Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Managed Service for Prometheus

Amazon Managed Service for Prometheus (service prefix: aps) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Managed Service for Prometheus
Actions defined by Amazon Managed Service for Prometheus
Resource types defined by Amazon Managed Service for Prometheus
Condition keys for Amazon Managed Service for Prometheus

API operations defined by Amazon Managed Service for Prometheus

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateAlertManagerDefinition	aps:CreateAlertManagerDefinition			Write
CreateAnomalyDetector	aps:CreateAnomalyDetector			Write
CreateAnomalyDetector	aps:TagResource			Tagging, Write
CreateLoggingConfiguration	aps:CreateLoggingConfiguration			Write
CreateQueryLoggingConfiguration	aps:CreateQueryLoggingConfiguration			Write
CreateRuleGroupsNamespace	aps:CreateRuleGroupsNamespace			Write
CreateRuleGroupsNamespace	aps:TagResource			Tagging, Write
CreateScraper	aps:CreateScraper			Write
	aps:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	aps.amazonaws.com	Write
CreateWorkspace	aps:CreateWorkspace			Write
CreateWorkspace	aps:TagResource			Tagging, Write
DeleteAlertManagerDefinition	aps:DeleteAlertManagerDefinition			Write
DeleteAnomalyDetector	aps:DeleteAnomalyDetector			Write
DeleteLoggingConfiguration	aps:DeleteLoggingConfiguration			Write
DeleteQueryLoggingConfiguration	aps:DeleteQueryLoggingConfiguration			Write
DeleteResourcePolicy	aps:DeleteResourcePolicy			Write
DeleteRuleGroupsNamespace	aps:DeleteRuleGroupsNamespace			Write
DeleteScraper	aps:DeleteScraper			Write
DeleteScraperLoggingConfiguration	aps:DeleteScraperLoggingConfiguration			Write
DeleteWorkspace	aps:DeleteWorkspace			Write
DescribeAlertManagerDefinition	aps:DescribeAlertManagerDefinition			Read
DescribeAnomalyDetector	aps:DescribeAnomalyDetector			Read
DescribeLoggingConfiguration	aps:DescribeLoggingConfiguration			Read
DescribeQueryLoggingConfiguration	aps:DescribeQueryLoggingConfiguration			Read
DescribeResourcePolicy	aps:DescribeResourcePolicy			Read
DescribeRuleGroupsNamespace	aps:DescribeRuleGroupsNamespace			Read
DescribeScraper	aps:DescribeScraper			Read
DescribeScraperLoggingConfiguration	aps:DescribeScraperLoggingConfiguration			Read
DescribeWorkspace	aps:DescribeWorkspace			Read
DescribeWorkspaceConfiguration	aps:DescribeWorkspaceConfiguration			Read
GetDefaultScraperConfiguration	aps:GetDefaultScraperConfiguration			Read
ListAnomalyDetectors	aps:ListAnomalyDetectors			List
ListRuleGroupsNamespaces	aps:ListRuleGroupsNamespaces			List
ListScrapers	aps:ListScrapers			List
ListTagsForResource	aps:ListTagsForResource			Read
ListWorkspaces	aps:ListWorkspaces			List
PutAlertManagerDefinition	aps:PutAlertManagerDefinition			Write
PutAnomalyDetector	aps:PutAnomalyDetector			Write
PutResourcePolicy	aps:PutResourcePolicy			Write
PutRuleGroupsNamespace	aps:PutRuleGroupsNamespace			Write
TagResource	aps:TagResource			Tagging, Write
UntagResource	aps:UntagResource			Tagging, Write
UpdateLoggingConfiguration	aps:UpdateLoggingConfiguration			Write
UpdateQueryLoggingConfiguration	aps:UpdateQueryLoggingConfiguration			Write
UpdateScraper	aps:UpdateScraper			Write
UpdateScraper	iam:PassRole	iam:PassedToService	aps.amazonaws.com	Write
UpdateScraperLoggingConfiguration	aps:UpdateScraperLoggingConfiguration			Write
UpdateWorkspaceAlias	aps:UpdateWorkspaceAlias			Write
UpdateWorkspaceConfiguration	aps:UpdateWorkspaceConfiguration			Write

Actions defined by Amazon Managed Service for Prometheus

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateAlertManagerAlerts	Grants permission to create alerts	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAlertManagerDefinition	Grants permission to create an alert manager definition	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAnomalyDetector	Grants permission to create an anomaly detector	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateLoggingConfiguration	Grants permission to create a logging configuration	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateQueryLoggingConfiguration	Grants permission to create a query logging configuration	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRuleGroupsNamespace	Grants permission to create a rule groups namespace	rulegroupsnamespace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateScraper	Grants permission to create a scraper	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateScraper	Grants permission to create a scraper	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateWorkspace	Grants permission to create a workspace		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteAlertManagerDefinition	Grants permission to delete an alert manager definition	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAlertManagerSilence	Grants permission to delete a silence	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAnomalyDetector	Grants permission to delete an anomaly detector	anomalydetector*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAnomalyDetector	Grants permission to delete an anomaly detector	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteLoggingConfiguration	Grants permission to delete a logging configuration	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteQueryLoggingConfiguration	Grants permission to delete a query logging configuration	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteResourcePolicy	Grants permission to delete workspace resource policy	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteRuleGroupsNamespace	Grants permission to delete a rule groups namespace	rulegroupsnamespace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteScraper	Grants permission to delete a scraper	scraper*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteScraperLoggingConfiguration	Grants permission to delete a scraper logging configuration	scraper*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteWorkspace	Grants permission to delete a workspace	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DescribeAlertManagerDefinition	Grants permission to describe an alert manager definition	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
DescribeAnomalyDetector	Grants permission to describe an anomaly detector	anomalydetector*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
DescribeAnomalyDetector	Grants permission to describe an anomaly detector	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
DescribeLoggingConfiguration	Grants permission to describe a logging configuration	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
DescribeQueryLoggingConfiguration	Grants permission to describe a query logging configuration	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
DescribeResourcePolicy	Grants permission to describe workspace resource policy	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
DescribeRuleGroupsNamespace	Grants permission to describe a rule groups namespace	rulegroupsnamespace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
DescribeScraper	Grants permission to describe a scraper	scraper*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
DescribeScraperLoggingConfiguration	Grants permission to describe a scraper logging configuration	scraper*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
DescribeWorkspace	Grants permission to describe a workspace	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
DescribeWorkspaceConfiguration	Grants permission to describe workspace configuration	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
GetAlertManagerSilence	Grants permission to get a silence	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
GetAlertManagerStatus	Grants permission to get current status of an alertmanager	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
GetDefaultScraperConfiguration	Grants permission to get default scraper configuration			Read
GetLabels	Grants permission to retrieve AMP workspace labels	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
GetMetricMetadata	Grants permission to retrieve the metadata for AMP workspace metrics	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
GetSeries	Grants permission to retrieve AMP workspace time series data	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
ListAlertManagerAlertGroups	Grants permission to list groups	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
ListAlertManagerAlerts	Grants permission to list alerts	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
ListAlertManagerReceivers	Grants permission to list receivers	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
ListAlertManagerSilences	Grants permission to list silences	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
ListAlerts	Grants permission to list active alerts	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
ListAnomalyDetectors	Grants permission to list anomaly detectors	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	List
ListRuleGroupsNamespaces	Grants permission to list rule groups namespaces	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	List
ListRules	Grants permission to list alerting and recording rules	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
ListScrapers	Grants permission to list scrapers			List
ListTagsForResource	Grants permission to list tags on an AMP resource	anomalydetector	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
		rulegroupsnamespace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		scraper	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workspace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
ListWorkspaces	Grants permission to list workspaces			List
PreviewAnomalyDetector	Grants permission to preview anomaly detection on AMP workspace metrics	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
PutAlertManagerDefinition	Grants permission to update an alert manager definition	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutAlertManagerSilences	Grants permission to create or update a silence	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutAnomalyDetector	Grants permission to update an anomaly detector	anomalydetector*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutAnomalyDetector	Grants permission to update an anomaly detector	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutResourcePolicy	Grants permission to create and update workspace resource policy	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutRuleGroupsNamespace	Grants permission to update a rule groups namespace	rulegroupsnamespace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
QueryMetrics	Grants permission to run a query on AMP workspace metrics	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
RemoteWrite	Grants permission to perform a remote write operation to initiate the streaming of metrics to AMP workspace	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
TagResource	Grants permission to tag an AMP resource	anomalydetector	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		rulegroupsnamespace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		scraper	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workspace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag an AMP resource	anomalydetector	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		rulegroupsnamespace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		scraper	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workspace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UpdateLoggingConfiguration	Grants permission to update a logging configuration	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateQueryLoggingConfiguration	Grants permission to update a query logging configuration	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateScraper	Grants permission to update a scraper	scraper*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateScraper	Grants permission to update a scraper	workspace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateScraperLoggingConfiguration	Grants permission to put a scraper logging configuration	scraper*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateWorkspaceAlias	Grants permission to modify the alias of existing AMP workspace	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateWorkspaceConfiguration	Grants permission to update workspace configuration	workspace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write

Resource types defined by Amazon Managed Service for Prometheus

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
anomalydetector	arn:${Partition}:aps:${Region}:${Account}:anomalydetector/${WorkspaceId}/${AnomalyDetectorId}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
cluster	arn:${Partition}:eks:${Region}:${Account}:cluster/${ClusterName}	aws:ResourceTag/${TagKey}
rulegroupsnamespace	arn:${Partition}:aps:${Region}:${Account}:rulegroupsnamespace/${WorkspaceId}/${Namespace}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
scraper	arn:${Partition}:aps:${Region}:${Account}:scraper/${ScraperId}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
workspace	arn:${Partition}:aps:${Region}:${Account}:workspace/${WorkspaceId}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys

Condition keys for Amazon Managed Service for Prometheus

Amazon Managed Service for Prometheus defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access based on the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access based on the tags associated with the resource	String
aws:TagKeys	Filters access based on the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Managed Grafana (grafana)

Amazon Managed Streaming for Apache Kafka (kafka)