Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Systems Manager Quick Setup

AWS Systems Manager Quick Setup (service prefix: ssm-quicksetup) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Systems Manager Quick Setup
Actions defined by AWS Systems Manager Quick Setup
Resource types defined by AWS Systems Manager Quick Setup
Condition keys for AWS Systems Manager Quick Setup

API operations defined by AWS Systems Manager Quick Setup

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateConfigurationManager	ssm-quicksetup:CreateConfigurationManager			Write
	ssm-quicksetup:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	cloudformation.amazonaws.com, ssm-quicksetup.amazonaws.com	Write
DeleteConfigurationManager	ssm-quicksetup:DeleteConfigurationManager			Write
DeleteConfigurationManager	iam:PassRole	iam:PassedToService	cloudformation.amazonaws.com, ssm-quicksetup.amazonaws.com	Write
GetConfiguration	ssm-quicksetup:GetConfiguration			Read
GetConfigurationManager	ssm-quicksetup:GetConfigurationManager			Read
GetServiceSettings	ssm-quicksetup:GetServiceSettings			Read
ListConfigurationManagers	ssm-quicksetup:ListConfigurationManagers			List
ListConfigurations	ssm-quicksetup:ListConfigurations			List
ListQuickSetupTypes	ssm-quicksetup:ListQuickSetupTypes			Read
ListTagsForResource	ssm-quicksetup:ListTagsForResource			Read
TagResource	ssm-quicksetup:TagResource			Tagging, Write
TagResource	iam:PassRole	iam:PassedToService	cloudformation.amazonaws.com, ssm-quicksetup.amazonaws.com	Write
UntagResource	ssm-quicksetup:UntagResource			Tagging, Write
UntagResource	iam:PassRole	iam:PassedToService	cloudformation.amazonaws.com, ssm-quicksetup.amazonaws.com	Write
UpdateConfigurationDefinition	ssm-quicksetup:UpdateConfigurationDefinition			Write
UpdateConfigurationDefinition	iam:PassRole	iam:PassedToService	cloudformation.amazonaws.com, ssm-quicksetup.amazonaws.com	Write
UpdateConfigurationManager	ssm-quicksetup:UpdateConfigurationManager			Write
UpdateServiceSettings	ssm-quicksetup:UpdateServiceSettings			Write
UpdateServiceSettings	iam:PassRole	iam:PassedToService	ssm-quicksetup.amazonaws.com	Write

Actions defined by AWS Systems Manager Quick Setup

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateConfigurationManager	Grants permission to create a Quick Setup configuration manager resource	configuration-manager*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteConfigurationManager	Grants permission to delete a configuration manager	configuration-manager*	aws:ResourceTag/${TagKey}	Write
GetConfiguration	Grants permission to get Quick Setup configuration	configuration-manager	aws:ResourceTag/${TagKey}	Read
GetConfigurationManager	Grants permission to get a configuration manager	configuration-manager*	aws:ResourceTag/${TagKey}	Read
GetServiceSettings	Grants permission to get settings configured for Quick Setup in the requesting AWS account and AWS Region			Read
ListConfigurationManagers	Grants permission to list Quick Setup configuration managers			List
ListConfigurations	Grants permission to list Quick Setup configurations	configuration-manager	aws:ResourceTag/${TagKey}	List
ListQuickSetupTypes	Grants permission to list the available Quick Setup types			Read
ListTagsForResource	Grants permission to list tags assigned to the resource	configuration-manager*	aws:ResourceTag/${TagKey}	Read
TagResource	Grants permission to Assign key-value pairs of metadata to AWS resources	configuration-manager*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from the specified resource	configuration-manager*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateConfigurationDefinition	Grants permission to update a Quick Setup configuration definition	configuration-manager*	aws:ResourceTag/${TagKey}	Write
UpdateConfigurationManager	Grants permission to update a Quick Setup configuration manager	configuration-manager*	aws:ResourceTag/${TagKey}	Write
UpdateServiceSettings	Grants permission to update settings configured for Quick Setup			Write

Resource types defined by AWS Systems Manager Quick Setup

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
configuration-manager	arn:${Partition}:ssm-quicksetup:${Region}:${Account}:configuration-manager/${ConfigurationManagerId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Systems Manager Quick Setup

AWS Systems Manager Quick Setup defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Systems Manager Incident Manager Contacts (ssm-contacts)

AWS Tax Settings (tax)