Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Aurora DSQL

Amazon Aurora DSQL (service prefix: dsql) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Aurora DSQL
Actions defined by Amazon Aurora DSQL
Permission-only actions for Amazon Aurora DSQL
Resource types defined by Amazon Aurora DSQL
Condition keys for Amazon Aurora DSQL

API operations defined by Amazon Aurora DSQL

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateCluster	dsql:AddPeerCluster			Write
	dsql:CreateCluster			Write
	dsql:DeleteClusterPolicy			Write
	dsql:PutClusterPolicy			Write
	dsql:PutMultiRegionProperties			Write
	dsql:PutWitnessRegion			Write
	dsql:TagResource			Tagging, Write
CreateStream	dsql:CreateStream			Write
	dsql:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	dsql.amazonaws.com	Write
DeleteCluster	dsql:DeleteCluster			Write
DeleteClusterPolicy	dsql:DeleteClusterPolicy			Write
DeleteStream	dsql:DeleteStream			Write
GetCluster	dsql:GetCluster			Read
GetClusterPolicy	dsql:GetClusterPolicy			Read
GetStream	dsql:GetStream			Read
GetVpcEndpointServiceName	dsql:GetVpcEndpointServiceName			Read
ListClusters	dsql:ListClusters			List
ListStreams	dsql:ListStreams			List
ListTagsForResource	dsql:ListTagsForResource			Read
PutClusterPolicy	dsql:DeleteClusterPolicy			Write
PutClusterPolicy	dsql:PutClusterPolicy			Write
TagResource	dsql:TagResource			Tagging, Write
UntagResource	dsql:UntagResource			Tagging, Write
UpdateCluster	dsql:AddPeerCluster			Write
	dsql:GetCluster			Read
	dsql:PutMultiRegionProperties			Write
	dsql:PutWitnessRegion			Write
	dsql:RemovePeerCluster			Write
	dsql:UpdateCluster			Write

Actions defined by Amazon Aurora DSQL

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateCluster	Grants permission to create new clusters	Cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys dsql:WitnessRegion	Write
CreateStream	Grants permission to create a Change Stream for a cluster	Cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DbConnect	Grants permission to connect to the database	Cluster*	aws:ResourceTag/${TagKey}	Write
DbConnectAdmin	Grants permission to connect to the database with admin role. Connecting with any other role requires DbConnect permission	Cluster*	aws:ResourceTag/${TagKey}	Write
DeleteCluster	Grants permission to delete a cluster and all of its data	Cluster*	aws:ResourceTag/${TagKey}	Write
DeleteClusterPolicy	Grants permission to remove the inline resource-based policy attached to a cluster	Cluster*	aws:ResourceTag/${TagKey}	Write
DeleteStream	Grants permission to delete a Change Stream	Stream*	aws:ResourceTag/${TagKey}	Write
GetBackupJob	Grants permission to get the status of an Aurora DSQL cluster backup job	Cluster*	aws:ResourceTag/${TagKey}	Read
GetCluster	Grants permission to get information about a cluster	Cluster*	aws:ResourceTag/${TagKey}	Read
GetClusterPolicy	Grants permission to retrieve the inline resource-based policy attached to a cluster	Cluster*	aws:ResourceTag/${TagKey}	Read
GetRestoreJob	Grants permission to get the status of an Aurora DSQL cluster restore job	Cluster*	aws:ResourceTag/${TagKey}	Read
GetStream	Grants permission to get information about a Change Stream	Stream*	aws:ResourceTag/${TagKey}	Read
GetVpcEndpointServiceName	Grants permission to retrieve the VPC endpoint service name for a cluster	Cluster*	aws:ResourceTag/${TagKey}	Read
ListClusters	Grants permission to retrieve a list of clusters			List
ListStreams	Grants permission to retrieve a list of Change Streams for a cluster	Cluster*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list all tags on an Aurora DSQL resource	Cluster	aws:ResourceTag/${TagKey}	Read
ListTagsForResource		Stream	aws:ResourceTag/${TagKey}	Read
PutClusterPolicy	Grants permission to attach or update the inline resource-based policy attached to a cluster	Cluster*	aws:ResourceTag/${TagKey}	Write
StartBackupJob	Grants permission to start a backup job for an Aurora DSQL cluster	Cluster*	aws:ResourceTag/${TagKey}	Write
StartRestoreJob	Grants permission to start a restore job for an Aurora DSQL cluster	Cluster*	aws:ResourceTag/${TagKey}	Write
StopBackupJob	Grants permission to stop a backup job for an Aurora DSQL cluster	Cluster*	aws:ResourceTag/${TagKey}	Write
StopRestoreJob	Grants permission to stop a restore job for an Aurora DSQL Cluster	Cluster*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add tags to Aurora DSQL resources	Cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource	Grants permission to add tags to Aurora DSQL resources	Stream	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from Aurora DSQL resources	Cluster	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from Aurora DSQL resources	Stream	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateCluster	Grants permission to modify cluster attributes	Cluster*	aws:ResourceTag/${TagKey} dsql:WitnessRegion	Write
UpdateStream	Grants permission to modify Change Stream attributes	Stream*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon Aurora DSQL

The following actions are defined by Amazon Aurora DSQL but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddPeerCluster	Grants permission to add a peer cluster to a multi-Region cluster	Cluster*	aws:ResourceTag/${TagKey}	Write
InjectError	Grants permission to inject errors in targeted clusters		dsql:FisActionId dsql:FisTargetArns	Write
PutMultiRegionProperties	Grants permission to update multi-Region properties of a cluster	Cluster*	aws:ResourceTag/${TagKey}	Write
PutWitnessRegion	Grants permission to configure and update the witness Region of a multi-Region cluster	Cluster*	aws:ResourceTag/${TagKey} dsql:WitnessRegion	Write
RemovePeerCluster	Grants permission to remove a peer cluster from a multi-Region cluster	Cluster*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Aurora DSQL

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
Cluster	arn:${Partition}:dsql:${Region}:${Account}:cluster/${Identifier}	aws:ResourceTag/${TagKey}
Stream	arn:${Partition}:dsql:${Region}:${Account}:cluster/${ClusterId}/stream/${StreamId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Aurora DSQL

Amazon Aurora DSQL defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a tag key and value pair that is allowed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by a list of tag keys that are allowed in the request	ArrayOfString
dsql:FisActionId	Filters access by the ID of an AWS FIS action	String
dsql:FisTargetArns	Filters access by the ARN of an AWS FIS target	ArrayOfARN
dsql:WitnessRegion	Filters access by the witness region of multi-Region clusters	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Athena (athena)

Amazon Bedrock (bedrock)