Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Connect Customer Profiles

Amazon Connect Customer Profiles (service prefix: profile) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Connect Customer Profiles
Actions defined by Amazon Connect Customer Profiles
Permission-only actions for Amazon Connect Customer Profiles
Resource types defined by Amazon Connect Customer Profiles
Condition keys for Amazon Connect Customer Profiles

API operations defined by Amazon Connect Customer Profiles

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AddProfileKey	profile:AddProfileKey			Write
BatchGetCalculatedAttributeForProfile	profile:BatchGetCalculatedAttributeForProfile			Read
BatchGetProfile	profile:BatchGetProfile			Read
CreateCalculatedAttributeDefinition	profile:CreateCalculatedAttributeDefinition			Write
CreateCalculatedAttributeDefinition	profile:TagResource			Tagging, Write
CreateDomain	profile:CreateDomain			Write
CreateDomain	profile:TagResource			Tagging, Write
CreateDomainLayout	profile:CreateDomainLayout			Write
CreateDomainLayout	profile:TagResource			Tagging, Write
CreateEventStream	profile:CreateEventStream			Write
CreateEventStream	profile:TagResource			Tagging, Write
CreateEventTrigger	profile:CreateEventTrigger			Write
CreateEventTrigger	profile:TagResource			Tagging, Write
CreateIntegrationWorkflow	profile:CreateIntegrationWorkflow			Write
CreateIntegrationWorkflow	iam:PassRole	iam:PassedToService	profile.amazonaws.com	Write
CreateProfile	profile:CreateProfile			Write
CreateRecommender	profile:CreateRecommender			Write
CreateRecommenderFilter	profile:CreateRecommenderFilter			Write
CreateRecommenderFilter	profile:TagResource			Tagging, Write
CreateRecommenderSchema	profile:CreateRecommenderSchema			Write
CreateSegmentDefinition	profile:CreateSegmentDefinition			Write
CreateSegmentDefinition	profile:TagResource			Tagging, Write
CreateSegmentEstimate	profile:CreateSegmentEstimate			Write
CreateSegmentSnapshot	profile:CreateSegmentSnapshot			Write
CreateSegmentSnapshot	iam:PassRole	iam:PassedToService	profile.amazonaws.com	Write
CreateUploadJob	profile:CreateUploadJob			Write
DeleteCalculatedAttributeDefinition	profile:DeleteCalculatedAttributeDefinition			Write
DeleteDomain	profile:DeleteDomain			Write
DeleteDomainLayout	profile:DeleteDomainLayout			Write
DeleteDomainObjectType	profile:DeleteDomainObjectType			Write
DeleteEventStream	profile:DeleteEventStream			Write
DeleteEventTrigger	profile:DeleteEventTrigger			Write
DeleteIntegration	profile:DeleteIntegration			Write
DeleteProfile	profile:DeleteProfile			Write
DeleteProfileKey	profile:DeleteProfileKey			Write
DeleteProfileObject	profile:DeleteProfileObject			Write
DeleteProfileObjectType	profile:DeleteProfileObjectType			Write
DeleteRecommender	profile:DeleteRecommender			Write
DeleteRecommenderFilter	profile:DeleteRecommenderFilter			Write
DeleteRecommenderSchema	profile:DeleteRecommenderSchema			Write
DeleteSegmentDefinition	profile:DeleteSegmentDefinition			Write
DeleteWorkflow	profile:DeleteWorkflow			Write
DetectProfileObjectType	profile:DetectProfileObjectType			Read
GetAutoMergingPreview	profile:GetAutoMergingPreview			Read
GetCalculatedAttributeDefinition	profile:GetCalculatedAttributeDefinition			Read
GetCalculatedAttributeForProfile	profile:GetCalculatedAttributeForProfile			Read
GetDomain	profile:GetDomain			Read
GetDomainLayout	profile:GetDomainLayout			Read
GetDomainObjectType	profile:GetDomainObjectType			Read
GetEventStream	profile:GetEventStream			Read
GetEventTrigger	profile:GetEventTrigger			Read
GetIdentityResolutionJob	profile:GetIdentityResolutionJob			Read
GetIntegration	profile:GetIntegration			Read
GetMatches	profile:GetMatches			List
GetObjectTypeAttributeStatistics	profile:GetObjectTypeAttributeStatistics			Read
GetProfileHistoryRecord	profile:GetProfileHistoryRecord			Read
GetProfileObjectType	profile:GetProfileObjectType			Read
GetProfileObjectTypeTemplate	profile:GetProfileObjectTypeTemplate			Read
GetProfileRecommendations	profile:GetProfileRecommendations			Read
GetRecommender	profile:GetRecommender			Read
GetRecommenderFilter	profile:GetRecommenderFilter			Read
GetRecommenderSchema	profile:GetRecommenderSchema			Read
GetSegmentDefinition	profile:GetSegmentDefinition			Read
GetSegmentEstimate	profile:GetSegmentEstimate			Read
GetSegmentMembership	profile:GetSegmentMembership			Read
GetSegmentSnapshot	profile:GetSegmentSnapshot			Read
GetSimilarProfiles	profile:GetSimilarProfiles			List
GetUploadJob	profile:GetUploadJob			Read
GetUploadJobPath	profile:GetUploadJobPath			Read
GetWorkflow	profile:GetWorkflow			Read
GetWorkflowSteps	profile:GetWorkflowSteps			Read
ListAccountIntegrations	profile:ListAccountIntegrations			List
ListCalculatedAttributeDefinitions	profile:ListCalculatedAttributeDefinitions			List
ListCalculatedAttributesForProfile	profile:ListCalculatedAttributesForProfile			List
ListDomainLayouts	profile:ListDomainLayouts			List
ListDomainObjectTypes	profile:ListDomainObjectTypes			List
ListDomains	profile:ListDomains			List
ListEventStreams	profile:ListEventStreams			List
ListEventTriggers	profile:ListEventTriggers			List
ListIdentityResolutionJobs	profile:ListIdentityResolutionJobs			List
ListIntegrations	profile:ListIntegrations			List
ListObjectTypeAttributeValues	profile:ListObjectTypeAttributeValues			List
ListObjectTypeAttributes	profile:ListObjectTypeAttributes			List
ListProfileAttributeValues	profile:ListProfileAttributeValues			List
ListProfileHistoryRecords	profile:ListProfileHistoryRecords			List
ListProfileObjectTypeTemplates	profile:ListProfileObjectTypeTemplates			List
ListProfileObjectTypes	profile:ListProfileObjectTypes			List
ListProfileObjects	profile:ListProfileObjects			List
ListRecommenderFilters	profile:ListRecommenderFilters			List
ListRecommenderRecipes	profile:ListRecommenderRecipes			List
ListRecommenderSchemas	profile:ListRecommenderSchemas			List
ListRecommenders	profile:ListRecommenders			List
ListRuleBasedMatches	profile:ListRuleBasedMatches			List
ListSegmentDefinitions	profile:ListSegmentDefinitions			List
ListTagsForResource	profile:ListTagsForResource			Read
ListUploadJobs	profile:ListUploadJobs			List
ListWorkflows	profile:ListWorkflows			List
MergeProfiles	profile:MergeProfiles			Write
PutDomainObjectType	profile:PutDomainObjectType			Write
PutDomainObjectType	profile:TagResource			Tagging, Write
PutIntegration	profile:PutIntegration			Write
PutIntegration	profile:TagResource			Tagging, Write
PutProfileObject	profile:PutProfileObject			Write
PutProfileObjectType	profile:PutProfileObjectType			Write
PutProfileObjectType	profile:TagResource			Tagging, Write
SearchProfiles	profile:SearchProfiles			Read
StartRecommender	profile:StartRecommender			Write
StartUploadJob	profile:StartUploadJob			Write
StopRecommender	profile:StopRecommender			Write
StopUploadJob	profile:StopUploadJob			Write
TagResource	profile:TagResource			Tagging, Write
UntagResource	profile:UntagResource			Tagging, Write
UpdateCalculatedAttributeDefinition	profile:UpdateCalculatedAttributeDefinition			Write
UpdateDomain	profile:UpdateDomain			Write
UpdateDomainLayout	profile:UpdateDomainLayout			Write
UpdateEventTrigger	profile:UpdateEventTrigger			Write
UpdateProfile	profile:UpdateProfile			Write
UpdateRecommender	profile:UpdateRecommender			Write

Actions defined by Amazon Connect Customer Profiles

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddProfileKey	Grants permission to add a profile key	domains*	aws:ResourceTag/${TagKey}	Write
BatchGetCalculatedAttributeForProfile	Grants permission to retrieve a calculated attribute for the specific profiles in the domain	calculated-attributes*	aws:ResourceTag/${TagKey}	Read
BatchGetCalculatedAttributeForProfile		domains*	aws:ResourceTag/${TagKey}	Read
BatchGetProfile	Grants permission to get profiles in the domain	domains*	aws:ResourceTag/${TagKey}	Read
CreateCalculatedAttributeDefinition	Grants permission to create a calculated attribute definition in the domain	calculated-attributes*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCalculatedAttributeDefinition		domains*	aws:ResourceTag/${TagKey}	Write
CreateDomain	Grants permission to create a Domain	domains*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDomainLayout	Grants permission to create a layout in the domain	domains*	aws:ResourceTag/${TagKey}	Write
CreateDomainLayout	Grants permission to create a layout in the domain	layouts*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateEventStream	Grants permission to put an event stream in a domain	domains*	aws:ResourceTag/${TagKey}	Write
CreateEventStream	Grants permission to put an event stream in a domain	event-streams*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateEventTrigger	Grants permission to create an event trigger in the domain	domains*	aws:ResourceTag/${TagKey}	Write
CreateEventTrigger	Grants permission to create an event trigger in the domain	event-triggers*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateIntegrationWorkflow	Grants permission to create an integration workflow in a domain	domains*	aws:ResourceTag/${TagKey}	Write
CreateIntegrationWorkflow		integrations*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateProfile	Grants permission to create a profile in the domain	domains*	aws:ResourceTag/${TagKey}	Write
CreateRecommender	Grants permission to create a Recommender in the domain	domains*	aws:ResourceTag/${TagKey}	Write
CreateRecommender	Grants permission to create a Recommender in the domain	recommenders*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRecommenderFilter	Grants permission to create a recommender filter in the domain	domains*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRecommenderFilter		recommender-filters*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRecommenderSchema	Grants permission to create a recommender schema in the domain	domains*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRecommenderSchema		recommender-schemas*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSegmentDefinition	Grants permission to create a segment definition in the domain	domains*	aws:ResourceTag/${TagKey}	Write
CreateSegmentDefinition		segment-definitions*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSegmentEstimate	Grants permission to create a segment estimate in the domain	domains*	aws:ResourceTag/${TagKey}	Write
CreateSegmentSnapshot	Grants permission to create a segment snapshot in the domain	domains*	aws:ResourceTag/${TagKey}	Write
CreateSegmentSnapshot		segment-definitions*	aws:ResourceTag/${TagKey}	Write
CreateUploadJob	Grants permission to create an upload job in the domain	domains*	aws:ResourceTag/${TagKey}	Write
DeleteCalculatedAttributeDefinition	Grants permission to delete a calculated attribute definition in the domain	calculated-attributes*	aws:ResourceTag/${TagKey}	Write
DeleteCalculatedAttributeDefinition		domains*	aws:ResourceTag/${TagKey}	Write
DeleteDomain	Grants permission to delete a Domain	domains*	aws:ResourceTag/${TagKey}	Write
DeleteDomainLayout	Grants permission to delete a layout in the domain	domains*	aws:ResourceTag/${TagKey}	Write
DeleteDomainLayout	Grants permission to delete a layout in the domain	layouts*	aws:ResourceTag/${TagKey}	Write
DeleteDomainObjectType	Grants permission to delete a specific domain object type in the domain	domain-object-types*	aws:ResourceTag/${TagKey}	Write
DeleteDomainObjectType		domains*	aws:ResourceTag/${TagKey}	Write
DeleteEventStream	Grants permission to delete an event stream in a domain	domains*	aws:ResourceTag/${TagKey}	Write
DeleteEventStream	Grants permission to delete an event stream in a domain	event-streams*	aws:ResourceTag/${TagKey}	Write
DeleteEventTrigger	Grants permission to delete an event trigger in the domain	domains*	aws:ResourceTag/${TagKey}	Write
DeleteEventTrigger	Grants permission to delete an event trigger in the domain	event-triggers*	aws:ResourceTag/${TagKey}	Write
DeleteIntegration	Grants permission to delete a integration in a domain	domains*	aws:ResourceTag/${TagKey}	Write
DeleteIntegration	Grants permission to delete a integration in a domain	integrations*	aws:ResourceTag/${TagKey}	Write
DeleteProfile	Grants permission to delete a profile	domains*	aws:ResourceTag/${TagKey}	Write
DeleteProfileKey	Grants permission to delete a profile key	domains*	aws:ResourceTag/${TagKey}	Write
DeleteProfileObject	Grants permission to delete a profile object	domains*	aws:ResourceTag/${TagKey}	Write
DeleteProfileObject	Grants permission to delete a profile object	object-types*	aws:ResourceTag/${TagKey}	Write
DeleteProfileObjectType	Grants permission to delete a specific profile object type in the domain	domains*	aws:ResourceTag/${TagKey}	Write
DeleteProfileObjectType		object-types*	aws:ResourceTag/${TagKey}	Write
DeleteRecommender	Grants permission to delete a recommender in a domain	domains*	aws:ResourceTag/${TagKey}	Write
DeleteRecommender	Grants permission to delete a recommender in a domain	recommenders*	aws:ResourceTag/${TagKey}	Write
DeleteRecommenderFilter	Grants permission to delete a recommender filter in the domain	domains*	aws:ResourceTag/${TagKey}	Write
DeleteRecommenderFilter		recommender-filters*	aws:ResourceTag/${TagKey}	Write
DeleteRecommenderSchema	Grants permission to delete a recommender schema in the domain	domains*	aws:ResourceTag/${TagKey}	Write
DeleteRecommenderSchema		recommender-schemas*	aws:ResourceTag/${TagKey}	Write
DeleteSegmentDefinition	Grants permission to delete a segment definition in the domain	domains*	aws:ResourceTag/${TagKey}	Write
DeleteSegmentDefinition		segment-definitions*	aws:ResourceTag/${TagKey}	Write
DeleteWorkflow	Grants permission to delete a workflow in a domain	domains*	aws:ResourceTag/${TagKey}	Write
DetectProfileObjectType	Grants permission to auto detect object type	domains*	aws:ResourceTag/${TagKey}	Read
GetAutoMergingPreview	Grants permission to get a preview of auto merging in a domain	domains*	aws:ResourceTag/${TagKey}	Read
GetCalculatedAttributeDefinition	Grants permission to get a calculated attribute definition in the domain	calculated-attributes*	aws:ResourceTag/${TagKey}	Read
GetCalculatedAttributeDefinition		domains*	aws:ResourceTag/${TagKey}	Read
GetCalculatedAttributeForProfile	Grants permission to retrieve a calculated attribute for a specific profile in the domain	calculated-attributes*	aws:ResourceTag/${TagKey}	Read
GetCalculatedAttributeForProfile		domains*	aws:ResourceTag/${TagKey}	Read
GetDomain	Grants permission to get a specific domain in an account	domains*	aws:ResourceTag/${TagKey}	Read
GetDomainLayout	Grants permission to get a layout in the domain	domains*	aws:ResourceTag/${TagKey}	Read
GetDomainLayout	Grants permission to get a layout in the domain	layouts*	aws:ResourceTag/${TagKey}	Read
GetDomainObjectType	Grants permission to get a specific domain object type in the domain	domain-object-types*	aws:ResourceTag/${TagKey}	Read
GetDomainObjectType		domains*	aws:ResourceTag/${TagKey}	Read
GetEventStream	Grants permission to get a specific event stream in a domain	domains*	aws:ResourceTag/${TagKey}	Read
GetEventStream		event-streams*	aws:ResourceTag/${TagKey}	Read
GetEventTrigger	Grants permission to get an event trigger in the domain	domains*	aws:ResourceTag/${TagKey}	Read
GetEventTrigger	Grants permission to get an event trigger in the domain	event-triggers*	aws:ResourceTag/${TagKey}	Read
GetIdentityResolutionJob	Grants permission to get an identity resolution job in a domain	domains*	aws:ResourceTag/${TagKey}	Read
GetIntegration	Grants permission to get a specific integrations in a domain	domains*	aws:ResourceTag/${TagKey}	Read
GetIntegration		integrations*	aws:ResourceTag/${TagKey}	Read
GetMatches	Grants permission to get profile matches in a domain	domains*	aws:ResourceTag/${TagKey}	List
GetObjectTypeAttributeStatistics	Grants permission to get statistics of a specific attribute for object type in the domain	domains*	aws:ResourceTag/${TagKey}	Read
GetObjectTypeAttributeStatistics		object-types*	aws:ResourceTag/${TagKey}	Read
GetProfileHistoryRecord	Grants permission to get a profile history record for a profile in a domain	domains*	aws:ResourceTag/${TagKey}	Read
GetProfileInsights	Grants permission to list insights for a profile	domains*	aws:ResourceTag/${TagKey}	Read
GetProfileObjectType	Grants permission to get a specific profile object type in the domain	domains*	aws:ResourceTag/${TagKey}	Read
GetProfileObjectType		object-types*	aws:ResourceTag/${TagKey}	Read
GetProfileObjectTypeTemplate	Grants permission to get a specific object type template			Read
GetProfileRecommendations	Grants permission to list recommendations for a profile	domains*	aws:ResourceTag/${TagKey}	Read
GetProfileRecommendations	Grants permission to list recommendations for a profile	recommenders*	aws:ResourceTag/${TagKey}	Read
GetRecommender	Grants permission to get Recommender details in a domain	domains*	aws:ResourceTag/${TagKey}	Read
GetRecommender	Grants permission to get Recommender details in a domain	recommenders*	aws:ResourceTag/${TagKey}	Read
GetRecommenderFilter	Grants permission to get recommender filter details in the domain	domains*	aws:ResourceTag/${TagKey}	Read
GetRecommenderFilter		recommender-filters*	aws:ResourceTag/${TagKey}	Read
GetRecommenderSchema	Grants permission to get recommender schema details in the domain	domains*	aws:ResourceTag/${TagKey}	Read
GetRecommenderSchema		recommender-schemas*	aws:ResourceTag/${TagKey}	Read
GetSegmentDefinition	Grants permission to get a segment definition in the domain	domains*	aws:ResourceTag/${TagKey}	Read
GetSegmentDefinition	Grants permission to get a segment definition in the domain	segment-definitions*	aws:ResourceTag/${TagKey}	Read
GetSegmentEstimate	Grants permission to get a segment estimate in the domain	domains*	aws:ResourceTag/${TagKey}	Read
GetSegmentMembership	Grants permission to determine if the given profiles are part of a segment in the domain	domains*	aws:ResourceTag/${TagKey}	Read
GetSegmentMembership		segment-definitions*	aws:ResourceTag/${TagKey}	Read
GetSegmentSnapshot	Grants permission to get a segment snapshot in the domain	domains*	aws:ResourceTag/${TagKey}	Read
GetSegmentSnapshot	Grants permission to get a segment snapshot in the domain	segment-definitions*	aws:ResourceTag/${TagKey}	Read
GetSimilarProfiles	Grants permission to get all the similar profiles in the domain	domains*	aws:ResourceTag/${TagKey}	List
GetUploadJob	Grants permission to get details of an upload job in the domain	domains*	aws:ResourceTag/${TagKey}	Read
GetUploadJobPath	Grants permission to get a pre-signed URL to upload file for an upload job	domains*	aws:ResourceTag/${TagKey}	Read
GetWorkflow	Grants permission to get workflow details in a domain	domains*	aws:ResourceTag/${TagKey}	Read
GetWorkflowSteps	Grants permission to get workflow step details in a domain	domains*	aws:ResourceTag/${TagKey}	Read
ListAccountIntegrations	Grants permission to list all the integrations in the account			List
ListCalculatedAttributeDefinitions	Grants permission to list all the calculated attribute definitions in the domain	domains*	aws:ResourceTag/${TagKey}	List
ListCalculatedAttributesForProfile	Grants permission to list all calculated attributes for a specific profile in the domain	domains*	aws:ResourceTag/${TagKey}	List
ListDomainLayouts	Grants permission to list all the layouts in the domain	domains*	aws:ResourceTag/${TagKey}	List
ListDomainObjectTypes	Grants permission to list all the domain object types in the domain	domains*	aws:ResourceTag/${TagKey}	List
ListDomainObjects	Grants permission to list domain objects in a domain	domain-object-types*	aws:ResourceTag/${TagKey}	List
ListDomainObjects	Grants permission to list domain objects in a domain	domains*	aws:ResourceTag/${TagKey}	List
ListDomains	Grants permission to list all the domains in an account			List
ListEventStreams	Grants permission to list all the event streams in a specific domain	domains*	aws:ResourceTag/${TagKey}	List
ListEventTriggers	Grants permission to list all the event triggers in the domain	domains*	aws:ResourceTag/${TagKey}	List
ListIdentityResolutionJobs	Grants permission to list identity resolution jobs in a domain	domains*	aws:ResourceTag/${TagKey}	List
ListIntegrations	Grants permission to list all the integrations in a specific domain	domains*	aws:ResourceTag/${TagKey}	List
ListObjectTypeAttributeValues	Grants permission to list values of a specific attribute for object type in the domain	domains*	aws:ResourceTag/${TagKey}	List
ListObjectTypeAttributeValues		object-types*	aws:ResourceTag/${TagKey}	List
ListObjectTypeAttributes	Grants permission to list all the attributes of a specific object type in the domain	domains*	aws:ResourceTag/${TagKey}	List
ListObjectTypeAttributes		object-types*	aws:ResourceTag/${TagKey}	List
ListProfileAttributeValues	Grants permission to list all the values of a profile attribute in the domain	domains*	aws:ResourceTag/${TagKey}	List
ListProfileHistoryRecords	Grants permission to list all the profile history records for a profile in a domain	domains*	aws:ResourceTag/${TagKey}	List
ListProfileObjectTypeTemplates	Grants permission to list all the profile object type templates in the account			List
ListProfileObjectTypes	Grants permission to list all the profile object types in the domain	domains*	aws:ResourceTag/${TagKey}	List
ListProfileObjects	Grants permission to list all the profile objects for a profile	domains*	aws:ResourceTag/${TagKey}	List
ListProfileObjects		object-types*	aws:ResourceTag/${TagKey}	List
ListRecommenderFilters	Grants permission to list all recommender filters in the domain	domains*	aws:ResourceTag/${TagKey}	List
ListRecommenderRecipes	Grants permission to list all the Recommenders Recipes in the domain			List
ListRecommenderSchemas	Grants permission to list all recommender schemas in the domain	domains*	aws:ResourceTag/${TagKey}	List
ListRecommenders	Grants permission to list all the Recommenders in the domain	domains*	aws:ResourceTag/${TagKey}	List
ListRuleBasedMatches	Grants permission to list all the rule-based matching result in the domain	domains*	aws:ResourceTag/${TagKey}	List
ListSegmentDefinitions	Grants permission to list all the segment definitions in the domain	domains*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags for a resource	calculated-attributes	aws:ResourceTag/${TagKey}	Read
		domain-object-types	aws:ResourceTag/${TagKey}
		domains	aws:ResourceTag/${TagKey}
		event-streams	aws:ResourceTag/${TagKey}
		event-triggers	aws:ResourceTag/${TagKey}
		integrations	aws:ResourceTag/${TagKey}
		layouts	aws:ResourceTag/${TagKey}
		object-types	aws:ResourceTag/${TagKey}
		recommender-filters	aws:ResourceTag/${TagKey}
		recommender-schemas	aws:ResourceTag/${TagKey}
		recommenders	aws:ResourceTag/${TagKey}
		segment-definitions	aws:ResourceTag/${TagKey}
ListUploadJobs	Grants permission to list all upload jobs in the domain	domains*	aws:ResourceTag/${TagKey}	List
ListWorkflows	Grants permission to list all the workflows in a specific domain	domains*	aws:ResourceTag/${TagKey}	List
MergeProfiles	Grants permission to merge profiles in a domain	domains*	aws:ResourceTag/${TagKey}	Write
PutDomainObjectType	Grants permission to put a specific domain object type in the domain	domain-object-types*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutDomainObjectType		domains*	aws:ResourceTag/${TagKey}	Write
PutIntegration	Grants permission to put a integration in a domain	domains*	aws:ResourceTag/${TagKey}	Write
PutIntegration	Grants permission to put a integration in a domain	integrations*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutProfileObject	Grants permission to put an object for a profile	domains*	aws:ResourceTag/${TagKey}	Write
PutProfileObject	Grants permission to put an object for a profile	object-types*	aws:ResourceTag/${TagKey}	Write
PutProfileObjectType	Grants permission to put a specific profile object type in the domain	domains*	aws:ResourceTag/${TagKey}	Write
PutProfileObjectType		object-types*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
SearchProfiles	Grants permission to search for profiles in a domain	domains*	aws:ResourceTag/${TagKey}	Read
StartRecommender	Grants permission to start a recommender in a domain	domains*	aws:ResourceTag/${TagKey}	Write
StartRecommender	Grants permission to start a recommender in a domain	recommenders*	aws:ResourceTag/${TagKey}	Write
StartUploadJob	Grants permission to start an upload job in the domain	domains*	aws:ResourceTag/${TagKey}	Write
StopRecommender	Grants permission to stop a recommender in a domain	domains*	aws:ResourceTag/${TagKey}	Write
StopRecommender	Grants permission to stop a recommender in a domain	recommenders*	aws:ResourceTag/${TagKey}	Write
StopUploadJob	Grants permission to stop an upload job in the domain	domains*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to adds tags to a resource	calculated-attributes	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		domain-object-types	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		domains	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		event-streams	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		event-triggers	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		integrations	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		layouts	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		object-types	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		recommender-filters	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		recommender-schemas	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		recommenders	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		segment-definitions	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from a resource	calculated-attributes	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		domain-object-types	aws:ResourceTag/${TagKey} aws:TagKeys
		domains	aws:ResourceTag/${TagKey} aws:TagKeys
		event-streams	aws:ResourceTag/${TagKey} aws:TagKeys
		event-triggers	aws:ResourceTag/${TagKey} aws:TagKeys
		integrations	aws:ResourceTag/${TagKey} aws:TagKeys
		layouts	aws:ResourceTag/${TagKey} aws:TagKeys
		object-types	aws:ResourceTag/${TagKey} aws:TagKeys
		recommender-filters	aws:ResourceTag/${TagKey} aws:TagKeys
		recommender-schemas	aws:ResourceTag/${TagKey} aws:TagKeys
		recommenders	aws:ResourceTag/${TagKey} aws:TagKeys
		segment-definitions	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateCalculatedAttributeDefinition	Grants permission to update a calculated attribute definition in the domain	calculated-attributes*	aws:ResourceTag/${TagKey}	Write
UpdateCalculatedAttributeDefinition		domains*	aws:ResourceTag/${TagKey}	Write
UpdateDomain	Grants permission to update a Domain	domains*	aws:ResourceTag/${TagKey}	Write
UpdateDomainLayout	Grants permission to update a layout in the domain	domains*	aws:ResourceTag/${TagKey}	Write
UpdateDomainLayout	Grants permission to update a layout in the domain	layouts*	aws:ResourceTag/${TagKey}	Write
UpdateEventTrigger	Grants permission to update an event trigger in the domain	domains*	aws:ResourceTag/${TagKey}	Write
UpdateEventTrigger	Grants permission to update an event trigger in the domain	event-triggers*	aws:ResourceTag/${TagKey}	Write
UpdateProfile	Grants permission to update a profile in the domain	domains*	aws:ResourceTag/${TagKey}	Write
UpdateRecommender	Grants permission to update a Recommender in the domain	domains*	aws:ResourceTag/${TagKey}	Write
UpdateRecommender	Grants permission to update a Recommender in the domain	recommenders*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon Connect Customer Profiles

The following actions are defined by Amazon Connect Customer Profiles but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateSnapshot	Grants permission to create a snapshot in the domain	domains*	aws:ResourceTag/${TagKey}	Write
GetSnapshot	Grants permission to get a snapshot in the domain	domains*	aws:ResourceTag/${TagKey}	Read

Resource types defined by Amazon Connect Customer Profiles

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
calculated-attributes	arn:${Partition}:profile:${Region}:${Account}:domains/${DomainName}/calculated-attributes/${CalculatedAttributeName}	aws:ResourceTag/${TagKey}
domain-object-types	arn:${Partition}:profile:${Region}:${Account}:domains/${DomainName}/domain-object-types/${ObjectTypeName}	aws:ResourceTag/${TagKey}
domains	arn:${Partition}:profile:${Region}:${Account}:domains/${DomainName}	aws:ResourceTag/${TagKey}
event-streams	arn:${Partition}:profile:${Region}:${Account}:domains/${DomainName}/event-streams/${EventStreamName}	aws:ResourceTag/${TagKey}
event-triggers	arn:${Partition}:profile:${Region}:${Account}:domains/${DomainName}/event-triggers/${EventTriggerName}	aws:ResourceTag/${TagKey}
integrations	arn:${Partition}:profile:${Region}:${Account}:domains/${DomainName}/integrations/${Uri}	aws:ResourceTag/${TagKey}
layouts	arn:${Partition}:profile:${Region}:${Account}:domains/${DomainName}/layouts/${LayoutDefinitionName}	aws:ResourceTag/${TagKey}
object-types	arn:${Partition}:profile:${Region}:${Account}:domains/${DomainName}/object-types/${ObjectTypeName}	aws:ResourceTag/${TagKey}
recommender-filters	arn:${Partition}:profile:${Region}:${Account}:domains/${DomainName}/recommender-filters/${RecommenderFilterName}	aws:ResourceTag/${TagKey}
recommender-schemas	arn:${Partition}:profile:${Region}:${Account}:domains/${DomainName}/recommender-schemas/${RecommenderSchemaName}	aws:ResourceTag/${TagKey}
recommenders	arn:${Partition}:profile:${Region}:${Account}:domains/${DomainName}/recommenders/${RecommenderTypeName}	aws:ResourceTag/${TagKey}
segment-definitions	arn:${Partition}:profile:${Region}:${Account}:domains/${DomainName}/segment-definitions/${SegmentDefinitionName}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Connect Customer Profiles

Amazon Connect Customer Profiles defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a key that is present in the request the user makes to the customer profile service	String
aws:ResourceTag/${TagKey}	Filters access by a tag key and value pair	String
aws:TagKeys	Filters access by the list of all the tag key names present in the request the user makes to the customer profile service	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Connect Cases (cases)

Amazon Connect Health (health-agent)