Actions, resources, and condition keys for Amazon CloudWatch Evidently

Amazon CloudWatch Evidently (service prefix: evidently) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

Actions defined by Amazon CloudWatch Evidently
Resource types defined by Amazon CloudWatch Evidently
Condition keys for Amazon CloudWatch Evidently

Actions defined by Amazon CloudWatch Evidently

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchEvaluateFeature	Grants permission to send a batched evaluate feature request	Feature*	aws:ResourceTag/${TagKey}	Write
CreateExperiment	Grants permission to create an experiment		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateFeature	Grants permission to create a feature		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLaunch	Grants permission to create a launch		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateProject	Grants permission to create a project		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateSegment	Grants permission to create a segment		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteExperiment	Grants permission to delete an experiment	Experiment*	aws:ResourceTag/${TagKey}	Write
DeleteFeature	Grants permission to delete a feature	Feature*	aws:ResourceTag/${TagKey}	Write
DeleteLaunch	Grants permission to delete a launch	Launch*	aws:ResourceTag/${TagKey}	Write
DeleteProject	Grants permission to delete a project	Project*	aws:ResourceTag/${TagKey}	Write
DeleteSegment	Grants permission to delete a segment	Segment*	aws:ResourceTag/${TagKey}	Write
EvaluateFeature	Grants permission to send an evaluate feature request	Feature*	aws:ResourceTag/${TagKey}	Write
GetExperiment	Grants permission to get experiment details	Experiment*	aws:ResourceTag/${TagKey}	Read
GetExperimentResults	Grants permission to get experiment result	Experiment*	aws:ResourceTag/${TagKey}	Read
GetFeature	Grants permission to get feature details	Feature*	aws:ResourceTag/${TagKey}	Read
GetLaunch	Grants permission to get launch details	Launch*	aws:ResourceTag/${TagKey}	Read
GetProject	Grants permission to get project details	Project*	aws:ResourceTag/${TagKey}	Read
GetSegment	Grants permission to get segment details	Segment*	aws:ResourceTag/${TagKey}	Read
ListExperiments	Grants permission to list experiments			Read
ListFeatures	Grants permission to list features			Read
ListLaunches	Grants permission to list launches			Read
ListProjects	Grants permission to list projects			Read
ListSegmentReferences	Grants permission to list resources referencing a segment			Read
ListSegments	Grants permission to list segments			Read
ListTagsForResource	Grants permission to list tags for resources			Read
PutProjectEvents	Grants permission to send performance events	Project*	aws:ResourceTag/${TagKey}	Write
StartExperiment	Grants permission to start an experiment	Experiment*	aws:ResourceTag/${TagKey}	Write
StartLaunch	Grants permission to start a launch	Launch*	aws:ResourceTag/${TagKey}	Write
StopExperiment	Grants permission to stop an experiment	Experiment*	aws:ResourceTag/${TagKey}	Write
StopLaunch	Grants permission to stop a launch	Launch*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag resources	Experiment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		Feature	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Launch	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Project	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Segment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
TestSegmentPattern	Grants permission to test a segment pattern			Read
UntagResource	Grants permission to untag resources	Experiment	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		Feature	aws:ResourceTag/${TagKey} aws:TagKeys
		Launch	aws:ResourceTag/${TagKey} aws:TagKeys
		Project	aws:ResourceTag/${TagKey} aws:TagKeys
		Segment	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateExperiment	Grants permission to update experiment	Experiment*	aws:ResourceTag/${TagKey}	Write
UpdateFeature	Grants permission to update feature	Feature*	aws:ResourceTag/${TagKey}	Write
UpdateLaunch	Grants permission to update a launch	Launch*	aws:ResourceTag/${TagKey}	Write
UpdateProject	Grants permission to update project	Project*	aws:ResourceTag/${TagKey}	Write
UpdateProjectDataDelivery	Grants permission to update project data delivery	Project*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon CloudWatch Evidently

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
Experiment	arn:${Partition}:evidently:${Region}:${Account}:project/${ProjectName}/experiment/${ExperimentName}	aws:ResourceTag/${TagKey}
Feature	arn:${Partition}:evidently:${Region}:${Account}:project/${ProjectName}/feature/${FeatureName}	aws:ResourceTag/${TagKey}
Launch	arn:${Partition}:evidently:${Region}:${Account}:project/${ProjectName}/launch/${LaunchName}	aws:ResourceTag/${TagKey}
Project	arn:${Partition}:evidently:${Region}:${Account}:project/${ProjectName}	aws:ResourceTag/${TagKey}
Segment	arn:${Partition}:evidently:${Region}:${Account}:segment/${SegmentName}	aws:ResourceTag/${TagKey}

Condition keys for Amazon CloudWatch Evidently

Amazon CloudWatch Evidently defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed the request on behalf of the IAM principal	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource that make the request on behalf of the IAM principal	String
aws:TagKeys	Filters access by the tag keys that are passed in the request on behalf of the IAM principal	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon CloudWatch Application Signals MCP Server (application-signals-mcp)

Amazon CloudWatch Internet Monitor (internetmonitor)