View a markdown version of this page

Actions, resources, and condition keys for AWS Service - Oracle Database@AWS - Service Authorization Reference

Actions, resources, and condition keys for AWS Service - Oracle Database@AWS

AWS Service - Oracle Database@AWS (service prefix: odb) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

API operations defined by AWS Service - Oracle Database@AWS

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation IAM action Condition key Possible value(s) Access level

AcceptMarketplaceRegistration

odb:AcceptMarketplaceRegistration

Write

AssociateIamRoleToResource

odb:AssociateIamRoleToResource

Write

iam:PassRole

iam:PassedToService

odb.amazonaws.com

Write

CreateAutonomousDatabase

odb:CreateAutonomousDatabase

Write

odb:TagResource

Tagging, Write

CreateAutonomousDatabaseBackup

odb:CreateAutonomousDatabaseBackup

Write

CreateAutonomousDatabaseWallet

odb:CreateAutonomousDatabaseWallet

Write

CreateCloudAutonomousVmCluster

odb:CreateCloudAutonomousVmCluster

Write

odb:TagResource

Tagging, Write

CreateCloudExadataInfrastructure

odb:CreateCloudExadataInfrastructure

Write

odb:TagResource

Tagging, Write

CreateCloudVmCluster

odb:CreateCloudVmCluster

Write

odb:CreateDbNode

Write

odb:TagResource

Tagging, Write

CreateOdbNetwork

odb:CreateOdbNetwork

Write

odb:TagResource

Tagging, Write

CreateOdbPeeringConnection

odb:CreateOdbPeeringConnection

Write

odb:TagResource

Tagging, Write

DeleteAutonomousDatabase

odb:DeleteAutonomousDatabase

Write

DeleteAutonomousDatabaseBackup

odb:DeleteAutonomousDatabaseBackup

Write

DeleteCloudAutonomousVmCluster

odb:DeleteCloudAutonomousVmCluster

Write

DeleteCloudExadataInfrastructure

odb:DeleteCloudExadataInfrastructure

Write

DeleteCloudVmCluster

odb:DeleteCloudVmCluster

Write

odb:DeleteDbNode

Write

DeleteOdbNetwork

odb:DeleteOdbNetwork

Write

DeleteOdbPeeringConnection

odb:DeleteOdbPeeringConnection

Write

DisassociateIamRoleFromResource

odb:DisassociateIamRoleFromResource

Write

FailoverAutonomousDatabase

odb:FailoverAutonomousDatabase

Write

GetAutonomousDatabase

odb:GetAutonomousDatabase

Read

GetAutonomousDatabaseBackup

odb:GetAutonomousDatabaseBackup

Read

GetCloudAutonomousVmCluster

odb:GetCloudAutonomousVmCluster

Read

GetCloudExadataInfrastructure

odb:GetCloudExadataInfrastructure

Read

GetCloudExadataInfrastructureUnallocatedResources

odb:GetCloudExadataInfrastructureUnallocatedResources

Read

GetCloudVmCluster

odb:GetCloudVmCluster

Read

GetDbNode

odb:GetDbNode

Read

GetDbServer

odb:GetDbServer

Read

GetOciOnboardingStatus

odb:GetOciOnboardingStatus

Read

GetOdbNetwork

odb:GetOdbNetwork

Read

GetOdbPeeringConnection

odb:GetOdbPeeringConnection

Read

InitializeService

odb:InitializeService

Write

ListAutonomousDatabaseBackups

odb:ListAutonomousDatabaseBackups

List

ListAutonomousDatabaseCharacterSets

odb:ListAutonomousDatabaseCharacterSets

Read

ListAutonomousDatabaseClones

odb:ListAutonomousDatabaseClones

Read

ListAutonomousDatabasePeers

odb:ListAutonomousDatabasePeers

Read

ListAutonomousDatabaseVersions

odb:ListAutonomousDatabaseVersions

Read

ListAutonomousDatabases

odb:ListAutonomousDatabases

List

ListAutonomousVirtualMachines

odb:ListAutonomousVirtualMachines

Read

ListCloudAutonomousVmClusters

odb:ListCloudAutonomousVmClusters

List

ListCloudExadataInfrastructures

odb:ListCloudExadataInfrastructures

List

ListCloudVmClusters

odb:ListCloudVmClusters

List

ListDbNodes

odb:ListDbNodes

List

ListDbServers

odb:ListDbServers

Read

ListDbSystemShapes

odb:ListDbSystemShapes

Read

ListGiVersions

odb:ListGiVersions

Read

ListOdbNetworks

odb:ListOdbNetworks

List

ListOdbPeeringConnections

odb:ListOdbPeeringConnections

List

ListSystemVersions

odb:ListSystemVersions

Read

ListTagsForResource

odb:ListTagsForResource

Read

RebootAutonomousDatabase

odb:RebootAutonomousDatabase

Write

RebootDbNode

odb:RebootDbNode

Write

RestoreAutonomousDatabase

odb:RestoreAutonomousDatabase

Write

ShrinkAutonomousDatabase

odb:ShrinkAutonomousDatabase

Write

StartAutonomousDatabase

odb:StartAutonomousDatabase

Write

StartDbNode

odb:StartDbNode

Write

StopAutonomousDatabase

odb:StopAutonomousDatabase

Write

StopDbNode

odb:StopDbNode

Write

SwitchoverAutonomousDatabase

odb:SwitchoverAutonomousDatabase

Write

TagResource

odb:TagResource

Tagging, Write

UntagResource

odb:UntagResource

Tagging, Write

UpdateAutonomousDatabase

odb:UpdateAutonomousDatabase

Write

iam:PassRole

iam:PassedToService

odb.amazonaws.com

Write

UpdateCloudExadataInfrastructure

odb:UpdateCloudExadataInfrastructure

Write

UpdateOdbNetwork

odb:UpdateOdbNetwork

Write

UpdateOdbPeeringConnection

odb:UpdateOdbPeeringConnection

Write

Actions defined by AWS Service - Oracle Database@AWS

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions Description Resource types (*required) Condition keys Access level

AcceptMarketplaceRegistration

Grants permission to register the Amazon Web Services Marketplace token for your Amazon Web Services account to activate your Oracle Database@Amazon Web Services subscription

Write

AssociateIamRoleToResource

Grants permission to associate an AWS Identity and Access Management (IAM) service role with a specified resource to enable AWS service integration

cloud-autonomous-vm-cluster

aws:ResourceTag/${TagKey}

Write

cloud-vm-cluster

aws:ResourceTag/${TagKey}

CreateAutonomousDatabase

Grants permission to create an Autonomous Database

odb-network

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateAutonomousDatabaseBackup

Grants permission to create a backup of the specified Autonomous Database

autonomous-database*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateAutonomousDatabaseWallet

Grants permission to create a wallet for the specified Autonomous Database

autonomous-database*

aws:ResourceTag/${TagKey}

Write

CreateCloudAutonomousVmCluster

Grants permission to create an Autonomous VM cluster in the specified Exadata infrastructure

cloud-exadata-infrastructure*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

odb-network*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

CreateCloudExadataInfrastructure

Grants permission to create an Exadata infrastructure

aws:RequestTag/${TagKey}

aws:TagKeys

Write

CreateCloudVmCluster

Grants permission to create a VM cluster on the specified Exadata infrastructure

cloud-exadata-infrastructure*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

odb-network*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

CreateOdbNetwork

Grants permission to create an ODB network

aws:RequestTag/${TagKey}

aws:TagKeys

Write

CreateOdbPeeringConnection

Grants permission to create an ODB Peering Connection

odb-network*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

DeleteAutonomousDatabase

Grants permission to delete the specified Autonomous Database

autonomous-database*

aws:ResourceTag/${TagKey}

Write

DeleteAutonomousDatabaseBackup

Grants permission to delete the specified Autonomous Database backup

autonomous-database-backup*

aws:ResourceTag/${TagKey}

Write

DeleteCloudAutonomousVmCluster

Grants permission to Deletes an Autonomous VM cluster

cloud-autonomous-vm-cluster*

aws:ResourceTag/${TagKey}

Write

DeleteCloudExadataInfrastructure

Grants permission to delete a specified Exadata infrastructure. Before you use this operation, make sure to delete all of the VM clusters that are hosted on this Exadata infrastructure

cloud-exadata-infrastructure*

aws:ResourceTag/${TagKey}

Write

DeleteCloudVmCluster

Grants permission to delete a specified VM cluster

cloud-vm-cluster*

aws:ResourceTag/${TagKey}

Write

DeleteOdbNetwork

Grants permission to delete the specified ODB network

odb-network*

aws:ResourceTag/${TagKey}

Write

DeleteOdbPeeringConnection

Grants permission to delete the specified ODB Peering Connection. When you delete an ODB peering connection, the underlying VPC peering connection is also deleted

odb-peering-connection*

aws:ResourceTag/${TagKey}

Write

DisassociateIamRoleFromResource

Grants permission to disassociate an AWS Identity and Access Management (IAM) service role from a specified resource to disable AWS service integration

cloud-autonomous-vm-cluster

aws:ResourceTag/${TagKey}

Write

cloud-vm-cluster

aws:ResourceTag/${TagKey}

FailoverAutonomousDatabase

Grants permission to fail over the specified Autonomous Database to a standby peer database

autonomous-database*

aws:ResourceTag/${TagKey}

Write

GetAutonomousDatabase

Grants permission to get information about a specific Autonomous Database

autonomous-database*

aws:ResourceTag/${TagKey}

Read

GetAutonomousDatabaseBackup

Grants permission to get information about a specific Autonomous Database backup

autonomous-database-backup*

aws:ResourceTag/${TagKey}

Read

GetAutonomousDatabaseWalletDetails

Grants permission to get the wallet details for the specified Autonomous Database

autonomous-database*

aws:ResourceTag/${TagKey}

Read

GetCloudAutonomousVmCluster

Grants permission to get information about a specific Autonomous VM cluster

cloud-autonomous-vm-cluster*

aws:ResourceTag/${TagKey}

Read

GetCloudExadataInfrastructure

Grants permission to get information about the specified Exadata infrastructure

cloud-exadata-infrastructure*

aws:ResourceTag/${TagKey}

Read

GetCloudExadataInfrastructureUnallocatedResources

Grants permission to retrieve information about unallocated resources in a specified Cloud Exadata Infrastructure

cloud-exadata-infrastructure*

aws:ResourceTag/${TagKey}

Read

GetCloudVmCluster

Grants permission to get information about the specified VM cluster

cloud-vm-cluster*

aws:ResourceTag/${TagKey}

Read

GetDbNode

Grants permission to get information about the specified DB node

cloud-vm-cluster*

aws:ResourceTag/${TagKey}

Read

db-node*

aws:ResourceTag/${TagKey}

GetDbServer

Grants permission to get information about the specified database server

cloud-exadata-infrastructure*

aws:ResourceTag/${TagKey}

Read

GetOciOnboardingStatus

Grants permission to get the tenancy activation link and onboarding status for your Amazon Web Services account

Read

GetOdbNetwork

Grants permission to get information about the specified ODB network

odb-network*

aws:ResourceTag/${TagKey}

Read

GetOdbPeeringConnection

Grants permission to get information about the specified ODB Peering connection

odb-peering-connection*

aws:ResourceTag/${TagKey}

Read

InitializeService

Grants permission to initialize the ODB service for the first time in an account

Write

ListAutonomousDatabaseBackups

Grants permission to list information about the backups of the specified Autonomous Database

autonomous-database*

aws:ResourceTag/${TagKey}

List

ListAutonomousDatabaseCharacterSets

Grants permission to list information about the character sets that are available for Autonomous Databases

Read

ListAutonomousDatabaseClones

Grants permission to list all clones of the specified Autonomous Database

autonomous-database*

aws:ResourceTag/${TagKey}

Read

ListAutonomousDatabasePeers

Grants permission to list all peer databases of the specified Autonomous Database

autonomous-database*

aws:ResourceTag/${TagKey}

Read

ListAutonomousDatabaseVersions

Grants permission to list information about the Oracle Database software versions that are available for Autonomous Databases

Read

ListAutonomousDatabases

Grants permission to list information about the Autonomous Databases owned by your Amazon Web Services account

List

ListAutonomousVirtualMachines

Grants permission to list all Autonomous VMs in an Autonomous VM cluster

cloud-autonomous-vm-cluster

aws:ResourceTag/${TagKey}

Read

ListCloudAutonomousVmClusters

Grants permission to list all Autonomous VM clusters in a specified Cloud Exadata infrastructure

cloud-exadata-infrastructure

aws:ResourceTag/${TagKey}

List

ListCloudExadataInfrastructures

Grants permission to list information about the Exadata infrastructures owned by your Amazon Web Services account

List

ListCloudVmClusters

Grants permission to list information about the VM clusters owned by your Amazon Web Services account or only the ones on the specified Exadata infrastructure

cloud-exadata-infrastructure

aws:ResourceTag/${TagKey}

List

ListDbNodes

Grants permission to list information about the DB nodes for the specified VM cluster

cloud-vm-cluster*

aws:ResourceTag/${TagKey}

List

ListDbServers

Grants permission to list information about the database servers that belong to the specified Exadata infrastructure

cloud-exadata-infrastructure*

aws:ResourceTag/${TagKey}

Read

ListDbSystemShapes

Grants permission to list information about the shapes that are available for an Exadata infrastructure

Read

ListGiVersions

Grants permission to list information about Oracle Grid Infrastructure (GI) software versions that are available for a VM cluster for the specified shape

Read

ListOdbNetworks

Grants permission to list information about the ODB networks owned by your Amazon Web Services account

List

ListOdbPeeringConnections

Grants permission to list all ODB peering connections or those associated with a specific ODB network

odb-network

aws:ResourceTag/${TagKey}

List

ListSystemVersions

Grants permission to list information about the system versions that are available for a VM cluster for the specified giVersion and shape

Read

ListTagsForResource

Grants permission to list information about the tags applied to this resource

autonomous-database

aws:ResourceTag/${TagKey}

Read

autonomous-database-backup

aws:ResourceTag/${TagKey}

cloud-autonomous-vm-cluster

aws:ResourceTag/${TagKey}

cloud-exadata-infrastructure

aws:ResourceTag/${TagKey}

cloud-vm-cluster

aws:ResourceTag/${TagKey}

db-node

aws:ResourceTag/${TagKey}

odb-network

aws:ResourceTag/${TagKey}

odb-peering-connection

aws:ResourceTag/${TagKey}

RebootAutonomousDatabase

Grants permission to reboot the specified Autonomous Database

autonomous-database*

aws:ResourceTag/${TagKey}

Write

RebootDbNode

Grants permission to reboot the specified DB node in a VM cluster

cloud-vm-cluster*

aws:ResourceTag/${TagKey}

Write

db-node*

aws:ResourceTag/${TagKey}

RestoreAutonomousDatabase

Grants permission to restore the specified Autonomous Database to a point in time

autonomous-database*

aws:ResourceTag/${TagKey}

Write

ShrinkAutonomousDatabase

Grants permission to shrink the storage of the specified Autonomous Database to reclaim unused space

autonomous-database*

aws:ResourceTag/${TagKey}

Write

StartAutonomousDatabase

Grants permission to start the specified Autonomous Database

autonomous-database*

aws:ResourceTag/${TagKey}

Write

StartDbNode

Grants permission to start the specified DB node in a VM cluster

cloud-vm-cluster*

aws:ResourceTag/${TagKey}

Write

db-node*

aws:ResourceTag/${TagKey}

StopAutonomousDatabase

Grants permission to stop the specified Autonomous Database

autonomous-database*

aws:ResourceTag/${TagKey}

Write

StopDbNode

Grants permission to stop the specified DB node in a VM cluster

cloud-vm-cluster*

aws:ResourceTag/${TagKey}

Write

db-node*

aws:ResourceTag/${TagKey}

SwitchoverAutonomousDatabase

Grants permission to switch over the specified Autonomous Database to a standby peer database

autonomous-database*

aws:ResourceTag/${TagKey}

Write

TagResource

Grants permission to apply tags to the specified resource

autonomous-database

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Tagging, Write

autonomous-database-backup

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

cloud-autonomous-vm-cluster

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

cloud-exadata-infrastructure

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

cloud-vm-cluster

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

db-node

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

odb-network

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

odb-peering-connection

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

UntagResource

Grants permission to remove tags from the specified resource

autonomous-database

aws:ResourceTag/${TagKey}

aws:TagKeys

Tagging, Write

autonomous-database-backup

aws:ResourceTag/${TagKey}

aws:TagKeys

cloud-autonomous-vm-cluster

aws:ResourceTag/${TagKey}

aws:TagKeys

cloud-exadata-infrastructure

aws:ResourceTag/${TagKey}

aws:TagKeys

cloud-vm-cluster

aws:ResourceTag/${TagKey}

aws:TagKeys

db-node

aws:ResourceTag/${TagKey}

aws:TagKeys

odb-network

aws:ResourceTag/${TagKey}

aws:TagKeys

odb-peering-connection

aws:ResourceTag/${TagKey}

aws:TagKeys

UpdateAutonomousDatabase

Grants permission to update the properties of an Autonomous Database

autonomous-database*

aws:ResourceTag/${TagKey}

Write

UpdateAutonomousDatabaseBackup

Grants permission to update the properties of an Autonomous Database backup

autonomous-database-backup*

aws:ResourceTag/${TagKey}

Write

UpdateCloudExadataInfrastructure

Grants permission to update the properties of an Exadata infrastructure resource

cloud-exadata-infrastructure*

aws:ResourceTag/${TagKey}

Write

UpdateOdbNetwork

Grants permission to update properties of a specified ODB network

odb-network*

aws:ResourceTag/${TagKey}

Write

UpdateOdbPeeringConnection

Grants permission to update properties of a specified ODB Peering Connection

odb-peering-connection*

aws:ResourceTag/${TagKey}

Write

Permission-only actions for AWS Service - Oracle Database@AWS

The following actions are defined by AWS Service - Oracle Database@AWS but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions Description Resource types (*required) Condition keys Access level

CreateDbNode

Grants permission to create a DB Node

db-node*

aws:ResourceTag/${TagKey}

Write

CreateGrantShare

Grants permission to create an ODB Grant Share

Write

CreateOutboundIntegration

Grants permission to create an Outbound Integration

cloud-autonomous-vm-cluster*

aws:ResourceTag/${TagKey}

Write

cloud-vm-cluster*

aws:ResourceTag/${TagKey}

DeleteDbNode

Grants permission to delete a DB Node

db-node*

aws:ResourceTag/${TagKey}

Write

DeleteGrantShare

Grants permission to delete an ODB Grant Share

Write

DeleteResourcePolicy

Grants permission to delete a resource policy

cloud-exadata-infrastructure*

aws:ResourceTag/${TagKey}

Write

odb-network*

aws:ResourceTag/${TagKey}

GetResourcePolicy

Grants permission to get a resource policy

cloud-exadata-infrastructure*

aws:ResourceTag/${TagKey}

Read

odb-network*

aws:ResourceTag/${TagKey}

PutResourcePolicy

Grants permission to update a resource policy

cloud-exadata-infrastructure*

aws:ResourceTag/${TagKey}

Write

odb-network*

aws:ResourceTag/${TagKey}

UpdateGrantShare

Grants permission to update an ODB Grant Share

Write

UpdateOutboundIntegration

Grants permission to update an Outbound Integration

cloud-autonomous-vm-cluster*

aws:ResourceTag/${TagKey}

Write

cloud-vm-cluster*

aws:ResourceTag/${TagKey}

Resource types defined by AWS Service - Oracle Database@AWS

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types ARN Condition keys

autonomous-database

arn:${Partition}:odb:${Region}:${Account}:autonomous-database/${AutonomousDatabaseId}

aws:ResourceTag/${TagKey}

autonomous-database-backup

arn:${Partition}:odb:${Region}:${Account}:autonomous-database-backup/${AutonomousDatabaseBackupId}

aws:ResourceTag/${TagKey}

cloud-autonomous-vm-cluster

arn:${Partition}:odb:${Region}:${Account}:cloud-autonomous-vm-cluster/${CloudAutonomousVmClusterId}

aws:ResourceTag/${TagKey}

cloud-exadata-infrastructure

arn:${Partition}:odb:${Region}:${Account}:cloud-exadata-infrastructure/${CloudExadataInfrastructureId}

aws:ResourceTag/${TagKey}

cloud-vm-cluster

arn:${Partition}:odb:${Region}:${Account}:cloud-vm-cluster/${CloudVmClusterId}

aws:ResourceTag/${TagKey}

db-node

arn:${Partition}:odb:${Region}:${Account}:db-node/${DbNodeId}

aws:ResourceTag/${TagKey}

odb-network

arn:${Partition}:odb:${Region}:${Account}:odb-network/${OdbNetworkId}

aws:ResourceTag/${TagKey}

odb-peering-connection

arn:${Partition}:odb:${Region}:${Account}:odb-peering-connection/${OdbPeeringConnectionId}

aws:ResourceTag/${TagKey}

Condition keys for AWS Service - Oracle Database@AWS

AWS Service - Oracle Database@AWS defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys Description Type

aws:RequestTag/${TagKey}

Filters access by a tag key and value pair that is allowed in the request

String

aws:ResourceTag/${TagKey}

Filters access by a tag key and value pair of a resource

String

aws:TagKeys

Filters access by a list of tag keys that are allowed in the request

ArrayOfString