Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Q Business

Amazon Q Business (service prefix: qbusiness) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Q Business
Actions defined by Amazon Q Business
Permission-only actions for Amazon Q Business
Resource types defined by Amazon Q Business
Condition keys for Amazon Q Business

API operations defined by Amazon Q Business

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociatePermission	qbusiness:AssociatePermission			Write
AssociatePermission	qbusiness:PutResourcePolicy			Write
BatchDeleteDocument	qbusiness:BatchDeleteDocument			Write
BatchPutDocument	qbusiness:BatchPutDocument			Write
BatchPutDocument	iam:PassRole	iam:PassedToService	qbusiness.amazonaws.com	Write
CancelSubscription	qbusiness:CancelSubscription			Write
Chat	qbusiness:Chat			Read
ChatSync	qbusiness:ChatSync			Read
CheckDocumentAccess	qbusiness:CheckDocumentAccess			Read
CreateAnonymousWebExperienceUrl	qbusiness:CreateAnonymousWebExperienceUrl			Write
CreateApplication	qbusiness:CreateApplication			Write
	qbusiness:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	qbusiness.amazonaws.com	Write
CreateChatResponseConfiguration	qbusiness:CreateChatResponseConfiguration			Write
CreateChatResponseConfiguration	qbusiness:TagResource			Tagging, Write
CreateDataAccessor	qbusiness:CreateDataAccessor			Write
	qbusiness:CreateDataAccessorWithTti			Write
	qbusiness:TagResource			Tagging, Write
CreateDataSource	qbusiness:CreateDataSource			Write
	qbusiness:DisableAclOnDataSource			Write
	qbusiness:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	qbusiness.amazonaws.com	Write
CreateIndex	qbusiness:CreateIndex			Write
CreateIndex	qbusiness:TagResource			Tagging, Write
CreatePlugin	qbusiness:CreatePlugin			Write
	qbusiness:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	qbusiness.amazonaws.com	Write
CreateRetriever	qbusiness:CreateRetriever			Write
	qbusiness:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	qbusiness.amazonaws.com	Write
CreateSubscription	qbusiness:CreateSubscription			Write
CreateUser	qbusiness:CreateUser			Write
CreateWebExperience	qbusiness:CreateWebExperience			Write
	qbusiness:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	qbusiness.amazonaws.com	Write
DeleteApplication	qbusiness:DeleteApplication			Write
DeleteAttachment	qbusiness:DeleteAttachment			Write
DeleteChatControlsConfiguration	qbusiness:DeleteChatControlsConfiguration			Write
DeleteChatResponseConfiguration	qbusiness:DeleteChatResponseConfiguration			Write
DeleteConversation	qbusiness:DeleteConversation			Write
DeleteDataAccessor	qbusiness:DeleteDataAccessor			Write
DeleteDataSource	qbusiness:DeleteDataSource			Write
DeleteGroup	qbusiness:DeleteGroup			Write
DeleteIndex	qbusiness:DeleteIndex			Write
DeletePlugin	qbusiness:DeletePlugin			Write
DeleteRetriever	qbusiness:DeleteRetriever			Write
DeleteUser	qbusiness:DeleteUser			Write
DeleteWebExperience	qbusiness:DeleteWebExperience			Write
DisassociatePermission	qbusiness:DisassociatePermission			Write
DisassociatePermission	qbusiness:PutResourcePolicy			Write
GetApplication	qbusiness:GetApplication			Read
GetChatControlsConfiguration	qbusiness:GetChatControlsConfiguration			List
GetChatResponseConfiguration	qbusiness:GetChatResponseConfiguration			Read
GetDataAccessor	qbusiness:GetDataAccessor			Read
GetDataSource	qbusiness:GetDataSource			Read
GetDocumentContent	qbusiness:GetDocumentContent			Read
GetGroup	qbusiness:GetGroup			Read
GetIndex	qbusiness:GetIndex			Read
GetMedia	qbusiness:GetMedia			Read
GetPlugin	qbusiness:GetPlugin			Read
GetPolicy	qbusiness:GetPolicy			Read
GetRetriever	qbusiness:GetRetriever			Read
GetUser	qbusiness:GetUser			Read
GetWebExperience	qbusiness:GetWebExperience			Read
ListApplications	qbusiness:ListApplications			List
ListAttachments	qbusiness:ListAttachments			List
ListChatResponseConfigurations	qbusiness:ListChatResponseConfigurations			List
ListConversations	qbusiness:ListConversations			List
ListDataAccessors	qbusiness:ListDataAccessors			List
ListDataSourceSyncJobs	qbusiness:ListDataSourceSyncJobs			List
ListDataSources	qbusiness:ListDataSources			List
ListDocuments	qbusiness:ListDocuments			List
ListGroups	qbusiness:ListGroups			List
ListIndices	qbusiness:ListIndices			List
ListMessages	qbusiness:ListMessages			List
ListPluginActions	qbusiness:ListPluginActions			Read
ListPluginTypeActions	qbusiness:ListPluginTypeActions			Read
ListPluginTypeMetadata	qbusiness:ListPluginTypeMetadata			Read
ListPlugins	qbusiness:ListPlugins			List
ListRetrievers	qbusiness:ListRetrievers			List
ListSubscriptions	qbusiness:ListSubscriptions			List
ListTagsForResource	qbusiness:ListTagsForResource			Read
ListWebExperiences	qbusiness:ListWebExperiences			List
PutFeedback	qbusiness:PutFeedback			Write
PutGroup	qbusiness:PutGroup			Write
PutGroup	iam:PassRole	iam:PassedToService	qbusiness.amazonaws.com	Write
SearchRelevantContent	qbusiness:SearchRelevantContent			Read
StartDataSourceSyncJob	qbusiness:StartDataSourceSyncJob			Write
StopDataSourceSyncJob	qbusiness:StopDataSourceSyncJob			Write
TagResource	qbusiness:TagResource			Tagging, Write
UntagResource	qbusiness:UntagResource			Tagging, Write
UpdateApplication	qbusiness:UpdateApplication			Write
UpdateApplication	iam:PassRole	iam:PassedToService	qbusiness.amazonaws.com	Write
UpdateChatControlsConfiguration	qbusiness:UpdateChatControlsConfiguration			Write
UpdateChatResponseConfiguration	qbusiness:UpdateChatResponseConfiguration			Write
UpdateDataAccessor	qbusiness:UpdateDataAccessor			Write
UpdateDataSource	qbusiness:UpdateDataSource			Write
UpdateDataSource	iam:PassRole	iam:PassedToService	qbusiness.amazonaws.com	Write
UpdateIndex	qbusiness:UpdateIndex			Write
UpdatePlugin	qbusiness:UpdatePlugin			Write
UpdatePlugin	iam:PassRole	iam:PassedToService	qbusiness.amazonaws.com	Write
UpdateRetriever	qbusiness:UpdateRetriever			Write
UpdateRetriever	iam:PassRole	iam:PassedToService	qbusiness.amazonaws.com	Write
UpdateSubscription	qbusiness:UpdateSubscription			Write
UpdateUser	qbusiness:UpdateUser			Write
UpdateWebExperience	qbusiness:UpdateWebExperience			Write
UpdateWebExperience	iam:PassRole	iam:PassedToService	qbusiness.amazonaws.com	Write

Actions defined by Amazon Q Business

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociatePermission	Grants permission to associate resource based policy statement to the application	application*	aws:ResourceTag/${TagKey}	Write
BatchDeleteDocument	Grants permission to batch delete document	application*	aws:ResourceTag/${TagKey}	Write
BatchDeleteDocument	Grants permission to batch delete document	index*	aws:ResourceTag/${TagKey}	Write
BatchPutDocument	Grants permission to batch put document	application*	aws:ResourceTag/${TagKey}	Write
BatchPutDocument	Grants permission to batch put document	index*	aws:ResourceTag/${TagKey}	Write
CancelSubscription	Grants permission to cancel a subscription	application*	aws:ResourceTag/${TagKey}	Write
CancelSubscription	Grants permission to cancel a subscription	subscription*		Write
Chat	Grants permission to chat using an application	application*	aws:ResourceTag/${TagKey}	Read
ChatSync	Grants permission to chat synchronously using an application	application*	aws:ResourceTag/${TagKey}	Read
CheckDocumentAccess	Grants permission to check if a user has access to a document	application*	aws:ResourceTag/${TagKey}	Read
CheckDocumentAccess		index*	aws:ResourceTag/${TagKey}	Read
CreateAnonymousWebExperienceUrl	Grants permission to create a unique URL for anonymous Amazon Q Business web experience	application*	aws:ResourceTag/${TagKey}	Write
CreateAnonymousWebExperienceUrl		web-experience*	aws:ResourceTag/${TagKey}	Write
CreateApplication	Grants permission to create an application		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateChatResponseConfiguration	Grants permission to create a chat response configuration to the application	application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDataAccessor	Grants permission to create DataAccessor to the application	application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDataSource	Grants permission to create a data source for a given application and index	application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDataSource		index*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateIndex	Grants permission to create an index for a given application	application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateIntegration	Grants permission to create a new integration for a Q Business application	application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePlugin	Grants permission to create a plugin for a given application	application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRetriever	Grants permission to create a retriever for a given application	application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSubscription	Grants permission to create a subscription	application*	aws:ResourceTag/${TagKey} identitystore:GroupId identitystore:UserId	Write
CreateUser	Grants permission to create a user	application*	aws:ResourceTag/${TagKey}	Write
CreateWebExperience	Grants permission to create a web experience for a given application	application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteApplication	Grants permission to delete an application	application*	aws:ResourceTag/${TagKey}	Write
DeleteAttachment	Grants permission to delete an attachment in the current chat context	application*	aws:ResourceTag/${TagKey}	Write
DeleteChatControlsConfiguration	Grants permission to delete chat controls configuration for an application	application*	aws:ResourceTag/${TagKey}	Write
DeleteChatResponseConfiguration	Grants permission to delete a chat response configuration	application*	aws:ResourceTag/${TagKey}	Write
DeleteChatResponseConfiguration	Grants permission to delete a chat response configuration	chat-response-configuration*	aws:ResourceTag/${TagKey}	Write
DeleteConversation	Grants permission to delete a conversation	application*	aws:ResourceTag/${TagKey}	Write
DeleteDataAccessor	Grants permission to delete DataAccessor	application*	aws:ResourceTag/${TagKey}	Write
DeleteDataAccessor	Grants permission to delete DataAccessor	data-accessor*	aws:ResourceTag/${TagKey}	Write
DeleteDataSource	Grants permission to delete a DataSource	application*	aws:ResourceTag/${TagKey}	Write
		data-source*	aws:ResourceTag/${TagKey}
		index*	aws:ResourceTag/${TagKey}
DeleteGroup	Grants permission to delete a group	application*	aws:ResourceTag/${TagKey}	Write
DeleteGroup	Grants permission to delete a group	index*	aws:ResourceTag/${TagKey}	Write
DeleteIndex	Grants permission to delete an index	application*	aws:ResourceTag/${TagKey}	Write
DeleteIndex	Grants permission to delete an index	index*	aws:ResourceTag/${TagKey}	Write
DeleteIntegration	Grants permission to delete an integration for a Q Business application	application*	aws:ResourceTag/${TagKey}	Write
DeleteIntegration		integration*	aws:ResourceTag/${TagKey}	Write
DeletePlugin	Grants permission to delete a plugin	application*	aws:ResourceTag/${TagKey}	Write
DeletePlugin	Grants permission to delete a plugin	plugin*	aws:ResourceTag/${TagKey}	Write
DeleteRetriever	Grants permission to delete a retriever	application*	aws:ResourceTag/${TagKey}	Write
DeleteRetriever	Grants permission to delete a retriever	retriever*	aws:ResourceTag/${TagKey}	Write
DeleteUser	Grants permission to delete a user	application*	aws:ResourceTag/${TagKey}	Write
DeleteWebExperience	Grants permission to delete a web-experience	application*	aws:ResourceTag/${TagKey}	Write
DeleteWebExperience	Grants permission to delete a web-experience	web-experience*	aws:ResourceTag/${TagKey}	Write
DisassociatePermission	Grants permission to disassociate resource based policy statement to the application	application*	aws:ResourceTag/${TagKey}	Write
GetApplication	Grants permission to get an application	application*	aws:ResourceTag/${TagKey}	Read
GetChatControlsConfiguration	Grants permission to get chat controls configuration for an application	application*	aws:ResourceTag/${TagKey}	List
GetChatResponseConfiguration	Grants permission to get a chat response configuration	application*	aws:ResourceTag/${TagKey}	Read
GetChatResponseConfiguration	Grants permission to get a chat response configuration	chat-response-configuration*	aws:ResourceTag/${TagKey}	Read
GetDataAccessor	Grants permission to get DataAccessor	application*	aws:ResourceTag/${TagKey}	Read
GetDataAccessor	Grants permission to get DataAccessor	data-accessor*	aws:ResourceTag/${TagKey}	Read
GetDataSource	Grants permission to get a data source	application*	aws:ResourceTag/${TagKey}	Read
		data-source*	aws:ResourceTag/${TagKey}
		index*	aws:ResourceTag/${TagKey}
GetDocumentContent	Grants permission to get a document content	application*	aws:ResourceTag/${TagKey}	Read
GetDocumentContent	Grants permission to get a document content	index*	aws:ResourceTag/${TagKey}	Read
GetGroup	Grants permission to get a group	application*	aws:ResourceTag/${TagKey}	Read
GetGroup	Grants permission to get a group	index*	aws:ResourceTag/${TagKey}	Read
GetIndex	Grants permission to get an index	application*	aws:ResourceTag/${TagKey}	Read
GetIndex	Grants permission to get an index	index*	aws:ResourceTag/${TagKey}	Read
GetIntegration	Grants permission to get an integration for a Q Business application	application*	aws:ResourceTag/${TagKey}	Read
GetIntegration		integration*	aws:ResourceTag/${TagKey}	Read
GetMedia	Grants permission to get the media associated to a system message	application*	aws:ResourceTag/${TagKey}	Read
GetPlugin	Grants permission to get a plugin	application*	aws:ResourceTag/${TagKey}	Read
GetPlugin	Grants permission to get a plugin	plugin*	aws:ResourceTag/${TagKey}	Read
GetPolicy	Grants permission to get resource based policy of the application	application*	aws:ResourceTag/${TagKey}	Read
GetRetriever	Grants permission to get a retriever	application*	aws:ResourceTag/${TagKey}	Read
GetRetriever	Grants permission to get a retriever	retriever*	aws:ResourceTag/${TagKey}	Read
GetUser	Grants permission to get a user	application*	aws:ResourceTag/${TagKey}	Read
GetWebExperience	Grants permission to get a web-experience	application*	aws:ResourceTag/${TagKey}	Read
GetWebExperience	Grants permission to get a web-experience	web-experience*	aws:ResourceTag/${TagKey}	Read
ListApplications	Grants permission to list the applications			List
ListAttachments	Grants permission to list attachments in the current chat context	application*	aws:ResourceTag/${TagKey}	List
ListChatResponseConfigurations	Grants permission to list chat response configurations for an application	application*	aws:ResourceTag/${TagKey}	List
ListConversations	Grants permission to list all conversations for an application	application*	aws:ResourceTag/${TagKey}	List
ListDataAccessors	Grants permission to list DataAccessors for the application	application*	aws:ResourceTag/${TagKey}	List
ListDataSourceSyncJobs	Grants permission to get Data Source sync job history	application*	aws:ResourceTag/${TagKey}	List
		data-source*	aws:ResourceTag/${TagKey}
		index*	aws:ResourceTag/${TagKey}
ListDataSources	Grants permission to list the data sources of an application and an index	application*	aws:ResourceTag/${TagKey}	List
ListDataSources		index*	aws:ResourceTag/${TagKey}	List
ListDocuments	Grants permission to list all documents	application*	aws:ResourceTag/${TagKey}	List
ListDocuments	Grants permission to list all documents	index*	aws:ResourceTag/${TagKey}	List
ListGroups	Grants permission to list groups	application*	aws:ResourceTag/${TagKey}	List
ListGroups	Grants permission to list groups	index*	aws:ResourceTag/${TagKey}	List
ListIndices	Grants permission to list the indices of an application	application*	aws:ResourceTag/${TagKey}	List
ListIntegrations	Grants permission to list all integrations for a Q Business application	application*	aws:ResourceTag/${TagKey}	List
ListMessages	Grants permission to list all messages	application*	aws:ResourceTag/${TagKey}	List
ListPluginActions	Grants permission to list the plugins actions of a plugin within application	application*	aws:ResourceTag/${TagKey}	Read
ListPluginActions		plugin*	aws:ResourceTag/${TagKey}	Read
ListPluginTypeActions	Grants permission to list all the actions for a plugin type			Read
ListPluginTypeMetadata	Grants permission to list all the plugin type metadata			Read
ListPlugins	Grants permission to list the plugins of an application	application*	aws:ResourceTag/${TagKey}	List
ListRetrievers	Grants permission to list the retrievers of an application	application*	aws:ResourceTag/${TagKey}	List
ListSubscriptions	Grants permission to list subscriptions	application*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags for a resource	application	aws:ResourceTag/${TagKey}	Read
		chat-response-configuration	aws:ResourceTag/${TagKey}
		data-accessor	aws:ResourceTag/${TagKey}
		data-source	aws:ResourceTag/${TagKey}
		index	aws:ResourceTag/${TagKey}
		integration	aws:ResourceTag/${TagKey}
		plugin	aws:ResourceTag/${TagKey}
		retriever	aws:ResourceTag/${TagKey}
		web-experience	aws:ResourceTag/${TagKey}
ListWebExperiences	Grants permission to list the web experiences of an application	application*	aws:ResourceTag/${TagKey}	List
PutFeedback	Grants permission to put feedback about a conversation message	application*	aws:ResourceTag/${TagKey}	Write
PutGroup	Grants permission to put a group of users	application*	aws:ResourceTag/${TagKey}	Write
PutGroup	Grants permission to put a group of users	index*	aws:ResourceTag/${TagKey}	Write
SearchRelevantContent	Grants permission to search relevant content from the Amazon Q Business Application	application*	aws:ResourceTag/${TagKey}	Read
StartDataSourceSyncJob	Grants permission to start Data Source sync job	application*	aws:ResourceTag/${TagKey}	Write
		data-source*	aws:ResourceTag/${TagKey}
		index*	aws:ResourceTag/${TagKey}
StartDeployment	Grants permission to start deployment for an integration	application*	aws:ResourceTag/${TagKey}	Write
StartDeployment	Grants permission to start deployment for an integration	integration*	aws:ResourceTag/${TagKey}	Write
StopDataSourceSyncJob	Grants permission to stop Data Source sync job	application*	aws:ResourceTag/${TagKey}	Write
		data-source*	aws:ResourceTag/${TagKey}
		index*	aws:ResourceTag/${TagKey}
TagResource	Grants permission to tag a resource with given key value pairs	application	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		chat-response-configuration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		data-accessor	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		data-source	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		index	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		integration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		plugin	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		retriever	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		web-experience	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove the tag with the given key from a resource	application	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		chat-response-configuration	aws:ResourceTag/${TagKey} aws:TagKeys
		data-accessor	aws:ResourceTag/${TagKey} aws:TagKeys
		data-source	aws:ResourceTag/${TagKey} aws:TagKeys
		index	aws:ResourceTag/${TagKey} aws:TagKeys
		integration	aws:ResourceTag/${TagKey} aws:TagKeys
		plugin	aws:ResourceTag/${TagKey} aws:TagKeys
		retriever	aws:ResourceTag/${TagKey} aws:TagKeys
		web-experience	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateApplication	Grants permission to update an Application	application*	aws:ResourceTag/${TagKey}	Write
UpdateChatControlsConfiguration	Grants permission to update chat controls configuration for an application	application*	aws:ResourceTag/${TagKey}	Write
UpdateChatResponseConfiguration	Grants permission to update a chat response configuration	application*	aws:ResourceTag/${TagKey}	Write
UpdateChatResponseConfiguration	Grants permission to update a chat response configuration	chat-response-configuration*	aws:ResourceTag/${TagKey}	Write
UpdateDataAccessor	Grants permission to update DataAccessor	application*	aws:ResourceTag/${TagKey}	Write
UpdateDataAccessor	Grants permission to update DataAccessor	data-accessor*	aws:ResourceTag/${TagKey}	Write
UpdateDataSource	Grants permission to update a DataSource	application*	aws:ResourceTag/${TagKey}	Write
		data-source*	aws:ResourceTag/${TagKey}
		index*	aws:ResourceTag/${TagKey}
UpdateIndex	Grants permission to update an index	application*	aws:ResourceTag/${TagKey}	Write
UpdateIndex	Grants permission to update an index	index*	aws:ResourceTag/${TagKey}	Write
UpdateIntegration	Grants permission to update an integration for a Q Business application	application*	aws:ResourceTag/${TagKey}	Write
UpdateIntegration		integration*	aws:ResourceTag/${TagKey}	Write
UpdatePlugin	Grants permission to update a plugin	application*	aws:ResourceTag/${TagKey}	Write
UpdatePlugin	Grants permission to update a plugin	plugin*	aws:ResourceTag/${TagKey}	Write
UpdateRetriever	Grants permission to update a Retriever	application*	aws:ResourceTag/${TagKey}	Write
UpdateRetriever	Grants permission to update a Retriever	retriever*	aws:ResourceTag/${TagKey}	Write
UpdateSubscription	Grants permission to update a subscription	application*	aws:ResourceTag/${TagKey}	Write
UpdateSubscription	Grants permission to update a subscription	subscription*		Write
UpdateUser	Grants permission to update a user	application*	aws:ResourceTag/${TagKey}	Write
UpdateWebExperience	Grants permission to update a WebExperience	application*	aws:ResourceTag/${TagKey}	Write
UpdateWebExperience	Grants permission to update a WebExperience	web-experience*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon Q Business

The following actions are defined by Amazon Q Business but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AllowVendedLogDeliveryForResource	Grants permission to configure vended log delivery for Amazon Q Business application resource	application*	aws:ResourceTag/${TagKey}	Permissions management, Write
CreateDataAccessorWithTti	Grants permission to create AWS IAM Identity center Trusted Token Issuer based DataAccessor to the application	application*	aws:ResourceTag/${TagKey}	Write
DisableAclOnDataSource	Grants permission to disable the ACL crawl while creating the Amazon Q Business data source resource	application*	aws:ResourceTag/${TagKey}	Write
PutResourcePolicy	Grants permission to put resource based policy statement to the application	application*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Q Business

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
application	arn:${Partition}:qbusiness:${Region}:${Account}:application/${ApplicationId}	aws:ResourceTag/${TagKey}
chat-response-configuration	arn:${Partition}:qbusiness:${Region}:${Account}:application/${ApplicationId}/chat-response-configuration/${ChatResponseConfigurationId}	aws:ResourceTag/${TagKey}
data-accessor	arn:${Partition}:qbusiness:${Region}:${Account}:application/${ApplicationId}/data-accessor/${DataAccessorId}	aws:ResourceTag/${TagKey}
data-source	arn:${Partition}:qbusiness:${Region}:${Account}:application/${ApplicationId}/index/${IndexId}/data-source/${DataSourceId}	aws:ResourceTag/${TagKey}
index	arn:${Partition}:qbusiness:${Region}:${Account}:application/${ApplicationId}/index/${IndexId}	aws:ResourceTag/${TagKey}
integration	arn:${Partition}:qbusiness:${Region}:${Account}:application/${ApplicationId}/integration/${IntegrationId}	aws:ResourceTag/${TagKey}
plugin	arn:${Partition}:qbusiness:${Region}:${Account}:application/${ApplicationId}/plugin/${PluginId}	aws:ResourceTag/${TagKey}
retriever	arn:${Partition}:qbusiness:${Region}:${Account}:application/${ApplicationId}/retriever/${RetrieverId}	aws:ResourceTag/${TagKey}
subscription	arn:${Partition}:qbusiness:${Region}:${Account}:application/${ApplicationId}/subscription/${SubscriptionId}
web-experience	arn:${Partition}:qbusiness:${Region}:${Account}:application/${ApplicationId}/web-experience/${WebExperienceId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Q Business

Amazon Q Business defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
identitystore:GroupId	Filters access by IAM Identity Center Group ID	ArrayOfString
identitystore:UserId	Filters access by IAM Identity Center User ID	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Q (q)

Amazon Q Business Q Apps (qapps)