Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Network Manager

AWS Network Manager (service prefix: networkmanager) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Network Manager
Actions defined by AWS Network Manager
Resource types defined by AWS Network Manager
Condition keys for AWS Network Manager

API operations defined by AWS Network Manager

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AcceptAttachment	networkmanager:AcceptAttachment	Write
AssociateConnectPeer	networkmanager:AssociateConnectPeer	Write
AssociateCustomerGateway	networkmanager:AssociateCustomerGateway	Write
AssociateLink	networkmanager:AssociateLink	Write
AssociateTransitGatewayConnectPeer	networkmanager:AssociateTransitGatewayConnectPeer	Write
CreateConnectAttachment	networkmanager:CreateConnectAttachment	Write
CreateConnectAttachment	networkmanager:TagResource	Tagging, Write
CreateConnectPeer	networkmanager:CreateConnectPeer	Write
CreateConnectPeer	networkmanager:TagResource	Tagging, Write
CreateConnection	networkmanager:CreateConnection	Write
CreateConnection	networkmanager:TagResource	Tagging, Write
CreateCoreNetwork	networkmanager:CreateCoreNetwork	Write
CreateCoreNetwork	networkmanager:TagResource	Tagging, Write
CreateCoreNetworkPrefixListAssociation	networkmanager:CreateCoreNetworkPrefixListAssociation	Write
CreateDevice	networkmanager:CreateDevice	Write
CreateDevice	networkmanager:TagResource	Tagging, Write
CreateDirectConnectGatewayAttachment	networkmanager:CreateDirectConnectGatewayAttachment	Write
	networkmanager:PutAttachmentRoutingPolicyLabel	Write
	networkmanager:TagResource	Tagging, Write
CreateGlobalNetwork	networkmanager:CreateGlobalNetwork	Write
CreateGlobalNetwork	networkmanager:TagResource	Tagging, Write
CreateLink	networkmanager:CreateLink	Write
CreateLink	networkmanager:TagResource	Tagging, Write
CreateSite	networkmanager:CreateSite	Write
CreateSite	networkmanager:TagResource	Tagging, Write
CreateSiteToSiteVpnAttachment	networkmanager:CreateSiteToSiteVpnAttachment	Write
	networkmanager:PutAttachmentRoutingPolicyLabel	Write
	networkmanager:TagResource	Tagging, Write
CreateTransitGatewayPeering	networkmanager:CreateTransitGatewayPeering	Write
CreateTransitGatewayPeering	networkmanager:TagResource	Tagging, Write
CreateTransitGatewayRouteTableAttachment	networkmanager:CreateTransitGatewayRouteTableAttachment	Write
	networkmanager:PutAttachmentRoutingPolicyLabel	Write
	networkmanager:TagResource	Tagging, Write
CreateVpcAttachment	networkmanager:CreateVpcAttachment	Write
	networkmanager:PutAttachmentRoutingPolicyLabel	Write
	networkmanager:TagResource	Tagging, Write
DeleteAttachment	networkmanager:DeleteAttachment	Write
DeleteConnectPeer	networkmanager:DeleteConnectPeer	Write
DeleteConnection	networkmanager:DeleteConnection	Write
DeleteCoreNetwork	networkmanager:DeleteCoreNetwork	Write
DeleteCoreNetworkPolicyVersion	networkmanager:DeleteCoreNetworkPolicyVersion	Write
DeleteCoreNetworkPrefixListAssociation	networkmanager:DeleteCoreNetworkPrefixListAssociation	Write
DeleteDevice	networkmanager:DeleteDevice	Write
DeleteGlobalNetwork	networkmanager:DeleteGlobalNetwork	Write
DeleteLink	networkmanager:DeleteLink	Write
DeletePeering	networkmanager:DeletePeering	Write
DeleteResourcePolicy	networkmanager:DeleteResourcePolicy	Permissions management, Write
DeleteSite	networkmanager:DeleteSite	Write
DeregisterTransitGateway	networkmanager:DeregisterTransitGateway	Write
DescribeGlobalNetworks	networkmanager:DescribeGlobalNetworks	List
DisassociateConnectPeer	networkmanager:DisassociateConnectPeer	Write
DisassociateCustomerGateway	networkmanager:DisassociateCustomerGateway	Write
DisassociateLink	networkmanager:DisassociateLink	Write
DisassociateTransitGatewayConnectPeer	networkmanager:DisassociateTransitGatewayConnectPeer	Write
ExecuteCoreNetworkChangeSet	networkmanager:ExecuteCoreNetworkChangeSet	Write
GetConnectAttachment	networkmanager:GetConnectAttachment	Read
GetConnectPeer	networkmanager:GetConnectPeer	Read
GetConnectPeerAssociations	networkmanager:GetConnectPeerAssociations	Read
GetConnections	networkmanager:GetConnections	List
GetCoreNetwork	networkmanager:GetCoreNetwork	Read
GetCoreNetworkChangeEvents	networkmanager:GetCoreNetworkChangeEvents	Read
GetCoreNetworkChangeSet	networkmanager:GetCoreNetworkChangeSet	Read
GetCoreNetworkPolicy	networkmanager:GetCoreNetworkPolicy	Read
GetCustomerGatewayAssociations	networkmanager:GetCustomerGatewayAssociations	List
GetDevices	networkmanager:GetDevices	List
GetDirectConnectGatewayAttachment	networkmanager:GetDirectConnectGatewayAttachment	Read
GetLinkAssociations	networkmanager:GetLinkAssociations	List
GetLinks	networkmanager:GetLinks	List
GetNetworkResourceCounts	networkmanager:GetNetworkResourceCounts	Read
GetNetworkResourceRelationships	networkmanager:GetNetworkResourceRelationships	Read
GetNetworkResources	networkmanager:GetNetworkResources	Read
GetNetworkRoutes	networkmanager:GetNetworkRoutes	Read
GetNetworkTelemetry	networkmanager:GetNetworkTelemetry	Read
GetResourcePolicy	networkmanager:GetResourcePolicy	Read
GetRouteAnalysis	networkmanager:GetRouteAnalysis	Read
GetSiteToSiteVpnAttachment	networkmanager:GetSiteToSiteVpnAttachment	Read
GetSites	networkmanager:GetSites	List
GetTransitGatewayConnectPeerAssociations	networkmanager:GetTransitGatewayConnectPeerAssociations	List
GetTransitGatewayPeering	networkmanager:GetTransitGatewayPeering	Read
GetTransitGatewayRegistrations	networkmanager:GetTransitGatewayRegistrations	List
GetTransitGatewayRouteTableAttachment	networkmanager:GetTransitGatewayRouteTableAttachment	Read
GetVpcAttachment	networkmanager:GetVpcAttachment	Read
ListAttachmentRoutingPolicyAssociations	networkmanager:ListAttachmentRoutingPolicyAssociations	List
ListAttachments	networkmanager:ListAttachments	List
ListConnectPeers	networkmanager:ListConnectPeers	List
ListCoreNetworkPolicyVersions	networkmanager:ListCoreNetworkPolicyVersions	List
ListCoreNetworkPrefixListAssociations	networkmanager:ListCoreNetworkPrefixListAssociations	List
ListCoreNetworkRoutingInformation	networkmanager:ListCoreNetworkRoutingInformation	List
ListCoreNetworks	networkmanager:ListCoreNetworks	List
ListOrganizationServiceAccessStatus	networkmanager:ListOrganizationServiceAccessStatus	List
ListPeerings	networkmanager:ListPeerings	List
ListTagsForResource	networkmanager:ListTagsForResource	Read
PutAttachmentRoutingPolicyLabel	networkmanager:PutAttachmentRoutingPolicyLabel	Write
PutCoreNetworkPolicy	networkmanager:PutCoreNetworkPolicy	Write
PutResourcePolicy	networkmanager:PutResourcePolicy	Permissions management, Write
RegisterTransitGateway	networkmanager:RegisterTransitGateway	Write
RejectAttachment	networkmanager:RejectAttachment	Write
RemoveAttachmentRoutingPolicyLabel	networkmanager:RemoveAttachmentRoutingPolicyLabel	Write
RestoreCoreNetworkPolicyVersion	networkmanager:RestoreCoreNetworkPolicyVersion	Write
StartOrganizationServiceAccessUpdate	networkmanager:StartOrganizationServiceAccessUpdate	Permissions management, Write
StartRouteAnalysis	networkmanager:StartRouteAnalysis	Write
TagResource	networkmanager:TagResource	Tagging, Write
UntagResource	networkmanager:UntagResource	Tagging, Write
UpdateConnection	networkmanager:UpdateConnection	Write
UpdateCoreNetwork	networkmanager:UpdateCoreNetwork	Write
UpdateDevice	networkmanager:UpdateDevice	Write
UpdateDirectConnectGatewayAttachment	networkmanager:UpdateDirectConnectGatewayAttachment	Write
UpdateGlobalNetwork	networkmanager:UpdateGlobalNetwork	Write
UpdateLink	networkmanager:UpdateLink	Write
UpdateNetworkResourceMetadata	networkmanager:UpdateNetworkResourceMetadata	Write
UpdateSite	networkmanager:UpdateSite	Write
UpdateVpcAttachment	networkmanager:UpdateVpcAttachment	Write

Actions defined by AWS Network Manager

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptAttachment	Grants permission to accept creation of an attachment between a source and destination in a core network	attachment*	aws:ResourceTag/${TagKey}	Write
AssociateConnectPeer	Grants permission to associate a Connect Peer	device*	aws:ResourceTag/${TagKey}	Write
AssociateConnectPeer	Grants permission to associate a Connect Peer	global-network*	aws:ResourceTag/${TagKey}	Write
AssociateCustomerGateway	Grants permission to associate a customer gateway to a device	device*	aws:ResourceTag/${TagKey} networkmanager:cgwArn	Write
		global-network*	aws:ResourceTag/${TagKey} networkmanager:cgwArn
		link	aws:ResourceTag/${TagKey} networkmanager:cgwArn
AssociateLink	Grants permission to associate a link to a device	device*	aws:ResourceTag/${TagKey}	Write
		global-network*	aws:ResourceTag/${TagKey}
		link*	aws:ResourceTag/${TagKey}
AssociateTransitGatewayConnectPeer	Grants permission to associate a transit gateway connect peer to a device	device*	aws:ResourceTag/${TagKey} networkmanager:tgwConnectPeerArn	Write
		global-network*	aws:ResourceTag/${TagKey} networkmanager:tgwConnectPeerArn
		link	aws:ResourceTag/${TagKey} networkmanager:tgwConnectPeerArn
CreateConnectAttachment	Grants permission to create a Connect attachment	attachment*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConnectAttachment	Grants permission to create a Connect attachment	core-network*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConnectPeer	Grants permission to create a Connect Peer connection	attachment*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConnection	Grants permission to create a new connection	global-network*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCoreNetwork	Grants permission to create a new core network	global-network*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCoreNetworkPrefixListAssociation	Grants permission to create a prefix list core network association	core-network*	aws:ResourceTag/${TagKey}	Write
CreateDevice	Grants permission to create a new device	global-network*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDirectConnectGatewayAttachment	Grants permission to create a Direct Connect gateway attachment	core-network*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys networkmanager:directConnectGatewayArn networkmanager:edgeLocations	Write
CreateGlobalNetwork	Grants permission to create a new global network		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLink	Grants permission to create a new link	global-network*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateLink	Grants permission to create a new link	site	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSite	Grants permission to create a new site	global-network*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSiteToSiteVpnAttachment	Grants permission to create a site-to-site VPN attachment	core-network*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys networkmanager:vpnConnectionArn	Write
CreateTransitGatewayPeering	Grants permission to create a Transit Gateway peering	core-network*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys networkmanager:tgwArn	Write
CreateTransitGatewayRouteTableAttachment	Grants permission to create a TGW RTB attachment	peering*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys networkmanager:tgwRtbArn	Write
CreateVpcAttachment	Grants permission to create a VPC attachment	core-network*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys networkmanager:subnetArns networkmanager:vpcArn	Write
DeleteAttachment	Grants permission to delete an attachment	attachment*	aws:ResourceTag/${TagKey}	Write
DeleteConnectPeer	Grants permission to delete a Connect Peer	connect-peer*	aws:ResourceTag/${TagKey}	Write
DeleteConnection	Grants permission to delete a connection	connection*	aws:ResourceTag/${TagKey}	Write
DeleteConnection	Grants permission to delete a connection	global-network*	aws:ResourceTag/${TagKey}	Write
DeleteCoreNetwork	Grants permission to delete a core network	core-network*	aws:ResourceTag/${TagKey}	Write
DeleteCoreNetworkPolicyVersion	Grants permission to delete the core network policy version	core-network*	aws:ResourceTag/${TagKey}	Write
DeleteCoreNetworkPrefixListAssociation	Grants permission to delete a prefix list core network association	core-network*	aws:ResourceTag/${TagKey}	Write
DeleteDevice	Grants permission to delete a device	device*	aws:ResourceTag/${TagKey}	Write
DeleteDevice	Grants permission to delete a device	global-network*	aws:ResourceTag/${TagKey}	Write
DeleteGlobalNetwork	Grants permission to delete a global network	global-network*	aws:ResourceTag/${TagKey}	Write
DeleteLink	Grants permission to delete a link	global-network*	aws:ResourceTag/${TagKey}	Write
DeleteLink	Grants permission to delete a link	link*	aws:ResourceTag/${TagKey}	Write
DeletePeering	Grants permission to delete a peering	peering*	aws:ResourceTag/${TagKey}	Write
DeleteResourcePolicy	Grants permission to delete a resource	core-network*	aws:ResourceTag/${TagKey}	Permissions management, Write
DeleteSite	Grants permission to delete a site	global-network*	aws:ResourceTag/${TagKey}	Write
DeleteSite	Grants permission to delete a site	site*	aws:ResourceTag/${TagKey}	Write
DeregisterTransitGateway	Grants permission to deregister a transit gateway from a global network	global-network*	aws:ResourceTag/${TagKey} networkmanager:tgwArn	Write
DescribeGlobalNetworks	Grants permission to describe global networks	global-network	aws:ResourceTag/${TagKey}	List
DisassociateConnectPeer	Grants permission to disassociate a Connect Peer	global-network*	aws:ResourceTag/${TagKey}	Write
DisassociateCustomerGateway	Grants permission to disassociate a customer gateway from a device	global-network*	aws:ResourceTag/${TagKey} networkmanager:cgwArn	Write
DisassociateLink	Grants permission to disassociate a link from a device	device*	aws:ResourceTag/${TagKey}	Write
		global-network*	aws:ResourceTag/${TagKey}
		link*	aws:ResourceTag/${TagKey}
DisassociateTransitGatewayConnectPeer	Grants permission to disassociate a transit gateway connect peer from a device	global-network*	aws:ResourceTag/${TagKey} networkmanager:tgwConnectPeerArn	Write
ExecuteCoreNetworkChangeSet	Grants permission to apply changes to the core network	core-network*	aws:ResourceTag/${TagKey}	Write
GetConnectAttachment	Grants permission to retrieve a Connect attachment	attachment*	aws:ResourceTag/${TagKey}	Read
GetConnectPeer	Grants permission to retrieve a Connect Peer	connect-peer*	aws:ResourceTag/${TagKey}	Read
GetConnectPeerAssociations	Grants permission to describe Connect Peer associations	global-network*	aws:ResourceTag/${TagKey}	Read
GetConnections	Grants permission to describe connections	connection	aws:ResourceTag/${TagKey}	List
GetConnections	Grants permission to describe connections	global-network*	aws:ResourceTag/${TagKey}	List
GetCoreNetwork	Grants permission to retrieve a core network	core-network*	aws:ResourceTag/${TagKey}	Read
GetCoreNetworkChangeEvents	Grants permission to retrieve a list of core network change events	core-network*	aws:ResourceTag/${TagKey}	Read
GetCoreNetworkChangeSet	Grants permission to retrieve a list of core network change sets	core-network*	aws:ResourceTag/${TagKey}	Read
GetCoreNetworkPolicy	Grants permission to retrieve core network policy	core-network*	aws:ResourceTag/${TagKey}	Read
GetCustomerGatewayAssociations	Grants permission to describe customer gateway associations	global-network*	aws:ResourceTag/${TagKey}	List
GetDevices	Grants permission to describe devices	device	aws:ResourceTag/${TagKey}	List
GetDevices	Grants permission to describe devices	global-network*	aws:ResourceTag/${TagKey}	List
GetDirectConnectGatewayAttachment	Grants permission to retrieve a Direct Connect gateway attachment	attachment*	aws:ResourceTag/${TagKey}	Read
GetLinkAssociations	Grants permission to describe link associations	device	aws:ResourceTag/${TagKey}	List
		global-network*	aws:ResourceTag/${TagKey}
		link	aws:ResourceTag/${TagKey}
GetLinks	Grants permission to describe links	global-network*	aws:ResourceTag/${TagKey}	List
GetLinks	Grants permission to describe links	link	aws:ResourceTag/${TagKey}	List
GetNetworkResourceCounts	Grants permission to return the number of resources for a global network grouped by type	global-network*	aws:ResourceTag/${TagKey}	Read
GetNetworkResourceRelationships	Grants permission to retrieve related resources for a resource within the global network	global-network*	aws:ResourceTag/${TagKey}	Read
GetNetworkResources	Grants permission to retrieve a global network resource	global-network*	aws:ResourceTag/${TagKey}	Read
GetNetworkRoutes	Grants permission to retrieve routes for a route table within the global network	global-network*	aws:ResourceTag/${TagKey}	Read
GetNetworkTelemetry	Grants permission to retrieve network telemetry objects for the global network	global-network*	aws:ResourceTag/${TagKey}	Read
GetResourcePolicy	Grants permission to retrieve a resource policy	core-network*	aws:ResourceTag/${TagKey}	Read
GetRouteAnalysis	Grants permission to retrieve a route analysis configuration and result	global-network*	aws:ResourceTag/${TagKey}	Read
GetSiteToSiteVpnAttachment	Grants permission to retrieve a site-to-site VPN attachment	attachment*	aws:ResourceTag/${TagKey}	Read
GetSites	Grants permission to describe global networks	global-network*	aws:ResourceTag/${TagKey}	List
GetSites	Grants permission to describe global networks	site	aws:ResourceTag/${TagKey}	List
GetTransitGatewayConnectPeerAssociations	Grants permission to describe transit gateway connect peer associations	global-network*	aws:ResourceTag/${TagKey}	List
GetTransitGatewayPeering	Grants permission to retrieve a Transit Gateway peering	peering*	aws:ResourceTag/${TagKey}	Read
GetTransitGatewayRegistrations	Grants permission to describe transit gateway registrations	global-network*	aws:ResourceTag/${TagKey}	List
GetTransitGatewayRouteTableAttachment	Grants permission to retrieve a TGW RTB attachment	attachment*	aws:ResourceTag/${TagKey}	Read
GetVpcAttachment	Grants permission to retrieve a VPC attachment	attachment*	aws:ResourceTag/${TagKey}	Read
ListAttachmentRoutingPolicyAssociations	Grants permission to list all routing policies associated to core network attachments	core-network*	aws:ResourceTag/${TagKey}	List
ListAttachments	Grants permission to describe attachments	attachment*	aws:ResourceTag/${TagKey}	List
ListConnectPeers	Grants permission to describe Connect Peers	connect-peer*	aws:ResourceTag/${TagKey}	List
ListCoreNetworkPolicyVersions	Grants permission to list core network policy versions	core-network*	aws:ResourceTag/${TagKey}	List
ListCoreNetworkPrefixListAssociations	Grants permission to list core network prefix list associaitons	core-network*	aws:ResourceTag/${TagKey}	List
ListCoreNetworkRoutingInformation	Grants permission to list core network routing information	core-network*	aws:ResourceTag/${TagKey}	List
ListCoreNetworks	Grants permission to list core networks			List
ListOrganizationServiceAccessStatus	Grants permission to list organization service access status			List
ListPeerings	Grants permission to describe peerings			List
ListTagsForResource	Grants permission to list tags for a Network Manager resource	attachment	aws:ResourceTag/${TagKey}	Read
		connect-peer	aws:ResourceTag/${TagKey}
		connection	aws:ResourceTag/${TagKey}
		core-network	aws:ResourceTag/${TagKey}
		device	aws:ResourceTag/${TagKey}
		global-network	aws:ResourceTag/${TagKey}
		link	aws:ResourceTag/${TagKey}
		peering	aws:ResourceTag/${TagKey}
		site	aws:ResourceTag/${TagKey}
PutAttachmentRoutingPolicyLabel	Grants permission to put an attachment routing policy label	attachment*	aws:ResourceTag/${TagKey}	Write
PutAttachmentRoutingPolicyLabel	Grants permission to put an attachment routing policy label	core-network*	aws:ResourceTag/${TagKey}	Write
PutCoreNetworkPolicy	Grants permission to create a core network policy	core-network*	aws:ResourceTag/${TagKey}	Write
PutResourcePolicy	Grants permission to create or update a resource policy	core-network*	aws:ResourceTag/${TagKey}	Permissions management, Write
RegisterTransitGateway	Grants permission to register a transit gateway to a global network	global-network*	aws:ResourceTag/${TagKey} networkmanager:tgwArn	Write
RejectAttachment	Grants permission to reject attachment request	attachment*	aws:ResourceTag/${TagKey}	Write
RemoveAttachmentRoutingPolicyLabel	Grants permission to remove an attachment routing policy label	attachment*	aws:ResourceTag/${TagKey}	Write
RemoveAttachmentRoutingPolicyLabel		core-network*	aws:ResourceTag/${TagKey}	Write
RestoreCoreNetworkPolicyVersion	Grants permission to restore the core network policy to a previous version	core-network*	aws:ResourceTag/${TagKey}	Write
StartOrganizationServiceAccessUpdate	Grants permission to start organization service access update			Permissions management, Write
StartRouteAnalysis	Grants permission to start a route analysis and stores analysis configuration	global-network*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag a Network Manager resource	attachment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		connect-peer	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		connection	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		core-network	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		device	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		global-network	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		link	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		peering	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		site	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag a Network Manager resource	attachment	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		connect-peer	aws:ResourceTag/${TagKey} aws:TagKeys
		connection	aws:ResourceTag/${TagKey} aws:TagKeys
		core-network	aws:ResourceTag/${TagKey} aws:TagKeys
		device	aws:ResourceTag/${TagKey} aws:TagKeys
		global-network	aws:ResourceTag/${TagKey} aws:TagKeys
		link	aws:ResourceTag/${TagKey} aws:TagKeys
		peering	aws:ResourceTag/${TagKey} aws:TagKeys
		site	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateConnection	Grants permission to update a connection	connection*	aws:ResourceTag/${TagKey}	Write
UpdateConnection	Grants permission to update a connection	global-network*	aws:ResourceTag/${TagKey}	Write
UpdateCoreNetwork	Grants permission to update a core network	core-network*	aws:ResourceTag/${TagKey}	Write
UpdateDevice	Grants permission to update a device	device*	aws:ResourceTag/${TagKey}	Write
UpdateDevice	Grants permission to update a device	global-network*	aws:ResourceTag/${TagKey}	Write
UpdateDirectConnectGatewayAttachment	Grants permission to update a Direct Connect gateway attachment	attachment*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys networkmanager:edgeLocations	Write
UpdateGlobalNetwork	Grants permission to update a global network	global-network*	aws:ResourceTag/${TagKey}	Write
UpdateLink	Grants permission to update a link	global-network*	aws:ResourceTag/${TagKey}	Write
UpdateLink	Grants permission to update a link	link*	aws:ResourceTag/${TagKey}	Write
UpdateNetworkResourceMetadata	Grants permission to add or update metadata key/value pairs on network resource	global-network*	aws:ResourceTag/${TagKey}	Write
UpdateSite	Grants permission to update a site	global-network*	aws:ResourceTag/${TagKey}	Write
UpdateSite	Grants permission to update a site	site*	aws:ResourceTag/${TagKey}	Write
UpdateVpcAttachment	Grants permission to update a VPC attachment	attachment*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys networkmanager:subnetArns	Write

Resource types defined by AWS Network Manager

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
attachment	arn:${Partition}:networkmanager::${Account}:attachment/${ResourceId}	aws:ResourceTag/${TagKey}
connect-peer	arn:${Partition}:networkmanager::${Account}:connect-peer/${ResourceId}	aws:ResourceTag/${TagKey}
connection	arn:${Partition}:networkmanager::${Account}:connection/${GlobalNetworkId}/${ResourceId}	aws:ResourceTag/${TagKey}
core-network	arn:${Partition}:networkmanager::${Account}:core-network/${ResourceId}	aws:ResourceTag/${TagKey}
device	arn:${Partition}:networkmanager::${Account}:device/${GlobalNetworkId}/${ResourceId}	aws:ResourceTag/${TagKey}
global-network	arn:${Partition}:networkmanager::${Account}:global-network/${ResourceId}	aws:ResourceTag/${TagKey}
link	arn:${Partition}:networkmanager::${Account}:link/${GlobalNetworkId}/${ResourceId}	aws:ResourceTag/${TagKey}
peering	arn:${Partition}:networkmanager::${Account}:peering/${ResourceId}	aws:ResourceTag/${TagKey}
site	arn:${Partition}:networkmanager::${Account}:site/${GlobalNetworkId}/${ResourceId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Network Manager

AWS Network Manager defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
networkmanager:cgwArn	Filters access by which customer gateways can be associated or disassociated	ARN
networkmanager:directConnectGatewayArn	Filters access by which Direct Connect gateway can be used to a create/update attachment	ARN
networkmanager:edgeLocations	Filters access by which edge locations can be added or removed from a Direct Connect gateway attachment	ArrayOfString
networkmanager:subnetArns	Filters access by which VPC subnets can be added or removed from a VPC attachment	ArrayOfARN
networkmanager:tgwArn	Filters access by which transit gateways can be registered, deregistered, or peered	ARN
networkmanager:tgwConnectPeerArn	Filters access by which transit gateway connect peers can be associated or disassociated	ARN
networkmanager:tgwRtbArn	Filters access by which Transit Gateway Route Table can be used to create an attachment	ARN
networkmanager:vpcArn	Filters access by which VPC can be used to a create/update attachment	ARN
networkmanager:vpnConnectionArn	Filters access by which Site-to-Site VPN can be used to a create/update attachment	ARN

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Network Firewall (network-firewall)

AWS Network Manager Chat (networkmanager-chat)