Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Elemental MediaStore

AWS Elemental MediaStore (service prefix: mediastore) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Elemental MediaStore
Actions defined by AWS Elemental MediaStore
Resource types defined by AWS Elemental MediaStore
Condition keys for AWS Elemental MediaStore

API operations defined by AWS Elemental MediaStore

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
CreateContainer	mediastore	mediastore:CreateContainer			Write
CreateContainer	mediastore	mediastore:TagResource			Tagging, Write
DeleteContainer	mediastore	mediastore:DeleteContainer			Write
DeleteContainerPolicy	mediastore	mediastore:DeleteContainerPolicy			Permissions management, Write
DeleteCorsPolicy	mediastore	mediastore:DeleteCorsPolicy			Write
DeleteLifecyclePolicy	mediastore	mediastore:DeleteLifecyclePolicy			Write
DeleteMetricPolicy	mediastore	mediastore:DeleteMetricPolicy			Write
DescribeContainer	mediastore	mediastore:DescribeContainer			List
GetContainerPolicy	mediastore	mediastore:GetContainerPolicy			Read
GetCorsPolicy	mediastore	mediastore:GetCorsPolicy			Read
GetLifecyclePolicy	mediastore	mediastore:GetLifecyclePolicy			Read
GetMetricPolicy	mediastore	mediastore:GetMetricPolicy			Read
ListContainers	mediastore	mediastore:ListContainers			List
ListTagsForResource	mediastore	mediastore:ListTagsForResource			Read
PutContainerPolicy	mediastore	mediastore:PutContainerPolicy			Permissions management, Write
PutCorsPolicy	mediastore	mediastore:PutCorsPolicy			Write
PutLifecyclePolicy	mediastore	mediastore:PutLifecyclePolicy			Write
PutMetricPolicy	mediastore	mediastore:PutMetricPolicy			Write
StartAccessLogging	mediastore	mediastore:StartAccessLogging			Write
StartAccessLogging	mediastore	iam:PassRole	iam:PassedToService	mediastore.amazonaws.com	Write
StopAccessLogging	mediastore	mediastore:StopAccessLogging			Write
TagResource	mediastore	mediastore:TagResource			Tagging, Write
UntagResource	mediastore	mediastore:UntagResource			Tagging, Write
DeleteObject	mediastore-data	mediastore:DeleteObject			Write
DescribeObject	mediastore-data	mediastore:DescribeObject			List
GetObject	mediastore-data	mediastore:GetObject			Read
ListItems	mediastore-data	mediastore:ListItems			List
PutObject	mediastore-data	mediastore:PutObject			Write

Actions defined by AWS Elemental MediaStore

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateContainer	Grants permission to create a container		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteContainer	Grants permission to delete a container	container*	aws:ResourceTag/${TagKey}	Write
DeleteContainerPolicy	Grants permission to delete the access policy of a container	container*	aws:ResourceTag/${TagKey}	Permissions management, Write
DeleteCorsPolicy	Grants permission to delete the CORS policy from a container	container*	aws:ResourceTag/${TagKey}	Write
DeleteLifecyclePolicy	Grants permission to delete the lifecycle policy from a container	container*	aws:ResourceTag/${TagKey}	Write
DeleteMetricPolicy	Grants permission to delete the metric policy from a container	container*	aws:ResourceTag/${TagKey}	Write
DeleteObject	Grants permission to delete an object	object*		Write
DescribeContainer	Grants permission to retrieve details on a container	container*	aws:ResourceTag/${TagKey}	List
DescribeObject	Grants permission to retrieve metadata for an object	object*		List
GetContainerPolicy	Grants permission to retrieve the access policy of a container	container*	aws:ResourceTag/${TagKey}	Read
GetCorsPolicy	Grants permission to retrieve the CORS policy of a container	container*	aws:ResourceTag/${TagKey}	Read
GetLifecyclePolicy	Grants permission to retrieve the lifecycle policy that is assigned to a container	container*	aws:ResourceTag/${TagKey}	Read
GetMetricPolicy	Grants permission to retrieve the metric policy that is assigned to a container	container*	aws:ResourceTag/${TagKey}	Read
GetObject	Grants permission to retrieve an object	object*		Read
ListContainers	Grants permission to retrieve a list of containers in the current account			List
ListItems	Grants permission to retrieve a list of objects and subfolders that are stored in a folder	folder		List
ListTagsForResource	Grants permission to list tags on a container	container	aws:ResourceTag/${TagKey}	Read
PutContainerPolicy	Grants permission to create or replace the access policy of a container	container*	aws:ResourceTag/${TagKey}	Permissions management, Write
PutCorsPolicy	Grants permission to add or modify the CORS policy of a container	container*	aws:ResourceTag/${TagKey}	Write
PutLifecyclePolicy	Grants permission to add or modify the lifecycle policy that is assigned to a container	container*	aws:ResourceTag/${TagKey}	Write
PutMetricPolicy	Grants permission to add or modify the metric policy that is assigned to a container	container*	aws:ResourceTag/${TagKey}	Write
PutObject	Grants permission to upload an object	object*		Write
StartAccessLogging	Grants permission to start access logging on a container	container*	aws:ResourceTag/${TagKey}	Write
StopAccessLogging	Grants permission to stop access logging on a container	container*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add tags to a container	container	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from a container	container	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write

Resource types defined by AWS Elemental MediaStore

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
container	arn:${Partition}:mediastore:${Region}:${Account}:container/${ContainerName}	aws:ResourceTag/${TagKey}
folder	arn:${Partition}:mediastore:${Region}:${Account}:container/${ContainerName}/${FolderPath}
object	arn:${Partition}:mediastore:${Region}:${Account}:container/${ContainerName}/${ObjectPath}

Condition keys for AWS Elemental MediaStore

AWS Elemental MediaStore defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Elemental MediaPackage VOD (mediapackage-vod)

AWS Elemental MediaTailor (mediatailor)