Actions, resources, and condition keys for AWS Service - Oracle Database@AWS
AWS Service - Oracle Database@AWS (service prefix: odb) provides the following
service-specific operations, resources, actions, and condition keys for use in IAM permission
policies.
References:
-
Learn how to configure this service.
-
View a list of the API operations available for this service.
-
Learn how to secure this service and its resources by using IAM permission policies.
-
View the programmatic service authorization reference
for this service.
Topics
API operations defined by AWS Service - Oracle Database@AWS
The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.
| Operation | IAM action | Condition key | Possible value(s) | Access level |
|---|---|---|---|---|
|
AcceptMarketplaceRegistration |
Write |
|||
|
AssociateIamRoleToResource |
Write |
|||
iam:PassedToService |
odb.amazonaws.com |
Write |
||
|
CreateAutonomousDatabase |
Write |
|||
Tagging, Write |
||||
|
CreateAutonomousDatabaseBackup |
Write |
|||
|
CreateAutonomousDatabaseWallet |
Write |
|||
|
CreateCloudAutonomousVmCluster |
Write |
|||
Tagging, Write |
||||
|
CreateCloudExadataInfrastructure |
Write |
|||
Tagging, Write |
||||
|
CreateCloudVmCluster |
Write |
|||
Write |
||||
Tagging, Write |
||||
|
CreateOdbNetwork |
Write |
|||
Tagging, Write |
||||
|
CreateOdbPeeringConnection |
Write |
|||
Tagging, Write |
||||
|
DeleteAutonomousDatabase |
Write |
|||
|
DeleteAutonomousDatabaseBackup |
Write |
|||
|
DeleteCloudAutonomousVmCluster |
Write |
|||
|
DeleteCloudExadataInfrastructure |
Write |
|||
|
DeleteCloudVmCluster |
Write |
|||
Write |
||||
|
DeleteOdbNetwork |
Write |
|||
|
DeleteOdbPeeringConnection |
Write |
|||
|
DisassociateIamRoleFromResource |
Write |
|||
|
FailoverAutonomousDatabase |
Write |
|||
|
GetAutonomousDatabase |
Read |
|||
|
GetAutonomousDatabaseBackup |
Read |
|||
|
GetCloudAutonomousVmCluster |
Read |
|||
|
GetCloudExadataInfrastructure |
Read |
|||
|
GetCloudExadataInfrastructureUnallocatedResources |
Read |
|||
|
GetCloudVmCluster |
Read |
|||
|
GetDbNode |
Read |
|||
|
GetDbServer |
Read |
|||
|
GetOciOnboardingStatus |
Read |
|||
|
GetOdbNetwork |
Read |
|||
|
GetOdbPeeringConnection |
Read |
|||
|
InitializeService |
Write |
|||
|
ListAutonomousDatabaseBackups |
List |
|||
|
ListAutonomousDatabaseCharacterSets |
Read |
|||
|
ListAutonomousDatabaseClones |
Read |
|||
|
ListAutonomousDatabasePeers |
Read |
|||
|
ListAutonomousDatabaseVersions |
Read |
|||
|
ListAutonomousDatabases |
List |
|||
|
ListAutonomousVirtualMachines |
Read |
|||
|
ListCloudAutonomousVmClusters |
List |
|||
|
ListCloudExadataInfrastructures |
List |
|||
|
ListCloudVmClusters |
List |
|||
|
ListDbNodes |
List |
|||
|
ListDbServers |
Read |
|||
|
ListDbSystemShapes |
Read |
|||
|
ListGiVersions |
Read |
|||
|
ListOdbNetworks |
List |
|||
|
ListOdbPeeringConnections |
List |
|||
|
ListSystemVersions |
Read |
|||
|
ListTagsForResource |
Read |
|||
|
RebootAutonomousDatabase |
Write |
|||
|
RebootDbNode |
Write |
|||
|
RestoreAutonomousDatabase |
Write |
|||
|
ShrinkAutonomousDatabase |
Write |
|||
|
StartAutonomousDatabase |
Write |
|||
|
StartDbNode |
Write |
|||
|
StopAutonomousDatabase |
Write |
|||
|
StopDbNode |
Write |
|||
|
SwitchoverAutonomousDatabase |
Write |
|||
|
TagResource |
Tagging, Write |
|||
|
UntagResource |
Tagging, Write |
|||
|
UpdateAutonomousDatabase |
Write |
|||
iam:PassedToService |
odb.amazonaws.com |
Write |
||
|
UpdateCloudExadataInfrastructure |
Write |
|||
|
UpdateOdbNetwork |
Write |
|||
|
UpdateOdbPeeringConnection |
Write |
Actions defined by AWS Service - Oracle Database@AWS
You can specify the following actions in the Action element of an IAM
policy statement. Use policies to grant permissions to perform an operation in AWS. When
you use an action in a policy, you usually allow or deny access to the API operation or CLI
command with the same name. However, in some cases, a single action controls access to more
than one operation. Alternatively, some operations require several different actions.
| Actions | Description | Resource types (*required) | Condition keys | Access level |
|---|---|---|---|---|
Grants permission to register the Amazon Web Services Marketplace token for your Amazon Web Services account to activate your Oracle Database@Amazon Web Services subscription |
Write |
|||
Grants permission to associate an AWS Identity and Access Management (IAM) service role with a specified resource to enable AWS service integration |
Write |
|||
Grants permission to create an Autonomous Database |
Write |
|||
Grants permission to create a backup of the specified Autonomous Database |
Write |
|||
Grants permission to create a wallet for the specified Autonomous Database |
Write |
|||
Grants permission to create an Autonomous VM cluster in the specified Exadata infrastructure |
Write |
|||
Grants permission to create an Exadata infrastructure |
Write |
|||
Grants permission to create a VM cluster on the specified Exadata infrastructure |
Write |
|||
Grants permission to create an ODB network |
Write |
|||
Grants permission to create an ODB Peering Connection |
Write |
|||
Grants permission to delete the specified Autonomous Database |
Write |
|||
Grants permission to delete the specified Autonomous Database backup |
Write |
|||
Grants permission to Deletes an Autonomous VM cluster |
Write |
|||
Grants permission to delete a specified Exadata infrastructure. Before you use this operation, make sure to delete all of the VM clusters that are hosted on this Exadata infrastructure |
Write |
|||
Grants permission to delete a specified VM cluster |
Write |
|||
Grants permission to delete the specified ODB network |
Write |
|||
Grants permission to delete the specified ODB Peering Connection. When you delete an ODB peering connection, the underlying VPC peering connection is also deleted |
Write |
|||
Grants permission to disassociate an AWS Identity and Access Management (IAM) service role from a specified resource to disable AWS service integration |
Write |
|||
Grants permission to fail over the specified Autonomous Database to a standby peer database |
Write |
|||
Grants permission to get information about a specific Autonomous Database |
Read |
|||
Grants permission to get information about a specific Autonomous Database backup |
Read |
|||
Grants permission to get the wallet details for the specified Autonomous Database |
Read |
|||
Grants permission to get information about a specific Autonomous VM cluster |
Read |
|||
Grants permission to get information about the specified Exadata infrastructure |
Read |
|||
Grants permission to retrieve information about unallocated resources in a specified Cloud Exadata Infrastructure |
Read |
|||
Grants permission to get information about the specified VM cluster |
Read |
|||
Grants permission to get information about the specified DB node |
Read |
|||
Grants permission to get information about the specified database server |
Read |
|||
Grants permission to get the tenancy activation link and onboarding status for your Amazon Web Services account |
Read |
|||
Grants permission to get information about the specified ODB network |
Read |
|||
Grants permission to get information about the specified ODB Peering connection |
Read |
|||
Grants permission to initialize the ODB service for the first time in an account |
Write |
|||
Grants permission to list information about the backups of the specified Autonomous Database |
List |
|||
Grants permission to list information about the character sets that are available for Autonomous Databases |
Read |
|||
Grants permission to list all clones of the specified Autonomous Database |
Read |
|||
Grants permission to list all peer databases of the specified Autonomous Database |
Read |
|||
Grants permission to list information about the Oracle Database software versions that are available for Autonomous Databases |
Read |
|||
Grants permission to list information about the Autonomous Databases owned by your Amazon Web Services account |
List |
|||
Grants permission to list all Autonomous VMs in an Autonomous VM cluster |
Read |
|||
Grants permission to list all Autonomous VM clusters in a specified Cloud Exadata infrastructure |
List |
|||
Grants permission to list information about the Exadata infrastructures owned by your Amazon Web Services account |
List |
|||
Grants permission to list information about the VM clusters owned by your Amazon Web Services account or only the ones on the specified Exadata infrastructure |
List |
|||
Grants permission to list information about the DB nodes for the specified VM cluster |
List |
|||
Grants permission to list information about the database servers that belong to the specified Exadata infrastructure |
Read |
|||
Grants permission to list information about the shapes that are available for an Exadata infrastructure |
Read |
|||
Grants permission to list information about Oracle Grid Infrastructure (GI) software versions that are available for a VM cluster for the specified shape |
Read |
|||
Grants permission to list information about the ODB networks owned by your Amazon Web Services account |
List |
|||
Grants permission to list all ODB peering connections or those associated with a specific ODB network |
List |
|||
Grants permission to list information about the system versions that are available for a VM cluster for the specified giVersion and shape |
Read |
|||
Grants permission to list information about the tags applied to this resource |
Read |
|||
Grants permission to reboot the specified Autonomous Database |
Write |
|||
Grants permission to reboot the specified DB node in a VM cluster |
Write |
|||
Grants permission to restore the specified Autonomous Database to a point in time |
Write |
|||
Grants permission to shrink the storage of the specified Autonomous Database to reclaim unused space |
Write |
|||
Grants permission to start the specified Autonomous Database |
Write |
|||
Grants permission to start the specified DB node in a VM cluster |
Write |
|||
Grants permission to stop the specified Autonomous Database |
Write |
|||
Grants permission to stop the specified DB node in a VM cluster |
Write |
|||
Grants permission to switch over the specified Autonomous Database to a standby peer database |
Write |
|||
Grants permission to apply tags to the specified resource |
Tagging, Write |
|||
Grants permission to remove tags from the specified resource |
Tagging, Write |
|||
Grants permission to update the properties of an Autonomous Database |
Write |
|||
Grants permission to update the properties of an Autonomous Database backup |
Write |
|||
Grants permission to update the properties of an Exadata infrastructure resource |
Write |
|||
Grants permission to update properties of a specified ODB network |
Write |
|||
Grants permission to update properties of a specified ODB Peering Connection |
Write |
Permission-only actions for AWS Service - Oracle Database@AWS
The following actions are defined by AWS Service - Oracle Database@AWS but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.
| Actions | Description | Resource types (*required) | Condition keys | Access level |
|---|---|---|---|---|
Grants permission to create a DB Node |
Write |
|||
Grants permission to create an ODB Grant Share |
Write |
|||
Grants permission to create an Outbound Integration |
Write |
|||
Grants permission to delete a DB Node |
Write |
|||
Grants permission to delete an ODB Grant Share |
Write |
|||
Grants permission to delete a resource policy |
Write |
|||
Grants permission to get a resource policy |
Read |
|||
Grants permission to update a resource policy |
Write |
|||
Grants permission to update an ODB Grant Share |
Write |
|||
Grants permission to update an Outbound Integration |
Write |
|||
Resource types defined by AWS Service - Oracle Database@AWS
The following resource types are defined by this service and can be used in the
Resource element of IAM permission policy statements.
| Resource types | ARN | Condition keys |
|---|---|---|
arn:${Partition}:odb:${Region}:${Account}:autonomous-database/${AutonomousDatabaseId} |
||
arn:${Partition}:odb:${Region}:${Account}:autonomous-database-backup/${AutonomousDatabaseBackupId} |
||
arn:${Partition}:odb:${Region}:${Account}:cloud-autonomous-vm-cluster/${CloudAutonomousVmClusterId} |
||
arn:${Partition}:odb:${Region}:${Account}:cloud-exadata-infrastructure/${CloudExadataInfrastructureId} |
||
arn:${Partition}:odb:${Region}:${Account}:cloud-vm-cluster/${CloudVmClusterId} |
||
arn:${Partition}:odb:${Region}:${Account}:db-node/${DbNodeId} |
||
arn:${Partition}:odb:${Region}:${Account}:odb-network/${OdbNetworkId} |
||
arn:${Partition}:odb:${Region}:${Account}:odb-peering-connection/${OdbPeeringConnectionId} |
Condition keys for AWS Service - Oracle Database@AWS
AWS Service - Oracle Database@AWS defines the following condition keys that can be used in the
Condition element of an IAM policy.
| Condition keys | Description | Type |
|---|---|---|
Filters access by a tag key and value pair that is allowed in the request |
String |
|
Filters access by a tag key and value pair of a resource |
String |
|
Filters access by a list of tag keys that are allowed in the request |
ArrayOfString |