Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon OpenSearch Serverless

Amazon OpenSearch Serverless (service prefix: aoss) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon OpenSearch Serverless
Actions defined by Amazon OpenSearch Serverless
Resource types defined by Amazon OpenSearch Serverless
Condition keys for Amazon OpenSearch Serverless

API operations defined by Amazon OpenSearch Serverless

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
BatchGetCollection	aoss:BatchGetCollection	Read
BatchGetCollectionGroup	aoss:BatchGetCollectionGroup	Read
BatchGetEffectiveLifecyclePolicy	aoss:BatchGetEffectiveLifecyclePolicy	Read
BatchGetLifecyclePolicy	aoss:BatchGetLifecyclePolicy	Read
BatchGetVpcEndpoint	aoss:BatchGetVpcEndpoint	Read
CreateAccessPolicy	aoss:CreateAccessPolicy	Write
CreateCollection	aoss:AddCollectionToCollectionGroup	Write
	aoss:CreateCollection	Write
	aoss:TagResource	Write
CreateCollectionGroup	aoss:CreateCollectionGroup	Write
CreateCollectionGroup	aoss:TagResource	Write
CreateIndex	aoss:CreateIndex	Write
CreateLifecyclePolicy	aoss:CreateLifecyclePolicy	Write
CreateSecurityConfig	aoss:CreateSecurityConfig	Write
CreateSecurityPolicy	aoss:CreateSecurityPolicy	Write
CreateVpcEndpoint	aoss:CreateVpcEndpoint	Write
DeleteAccessPolicy	aoss:DeleteAccessPolicy	Write
DeleteCollection	aoss:DeleteCollection	Write
DeleteCollectionGroup	aoss:DeleteCollectionGroup	Write
DeleteIndex	aoss:DeleteIndex	Write
DeleteLifecyclePolicy	aoss:DeleteLifecyclePolicy	Write
DeleteSecurityConfig	aoss:DeleteSecurityConfig	Write
DeleteSecurityPolicy	aoss:DeleteSecurityPolicy	Write
DeleteVpcEndpoint	aoss:DeleteVpcEndpoint	Write
GetAccessPolicy	aoss:GetAccessPolicy	Read
GetAccountSettings	aoss:GetAccountSettings	Read
GetIndex	aoss:GetIndex	Read
GetPoliciesStats	aoss:GetPoliciesStats	Read
GetSecurityConfig	aoss:GetSecurityConfig	Read
GetSecurityPolicy	aoss:GetSecurityPolicy	Read
ListAccessPolicies	aoss:ListAccessPolicies	List
ListCollectionGroups	aoss:ListCollectionGroups	List
ListCollections	aoss:ListCollections	List
ListLifecyclePolicies	aoss:ListLifecyclePolicies	List
ListSecurityConfigs	aoss:ListSecurityConfigs	List
ListSecurityPolicies	aoss:ListSecurityPolicies	List
ListTagsForResource	aoss:ListTagsForResource	List
ListVpcEndpoints	aoss:ListVpcEndpoints	List
TagResource	aoss:TagResource	Write
UntagResource	aoss:UntagResource	Write
UpdateAccessPolicy	aoss:UpdateAccessPolicy	Write
UpdateAccountSettings	aoss:UpdateAccountSettings	Write
UpdateCollection	aoss:UpdateCollection	Write
UpdateCollectionGroup	aoss:UpdateCollectionGroup	Write
UpdateIndex	aoss:UpdateIndex	Write
UpdateLifecyclePolicy	aoss:UpdateLifecyclePolicy	Write
UpdateSecurityConfig	aoss:UpdateSecurityConfig	Write
UpdateSecurityPolicy	aoss:UpdateSecurityPolicy	Write
UpdateVpcEndpoint	aoss:UpdateVpcEndpoint	Write

Actions defined by Amazon OpenSearch Serverless

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
APIAccessAll	Grant permission to all the supported Opensearch APIs	Collection*	aoss:collection aoss:CollectionId aws:ResourceTag/${TagKey}	Write
AddCollectionToCollectionGroup	Grants permission to add a serverless collection to a specified collection group	CollectionGroup*	aoss:collection-group aws:ResourceTag/${TagKey}	Write
BatchGetCollection	Grants permission to get attributes for one or more collections		aoss:collection	Read
BatchGetCollectionGroup	Grants permission to get attributes for one or more collection groups		aoss:collection-group	Read
BatchGetEffectiveLifecyclePolicy	Grants permission to get the information about a lifecycle policy applied to one or more AOSS resources			Read
BatchGetLifecyclePolicy	Grants permission to get information about one or more lifecycle policies			Read
BatchGetVpcEndpoint	Grants permission to get attributes for one or more VPC endpoints			Read
CreateAccessPolicy	Grants permission to create a data access policy		aoss:collection aoss:index	Write
CreateCollection	Grants permission to create a serverless collection		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCollectionGroup	Grants permission to create a serverless collection group		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateIndex	Grants permission to create an opensearch index			Write
CreateLifecyclePolicy	Grants permission to create a lifecycle policy		aoss:index	Write
CreateSecurityConfig	Grants permission to create a serverless security configuration			Write
CreateSecurityPolicy	Grants permission to create a network or encryption policy		aoss:collection	Write
CreateVpcEndpoint	Grants permission to create an OpenSearch-Serverless-managed interface VPC endpoint			Write
DashboardsAccessAll	Grants permission to Opensearch Serverless Dashboards	Dashboards*	aoss:collection aoss:CollectionId	Write
DeleteAccessPolicy	Grants permission to delete a data access policy		aoss:collection aoss:index	Write
DeleteCollection	Grants permission to delete a serverless collection	Collection*	aws:ResourceTag/${TagKey}	Write
DeleteCollectionGroup	Grants permission to delete a serverless collection group	CollectionGroup*	aws:ResourceTag/${TagKey}	Write
DeleteIndex	Grants permission to delete an opensearch index			Write
DeleteLifecyclePolicy	Grants permission to delete a lifecycle policy		aoss:index	Write
DeleteSecurityConfig	Grants permission to delete a security configuration			Write
DeleteSecurityPolicy	Grants permission to delete a security policy		aoss:collection	Write
DeleteVpcEndpoint	Grants permission to delete an OpenSearch Serverless-managed interface VPC endpoint			Write
GetAccessPolicy	Grants permission to get information about a data access policy		aoss:collection aoss:index	Read
GetAccountSettings	Grants permission to get account settings, including capacity settings			Read
GetIndex	Grants permission to get an opensearch index			Read
GetPoliciesStats	Grants permission to get statistis about the security policies in your account			Read
GetSecurityConfig	Grants permission to get information about a serverless security configuration			Read
GetSecurityPolicy	Grants permission to get information about a security policy		aoss:collection	Read
ListAccessPolicies	Grants permission to list data access policies			List
ListCollectionGroups	Grants permission to list collection groups			List
ListCollections	Grants permission to list collections			List
ListLifecyclePolicies	Grants permission to list lifecycle policies			List
ListSecurityConfigs	Grants permission to list security configurations			List
ListSecurityPolicies	Grants permission to list security policies			List
ListTagsForResource	Grants permission to list tags for a collection			List
ListVpcEndpoints	Grants permission to list OpenSearch Serverless-managed VPC endpoints			List
TagResource	Grants permission to tag a serverless collection		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UntagResource	Grants permission to remove tags from a collection		aws:TagKeys	Write
UpdateAccessPolicy	Grants permission to update a data access policy		aoss:collection aoss:index	Write
UpdateAccountSettings	Grants permission to update account settings, including capacity settings			Write
UpdateCollection	Grants permission to update a collection	Collection*	aws:ResourceTag/${TagKey}	Write
UpdateCollectionGroup	Grants permission to update a collection group	CollectionGroup*	aws:ResourceTag/${TagKey}	Write
UpdateIndex	Grants permission to update an opensearch index			Write
UpdateLifecyclePolicy	Grants permission to update a lifecycle policy		aoss:index	Write
UpdateSecurityConfig	Grants permission to update a security configuration			Write
UpdateSecurityPolicy	Grants permission to update a security policy		aoss:collection	Write
UpdateVpcEndpoint	Grants permission to update an OpenSearch Serverless-managed VPC endpoint			Write

Resource types defined by Amazon OpenSearch Serverless

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
Collection	arn:${Partition}:aoss:${Region}:${Account}:collection/${CollectionId}	aws:ResourceTag/${TagKey}
CollectionGroup	arn:${Partition}:aoss:${Region}:${Account}:collection-group/${CollectionGroupId}	aws:ResourceTag/${TagKey}
Dashboards	arn:${Partition}:aoss:${Region}:${Account}:dashboards/default

Condition keys for Amazon OpenSearch Serverless

Amazon OpenSearch Serverless defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aoss:CollectionId	Filters access by the identifier of the collection	String
aoss:collection	Filters access by the collection name	String
aoss:collection-group	Filters access by the collection group name	String
aoss:index	Filters access by the index	String
aws:RequestTag/${TagKey}	Filters access based on the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access based on the tags associated with the resource	String
aws:TagKeys	Filters access based on the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon OpenSearch Ingestion (osis)

Amazon OpenSearch Service (es)