Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS CloudHSM

AWS CloudHSM (service prefix: cloudhsm) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS CloudHSM

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Access level
CreateHsm	cloudhsm	cloudhsm:CreateHsm	Write
		ec2:AuthorizeSecurityGroupEgress	Write
		ec2:AuthorizeSecurityGroupIngress	Write
		ec2:CreateNetworkInterface	Write
		ec2:CreateSecurityGroup	Write
		ec2:DeleteNetworkInterface	Write
		ec2:DescribeNetworkInterfaces	List
		ec2:DescribeSecurityGroups	List
		ec2:DescribeSubnets	List
		ec2:RevokeSecurityGroupEgress	Write
DeleteHsm	cloudhsm	cloudhsm:DeleteHsm	Write
DeleteHsm	cloudhsm	ec2:DeleteNetworkInterface	Write
CopyBackupToRegion	cloudhsmv2	cloudhsm:CopyBackupToRegion	Write
		cloudhsm:TagResource	Tagging, Write
		cloudhsm:UntagResource	Tagging, Write
CreateCluster	cloudhsmv2	cloudhsm:CreateCluster	Write
		cloudhsm:TagResource	Tagging, Write
		ec2:AuthorizeSecurityGroupEgress	Write
		ec2:AuthorizeSecurityGroupIngress	Write
		ec2:CreateSecurityGroup	Write
		ec2:DescribeSecurityGroups	List
		ec2:DescribeSubnets	List
		ec2:RevokeSecurityGroupEgress	Write
CreateHsm	cloudhsmv2	cloudhsm:CreateHsm	Write
		ec2:AuthorizeSecurityGroupEgress	Write
		ec2:AuthorizeSecurityGroupIngress	Write
		ec2:CreateNetworkInterface	Write
		ec2:CreateSecurityGroup	Write
		ec2:DeleteNetworkInterface	Write
		ec2:DescribeNetworkInterfaces	List
		ec2:DescribeSecurityGroups	List
		ec2:DescribeSubnets	List
		ec2:RevokeSecurityGroupEgress	Write
DeleteBackup	cloudhsmv2	cloudhsm:DeleteBackup	Write
DeleteCluster	cloudhsmv2	cloudhsm:DeleteCluster	Write
DeleteHsm	cloudhsmv2	cloudhsm:DeleteHsm	Write
DeleteHsm	cloudhsmv2	ec2:DeleteNetworkInterface	Write
DeleteResourcePolicy	cloudhsmv2	cloudhsm:DeleteResourcePolicy	Permissions management, Write
DescribeBackups	cloudhsmv2	cloudhsm:DescribeBackups	Read
DescribeClusters	cloudhsmv2	cloudhsm:DescribeClusters	Read
GetResourcePolicy	cloudhsmv2	cloudhsm:GetResourcePolicy	Read
InitializeCluster	cloudhsmv2	cloudhsm:InitializeCluster	Write
ListTags	cloudhsmv2	cloudhsm:ListTags	Read
ModifyBackupAttributes	cloudhsmv2	cloudhsm:ModifyBackupAttributes	Write
ModifyCluster	cloudhsmv2	cloudhsm:ModifyCluster	Write
PutResourcePolicy	cloudhsmv2	cloudhsm:PutResourcePolicy	Permissions management, Write
RestoreBackup	cloudhsmv2	cloudhsm:RestoreBackup	Write
TagResource	cloudhsmv2	cloudhsm:TagResource	Tagging, Write
UntagResource	cloudhsmv2	cloudhsm:UntagResource	Tagging, Write

Actions defined by AWS CloudHSM

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CopyBackupToRegion	Grants permission to create a copy of a backup in the specified region	backup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCluster	Grants permission to create a new AWS CloudHSM cluster	backup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateHsm	Grants permission to create a new hardware security module (HSM) in the specified AWS CloudHSM cluster	cluster*	aws:ResourceTag/${TagKey}	Write
DeleteBackup	Grants permission to delete the specified CloudHSM backup	backup*	aws:ResourceTag/${TagKey}	Write
DeleteCluster	Grants permission to delete the specified AWS CloudHSM cluster	cluster*	aws:ResourceTag/${TagKey}	Write
DeleteHsm	Grants permission to delete the specified HSM			Write
DeleteResourcePolicy	Grants permission to delete the policy attached to CloudHSM resources	backup*	aws:ResourceTag/${TagKey}	Permissions management, Write
DescribeBackups	Grants permission to get information about backups of AWS CloudHSM clusters			Read
DescribeClusters	Grants permission to get information about AWS CloudHSM clusters			Read
GetResourcePolicy	Grants permission to get information about the policy attached to a AWS CloudHSM resource	backup*	aws:ResourceTag/${TagKey}	Read
InitializeCluster	Grants permission to claim an AWS CloudHSM cluster	cluster*	aws:ResourceTag/${TagKey}	Write
ListTags	Grants permission to get a list of tags for the specified AWS CloudHSM cluster	backup	aws:ResourceTag/${TagKey}	Read
ListTags		cluster	aws:ResourceTag/${TagKey}	Read
ModifyBackupAttributes	Grants permission to modify attributes for an AWS CloudHSM backup	backup*	aws:ResourceTag/${TagKey}	Write
ModifyCluster	Grants permission to modify AWS CloudHSM cluster	cluster*	aws:ResourceTag/${TagKey}	Write
PutResourcePolicy	Grants permission to attach a policy to an AWS CloudHSM resource	backup*	aws:ResourceTag/${TagKey}	Permissions management, Write
RestoreBackup	Grants permission to restore the specified CloudHSM backup	backup*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add or overwrite one or more tags for the specified AWS CloudHSM cluster	backup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource		cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove the specified tag or tags from the specified AWS CloudHSM cluster	backup	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource		cluster	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write

Resource types defined by AWS CloudHSM

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
backup	arn:${Partition}:cloudhsm:${Region}:${Account}:backup/${CloudHsmBackupInstanceName}	aws:ResourceTag/${TagKey}
cluster	arn:${Partition}:cloudhsm:${Region}:${Account}:cluster/${CloudHsmClusterInstanceName}	aws:ResourceTag/${TagKey}

Condition keys for AWS CloudHSM

AWS CloudHSM defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS CloudFormation (cloudformation)

AWS CloudShell (cloudshell)