TagKey}	Write
CancelJob	Grants permission to cancel a job	jobs*	dataexchange:JobType	Write
CreateDataGrant	Grants permission to create a data grant	data-grants*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDataSet	Grants permission to create a data set	data-sets*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateEventAction	Grants permission to create an event action	event-actions*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateJob	Grants permission to create a job to import or export assets	jobs*	dataexchange:JobType	Write
CreateRevision	Grants permission to create a revision	data-sets*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAsset	Grants permission to delete an asset	assets*	aws:ResourceTag/${TagKey}	Write
DeleteDataGrant	Grants permission to delete a data grant	data-grants*	aws:ResourceTag/${TagKey}	Write
DeleteDataSet	Grants permission to delete a data set	data-sets*	aws:ResourceTag/${TagKey}	Write
DeleteDataSet	Grants permission to delete a data set	entitled-data-sets*		Write
DeleteEventAction	Grants permission to delete an event action	event-actions*	aws:ResourceTag/${TagKey}	Write
DeleteRevision	Grants permission to delete a revision	revisions*	aws:ResourceTag/${TagKey}	Write
GetAsset	Grants permission to get information about an asset and to export it (for example, in a Job)	assets*	aws:ResourceTag/${TagKey}	Read
GetAsset		entitled-assets*		Read
GetDataGrant	Grants permission to get a data grant	data-grants*	aws:ResourceTag/${TagKey}	Read
GetDataSet	Grants permission to get information about a data set	data-sets*	aws:ResourceTag/${TagKey}	Read
GetDataSet	Grants permission to get information about a data set	entitled-data-sets*		Read
GetEventAction	Grants permission to get an event action	event-actions*	aws:ResourceTag/${TagKey}	Read
GetJob	Grants permission to get information about a job	jobs*	dataexchange:JobType	Read
GetReceivedDataGrant	Grants permission to get a received data grant	data-grants*	aws:ResourceTag/${TagKey}	Read
GetRevision	Grants permission to get information about a revision	entitled-revisions*		Read
GetRevision	Grants permission to get information about a revision	revisions*	aws:ResourceTag/${TagKey}	Read
ListDataGrants	Grants permission to list data grants for the account			List
ListDataSetRevisions	Grants permission to list the revisions of a data set	data-sets*	aws:ResourceTag/${TagKey}	List
ListDataSetRevisions	Grants permission to list the revisions of a data set	entitled-data-sets*		List
ListDataSets	Grants permission to list data sets for the account			List
ListEventActions	Grants permission to list event actions for the account			List
ListJobs	Grants permission to list jobs for the account			List
ListReceivedDataGrants	Grants permission to list received data grants for the account			List
ListRevisionAssets	Grants permission to get list the assets of a revision	entitled-revisions*		List
ListRevisionAssets	Grants permission to get list the assets of a revision	revisions*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list the tags that you associated with the specified resource	assets	aws:ResourceTag/${TagKey}	List
		data-grants	aws:ResourceTag/${TagKey}
		data-sets	aws:ResourceTag/${TagKey}
		event-actions	aws:ResourceTag/${TagKey}
		revisions	aws:ResourceTag/${TagKey}
RevokeRevision	Grants permission to revoke subscriber access to a revision	revisions*	aws:ResourceTag/${TagKey}	Write
SendApiAsset	Grants permission to send a request to an API asset	assets*	aws:ResourceTag/${TagKey}	Write
SendApiAsset	Grants permission to send a request to an API asset	entitled-assets*		Write
SendDataSetNotification	Grants permission to send a notification to subscribers of a data set	data-sets*	aws:ResourceTag/${TagKey}	Write
StartJob	Grants permission to start a job	jobs*	dataexchange:JobType	Write
TagResource	Grants permission to add one or more tags to a specified resource	assets	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		data-grants	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		data-sets	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		event-actions	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		revisions	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove one or more tags from a specified resource	assets	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		data-grants	aws:ResourceTag/${TagKey} aws:TagKeys
		data-sets	aws:ResourceTag/${TagKey} aws:TagKeys
		event-actions	aws:ResourceTag/${TagKey} aws:TagKeys
		revisions	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAsset	Grants permission to get update information about an asset	assets*	aws:ResourceTag/${TagKey}	Write
UpdateDataSet	Grants permission to update information about a data set	data-sets*	aws:ResourceTag/${TagKey}	Write
UpdateEventAction	Grants permission to update information for an event action	event-actions*	aws:ResourceTag/${TagKey}	Write
UpdateRevision	Grants permission to update information about a revision	revisions*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for AWS Data Exchange

The following actions are defined by AWS Data Exchange but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateAsset	Grants permission to create an asset (for example, in a Job)	revisions*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PublishDataSet	Grants permission to publish a data set to a product	data-sets*	aws:ResourceTag/${TagKey}	Write
PublishToDataGrant	Grants permission to publish a data set to a data grant	data-sets*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write

Actions

Description

Resource types (*required)

Condition keys

Access level

CreateAsset

Grants permission to create an asset (for example, in a Job)

revisions*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

PublishDataSet

Grants permission to publish a data set to a product

data-sets*

aws:ResourceTag/${TagKey}

Write

PublishToDataGrant

Grants permission to publish a data set to a data grant

data-sets*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

Resource types defined by AWS Data Exchange

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
assets	arn:${Partition}:dataexchange:${Region}:${Account}:data-sets/${DataSetId}/revisions/${RevisionId}/assets/${AssetId}	aws:ResourceTag/${TagKey}
data-grants	arn:${Partition}:dataexchange:${Region}:${Account}:data-grants/${DataGrantId}	aws:ResourceTag/${TagKey}
data-sets	arn:${Partition}:dataexchange:${Region}:${Account}:data-sets/${DataSetId}	aws:ResourceTag/${TagKey}
entitled-assets	arn:${Partition}:dataexchange:${Region}::data-sets/${DataSetId}/revisions/${RevisionId}/assets/${AssetId}
entitled-data-sets	arn:${Partition}:dataexchange:${Region}::data-sets/${DataSetId}
entitled-revisions	arn:${Partition}:dataexchange:${Region}::data-sets/${DataSetId}/revisions/${RevisionId}
event-actions	arn:${Partition}:dataexchange:${Region}:${Account}:event-actions/${EventActionId}	aws:ResourceTag/${TagKey}
jobs	arn:${Partition}:dataexchange:${Region}:${Account}:jobs/${JobId}	dataexchange:JobType
revisions	arn:${Partition}:dataexchange:${Region}:${Account}:data-sets/${DataSetId}/revisions/${RevisionId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Data Exchange

AWS Data Exchange defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the allowed set of values for each of the mandatory tags in the create request	String
aws:ResourceTag/${TagKey}	Filters access by the tag value associated with the resource	String
aws:TagKeys	Filters access by the presence of mandatory tags in the create request	ArrayOfString
dataexchange:JobType	Filters access by the specified job type	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Customer Verification Service (customer-verification)

AWS Data Pipeline (datapipeline)