Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon DataZone

Amazon DataZone (service prefix: datazone) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon DataZone
Actions defined by Amazon DataZone
Permission-only actions for Amazon DataZone
Resource types defined by Amazon DataZone
Condition keys for Amazon DataZone

API operations defined by Amazon DataZone

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AcceptPredictions	datazone:AcceptPredictions			Write
AcceptSubscriptionRequest	datazone:AcceptSubscriptionRequest			Write
AddEntityOwner	datazone:AddEntityOwner			Write
AddPolicyGrant	datazone:AddPolicyGrant			Permissions management, Write
AssociateEnvironmentRole	datazone:AssociateEnvironmentRole			Write
AssociateEnvironmentRole	iam:PassRole	iam:PassedToService	datazone.amazonaws.com	Write
AssociateGovernedTerms	datazone:AssociateGovernedTerms			Write
BatchGetAttributesMetadata	datazone:BatchGetAttributesMetadata			Read
BatchPutAttributesMetadata	datazone:BatchPutAttributesMetadata			Write
CancelMetadataGenerationRun	datazone:CancelMetadataGenerationRun			Write
CancelSubscription	datazone:CancelSubscription			Write
CreateAccountPool	datazone:CreateAccountPool			Write
CreateAccountPool	iam:PassRole	iam:PassedToService	datazone.amazonaws.com	Write
CreateAsset	datazone:CreateAsset			Write
CreateAssetFilter	datazone:CreateAssetFilter			Write
CreateAssetRevision	datazone:CreateAssetRevision			Write
CreateAssetType	datazone:CreateAssetType			Write
CreateConnection	datazone:CreateConnection			Write
CreateDataProduct	datazone:CreateDataProduct			Write
CreateDataProductRevision	datazone:CreateDataProductRevision			Write
CreateDataSource	datazone:CreateDataSource			Write
CreateDataSource	iam:PassRole	iam:PassedToService	datazone.amazonaws.com	Write
CreateDomain	datazone:CreateDomain			Write
	datazone:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	datazone.amazonaws.com	Write
CreateDomainUnit	datazone:CreateDomainUnit			Write
CreateEnvironment	datazone:CreateEnvironment			Write
CreateEnvironmentAction	datazone:CreateEnvironmentAction			Write
CreateEnvironmentBlueprint	datazone:CreateEnvironmentBlueprint			Write
CreateEnvironmentProfile	datazone:CreateEnvironmentProfile			Write
CreateFormType	datazone:CreateFormType			Write
CreateGlossary	datazone:CreateGlossary			Write
CreateGlossaryTerm	datazone:CreateGlossaryTerm			Write
CreateGroupProfile	datazone:CreateGroupProfile			Write
CreateListingChangeSet	datazone:CreateListingChangeSet			Write
CreateNotebook	datazone:CreateNotebook			Write
CreateProject	datazone:CreateProject			Write
CreateProject	iam:PassRole	iam:PassedToService	datazone.amazonaws.com	Write
CreateProjectMembership	datazone:CreateProjectMembership			Write
CreateProjectProfile	datazone:CreateProjectProfile			Write
CreateRule	datazone:CreateRule			Write
CreateSubscriptionGrant	datazone:CreateSubscriptionGrant			Write
CreateSubscriptionRequest	datazone:CreateSubscriptionRequest			Write
CreateSubscriptionTarget	datazone:CreateSubscriptionTarget			Write
CreateSubscriptionTarget	iam:PassRole	iam:PassedToService	datazone.amazonaws.com	Write
CreateUserProfile	datazone:CreateUserProfile			Write
DeleteAccountPool	datazone:DeleteAccountPool			Write
DeleteAsset	datazone:DeleteAsset			Write
DeleteAssetFilter	datazone:DeleteAssetFilter			Write
DeleteAssetType	datazone:DeleteAssetType			Write
DeleteConnection	datazone:DeleteConnection			Write
DeleteDataExportConfiguration	datazone:DeleteDataExportConfiguration			Write
DeleteDataProduct	datazone:DeleteDataProduct			Write
DeleteDataSource	datazone:DeleteDataSource			Write
DeleteDomain	datazone:DeleteDomain			Write
DeleteDomainUnit	datazone:DeleteDomainUnit			Write
DeleteEnvironment	datazone:DeleteEnvironment			Write
DeleteEnvironmentAction	datazone:DeleteEnvironmentAction			Write
DeleteEnvironmentBlueprint	datazone:DeleteEnvironmentBlueprint			Write
DeleteEnvironmentBlueprintConfiguration	datazone:DeleteEnvironmentBlueprintConfiguration			Write
DeleteEnvironmentProfile	datazone:DeleteEnvironmentProfile			Write
DeleteFormType	datazone:DeleteFormType			Write
DeleteGlossary	datazone:DeleteGlossary			Write
DeleteGlossaryTerm	datazone:DeleteGlossaryTerm			Write
DeleteLineageEvent	datazone:DeleteLineageEvent			Write
DeleteListing	datazone:DeleteListing			Write
DeleteNotebook	datazone:DeleteNotebook			Write
DeleteProject	datazone:DeleteProject			Write
DeleteProjectMembership	datazone:DeleteProjectMembership			Write
DeleteProjectProfile	datazone:DeleteProjectProfile			Write
DeleteRule	datazone:DeleteRule			Write
DeleteSubscriptionGrant	datazone:DeleteSubscriptionGrant			Write
DeleteSubscriptionRequest	datazone:DeleteSubscriptionRequest			Write
DeleteSubscriptionTarget	datazone:DeleteSubscriptionTarget			Write
DeleteTimeSeriesDataPoints	datazone:DeleteTimeSeriesDataPoints			Write
DisassociateEnvironmentRole	datazone:DisassociateEnvironmentRole			Write
DisassociateGovernedTerms	datazone:DisassociateGovernedTerms			Write
GetAccountPool	datazone:GetAccountPool			Read
GetAsset	datazone:GetAsset			Read
GetAssetFilter	datazone:GetAssetFilter			Read
GetAssetType	datazone:GetAssetType			Read
GetConnection	datazone:GetConnection			Read
GetDataExportConfiguration	datazone:GetDataExportConfiguration			Read
GetDataProduct	datazone:GetDataProduct			Read
GetDataSource	datazone:GetDataSource			Read
GetDataSourceRun	datazone:GetDataSourceRun			Read
GetDomain	datazone:GetDomain			Read
GetDomainUnit	datazone:GetDomainUnit			Read
GetEnvironment	datazone:GetEnvironment			Read
GetEnvironmentAction	datazone:GetEnvironmentAction			Read
GetEnvironmentBlueprint	datazone:GetEnvironmentBlueprint			Read
GetEnvironmentBlueprintConfiguration	datazone:GetEnvironmentBlueprintConfiguration			Read
GetEnvironmentCredentials	datazone:GetEnvironmentCredentials			Read
GetEnvironmentProfile	datazone:GetEnvironmentProfile			Read
GetFormType	datazone:GetFormType			Read
GetGlossary	datazone:GetGlossary			Read
GetGlossaryTerm	datazone:GetGlossaryTerm			Read
GetGroupProfile	datazone:GetGroupProfile			Read
GetIamPortalLoginUrl	datazone:GetIamPortalLoginUrl			Permissions management, Write
GetJobRun	datazone:GetJobRun			Read
GetLineageEvent	datazone:GetLineageEvent			Read
GetLineageNode	datazone:GetLineageNode			Read
GetListing	datazone:GetListing			Read
GetMetadataGenerationRun	datazone:GetMetadataGenerationRun			Read
GetNotebook	datazone:GetNotebook			Read
GetNotebookExport	datazone:GetNotebookExport			Read
GetProject	datazone:GetProject			Read
GetProjectProfile	datazone:GetProjectProfile			Read
GetRule	datazone:GetRule			Read
GetSubscription	datazone:GetSubscription			Read
GetSubscriptionGrant	datazone:GetSubscriptionGrant			Read
GetSubscriptionRequestDetails	datazone:GetSubscriptionRequestDetails			Read
GetSubscriptionTarget	datazone:GetSubscriptionTarget			Read
GetTimeSeriesDataPoint	datazone:GetTimeSeriesDataPoint			Read
GetUserProfile	datazone:GetUserProfile			Read
ListAccountPools	datazone:ListAccountPools			List
ListAccountsInAccountPool	datazone:ListAccountsInAccountPool			List
ListAssetFilters	datazone:ListAssetFilters			List
ListAssetRevisions	datazone:ListAssetRevisions			List
ListConnections	datazone:ListConnections			List
ListDataProductRevisions	datazone:ListDataProductRevisions			List
ListDataSourceRunActivities	datazone:ListDataSourceRunActivities			List
ListDataSourceRuns	datazone:ListDataSourceRuns			List
ListDataSources	datazone:ListDataSources			List
ListDomainUnitsForParent	datazone:ListDomainUnitsForParent			List
ListDomains	datazone:ListDomains			List
ListEntityOwners	datazone:ListEntityOwners			List
ListEnvironmentActions	datazone:ListEnvironmentActions			List
ListEnvironmentBlueprintConfigurations	datazone:ListEnvironmentBlueprintConfigurations			List
ListEnvironmentBlueprints	datazone:ListEnvironmentBlueprints			List
ListEnvironmentProfiles	datazone:ListEnvironmentProfiles			List
ListEnvironments	datazone:ListEnvironments			List
ListJobRuns	datazone:ListJobRuns			List
ListLineageEvents	datazone:ListLineageEvents			List
ListLineageNodeHistory	datazone:ListLineageNodeHistory			List
ListMetadataGenerationRuns	datazone:ListMetadataGenerationRuns			List
ListNotebooks	datazone:ListNotebooks			List
ListNotifications	datazone:ListNotifications			List
ListPolicyGrants	datazone:ListPolicyGrants			List
ListProjectMemberships	datazone:ListProjectMemberships			List
ListProjectProfiles	datazone:ListProjectProfiles			List
ListProjects	datazone:ListProjects			List
ListRules	datazone:ListRules			List
ListSubscriptionGrants	datazone:ListSubscriptionGrants			List
ListSubscriptionRequests	datazone:ListSubscriptionRequests			List
ListSubscriptionTargets	datazone:ListSubscriptionTargets			List
ListSubscriptions	datazone:ListSubscriptions			List
ListTagsForResource	datazone:ListTagsForResource			Read
ListTimeSeriesDataPoints	datazone:ListTimeSeriesDataPoints			List
PostLineageEvent	datazone:PostLineageEvent			Write
PostTimeSeriesDataPoints	datazone:PostTimeSeriesDataPoints			Write
PutDataExportConfiguration	datazone:PutDataExportConfiguration			Write
PutEnvironmentBlueprintConfiguration	datazone:PutEnvironmentBlueprintConfiguration			Write
PutEnvironmentBlueprintConfiguration	iam:PassRole	iam:PassedToService	datazone.amazonaws.com	Write
QueryGraph	datazone:QueryGraph			List
RejectPredictions	datazone:RejectPredictions			Write
RejectSubscriptionRequest	datazone:RejectSubscriptionRequest			Write
RemoveEntityOwner	datazone:RemoveEntityOwner			Write
RemovePolicyGrant	datazone:RemovePolicyGrant			Permissions management, Write
RevokeSubscription	datazone:RevokeSubscription			Permissions management, Write
Search	datazone:Search			List
SearchGroupProfiles	datazone:SearchGroupProfiles			List
SearchListings	datazone:SearchListings			List
SearchTypes	datazone:SearchTypes			List
SearchUserProfiles	datazone:SearchUserProfiles			List
StartDataSourceRun	datazone:StartDataSourceRun			Write
StartMetadataGenerationRun	datazone:StartMetadataGenerationRun			Write
StartNotebookExport	datazone:StartNotebookExport			Write
StartNotebookImport	datazone:StartNotebookImport			Write
TagResource	datazone:TagResource			Tagging, Write
UntagResource	datazone:UntagResource			Tagging, Write
UpdateAccountPool	datazone:UpdateAccountPool			Write
UpdateAccountPool	iam:PassRole	iam:PassedToService	datazone.amazonaws.com	Write
UpdateAssetFilter	datazone:UpdateAssetFilter			Write
UpdateConnection	datazone:UpdateConnection			Write
UpdateDataSource	datazone:UpdateDataSource			Write
UpdateDataSource	iam:PassRole	iam:PassedToService	datazone.amazonaws.com	Write
UpdateDomain	datazone:UpdateDomain			Write
UpdateDomain	iam:PassRole	iam:PassedToService	datazone.amazonaws.com	Write
UpdateDomainUnit	datazone:UpdateDomainUnit			Write
UpdateEnvironment	datazone:UpdateEnvironment			Write
UpdateEnvironmentAction	datazone:UpdateEnvironmentAction			Write
UpdateEnvironmentBlueprint	datazone:UpdateEnvironmentBlueprint			Write
UpdateEnvironmentProfile	datazone:UpdateEnvironmentProfile			Write
UpdateGlossary	datazone:UpdateGlossary			Write
UpdateGlossaryTerm	datazone:UpdateGlossaryTerm			Write
UpdateGroupProfile	datazone:UpdateGroupProfile			Write
UpdateNotebook	datazone:UpdateNotebook			Write
UpdateProject	datazone:UpdateProject			Write
UpdateProjectProfile	datazone:UpdateProjectProfile			Write
UpdateRule	datazone:UpdateRule			Write
UpdateSubscriptionGrantStatus	datazone:UpdateSubscriptionGrantStatus			Write
UpdateSubscriptionRequest	datazone:UpdateSubscriptionRequest			Write
UpdateSubscriptionTarget	datazone:UpdateSubscriptionTarget			Write
UpdateSubscriptionTarget	iam:PassRole	iam:PassedToService	datazone.amazonaws.com	Write
UpdateUserProfile	datazone:UpdateUserProfile			Write

Actions defined by Amazon DataZone

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptPredictions	Grants permission to accept prediction			Write
AcceptSubscriptionRequest	Grants permission to approve a subscription request for a Data Asset			Write
AddEntityOwner	Grants permission to add an owner to an entity like domain unit			Write
AddPolicyGrant	Grants permission to add a policy grant			Permissions management, Write
AssociateEnvironmentRole	Grants permission to associate a role in a default service blueprint environment			Write
AssociateGovernedTerms	Grants permission to associate governed terms to an asset			Write
BatchGetAttributesMetadata	Grants permission to retrieve attributes metadata			Read
BatchGetCell	Grants permission to batch get cells			Read
BatchGetCellRun	Grants permission to batch get cell runs			Read
BatchPutAttributesMetadata	Grants permission to create and update attributes metadata			Write
CancelMessage	Grants permission to cancel an in-progress agent response			Write
CancelMetadataGenerationRun	Grants permission to cancel metadata generation run			Write
CancelSubscription	Grants permission to revoke or unsubscribe an approved subscription to Data Asset			Write
CreateAccountPool	Grants permission to create an account pool			Write
CreateAsset	Grants permission to create asset			Write
CreateAssetFilter	Grants permission to create asset filter			Write
CreateAssetRevision	Grants permission to create new revision of an asset			Write
CreateAssetType	Grants permission to create an asset type			Write
CreateCell	Grants permission to create cells			Write
CreateCellRun	Grants permission to create cell runs			Write
CreateConnection	Grants permission to create connections			Write
CreateDataProduct	Grants permission to create data product			Write
CreateDataProductRevision	Grants permission to create data product revision			Write
CreateDataSource	Grants permission to create a new DataSource			Write
CreateDomain	Grants permission to provision a domain which is a top level entity that contains other Amazon DataZone resources		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDomainUnit	Grants permission to create a domain unit			Write
CreateEnvironment	Grants permission to create a collection of configurated resources used to publish and subscribe to data			Write
CreateEnvironmentAction	Grants permission to create an environment action in a default service blueprint environment			Write
CreateEnvironmentBlueprint	Grants permission to create a custom Environment Blueprint that allow user to add Environments to their Project			Write
CreateEnvironmentProfile	Grants permission to create a template from a Blueprint that can be used to create a Environment			Write
CreateFormType	Grants permission to create a form type or a new revision of it			Write
CreateGlossary	Grants permission to create a business glossary			Write
CreateGlossaryTerm	Grants permission to create a glossary term			Write
CreateGroupProfile	Grants permission to create a DataZone group profile for an IAM Identity Center group			Write
CreateListingChangeSet	Grants permission to create listing change set			Write
CreateNotebook	Grants permission to create notebooks			Write
CreateProject	Grants permission to create a Project to enable your team to publish and subscribe to data			Write
CreateProjectMembership	Grants permission to add a user to a Project			Write
CreateProjectProfile	Grants permission to create a project profile			Write
CreateRule	Grants permission to create rule			Write
CreateSubscriptionGrant	Grants permission to create a grant for an approved subscription on a subscription target			Write
CreateSubscriptionRequest	Grants permission to create a subscription request for a Data Asset			Write
CreateSubscriptionTarget	Grants permission to create a subscription target for a Environment in the project			Write
CreateUserProfile	Grants permission to create a user profile for an existing user in the customers IAM Identity Center			Write
DeleteAccountPool	Grants permission to delete an account pool			Write
DeleteAsset	Grants permission to delete an asset			Write
DeleteAssetFilter	Grants permission to delete asset filter			Write
DeleteAssetType	Grants permission to delete an asset type			Write
DeleteCell	Grants permission to delete cells			Write
DeleteCellRun	Grants permission to delete cell runs			Write
DeleteConnection	Grants permission to delete connections			Write
DeleteDataExportConfiguration	Grants permission to delete DataZone catalog data export configuration			Write
DeleteDataProduct	Grants permission to delete data product			Write
DeleteDataSource	Grants permission to update existing DataSource			Write
DeleteDomain	Grants permission to delete a provisioned domain	domain*	aws:ResourceTag/${TagKey}	Write
DeleteDomainUnit	Grants permission to delete an existing domain unit			Write
DeleteEnvironment	Grants permission to Delete Environment			Write
DeleteEnvironmentAction	Grants permission to delete an environment action in a default service blueprint environment			Write
DeleteEnvironmentBlueprint	Grants permission to delete Environment Blueprint			Write
DeleteEnvironmentBlueprintConfiguration	Grants permission to delete environment blueprint configuration			Write
DeleteEnvironmentProfile	Grants permission to delete Environment Profile			Write
DeleteFormType	Grants permission to delete a form type			Write
DeleteGlossary	Grants permission to delete a business glossary			Write
DeleteGlossaryTerm	Grants permission to delete a glossary term			Write
DeleteLineageEvent	Grants permission to delete lineage events			Write
DeleteListing	Grants permission to delete listing			Write
DeleteNotebook	Grants permission to delete notebooks			Write
DeleteProject	Grants permission to delete a Project that enables your team to publish and subscribe to data			Write
DeleteProjectMembership	Grants permission to remove a user from a project			Write
DeleteProjectProfile	Grants permission to delete a project profile			Write
DeleteRule	Grants permission to delete rule			Write
DeleteSubscriptionGrant	Grants permission to delete a subscription grant from a subscription target			Write
DeleteSubscriptionRequest	Grants permission to delete a pending subscription request for a Data Asset			Write
DeleteSubscriptionTarget	Grants permission to delete a subscription target from a Environment in the project			Write
DeleteTimeSeriesDataPoints	Grants permission to delete existing TimeSeriesDataPoints			Write
DisassociateEnvironmentRole	Grants permission to disassociate a role in a default service blueprint environment			Write
DisassociateGovernedTerms	Grants permission to disassociate governed terms to an asset			Write
GenerateCode	Grants permission to generate code			Write
GetAccountPool	Grants permission to get account pool details			Read
GetAsset	Grants permission to retrieve an asset			Read
GetAssetFilter	Grants permission to get asset filter			Read
GetAssetType	Grants permission to get an asset type			Read
GetCell	Grants permission to get cells			Read
GetCellRun	Grants permission to get cell runs			Read
GetCellRunResult	Grants permission to get cell run result			Read
GetCompute	Grants permission to get compute			Read
GetConnection	Grants permission to get connections			Read
GetConversation	Grants permission to get conversations			Read
GetDataExportConfiguration	Grants permission to retrieve DataZone catalog data export configuration			Read
GetDataProduct	Grants permission to get data product			Read
GetDataSource	Grants permission to Get a existing DataSource in Amazon DataZone using its identifier			Read
GetDataSourceRun	Grants permission to get DataSource run job in Amazon DataZone using it's identifier			Read
GetDomain	Grants permission to retrieve information about a domain	domain*	aws:ResourceTag/${TagKey}	Read
GetDomainUnit	Grants permission to get an existing domain unit			Read
GetEnvironment	Grants permission to get Environment details			Read
GetEnvironmentAction	Grants permission to get an environment action in a default service blueprint environment			Read
GetEnvironmentBlueprint	Grants permission to get Environment Blueprint details			Read
GetEnvironmentBlueprintConfiguration	Grants permission to get environment blueprint configuration			Read
GetEnvironmentCredentials	Grants permission to get short term credentials that assume the Environment user role			Read
GetEnvironmentProfile	Grants permission to get Environment Profile details			Read
GetFormType	Grants permission to get a form type			Read
GetGlossary	Grants permission to get a business glossary			Read
GetGlossaryTerm	Grants permission to get a glossary term			Read
GetGroupProfile	Grants permission to retrieve an existing DataZone group profile			Read
GetIamPortalLoginUrl	Grants permission to an IAM principal to log into the DataZone Portal			Permissions management, Write
GetJobRun	Grants permission to get job runs			Read
GetLineageEvent	Grants permission to get lineage events			Read
GetLineageNode	Grants permission to get the lineage node			Read
GetListing	Grants permission to get listing			Read
GetMetadataGenerationRun	Grants permission to get metadata generation run			Read
GetNotebook	Grants permission to get notebooks			Read
GetNotebookCompute	Grants permission to get notebook compute			Read
GetNotebookExport	Grants permission to get notebook exports			Read
GetProject	Grants permission to get Project details			Read
GetProjectProfile	Grants permission to get project profile details			Read
GetRule	Grants permission to get rule			Read
GetSubscription	Grants permission to retrieve a subscription			Read
GetSubscriptionGrant	Grants permission to retireve a subscription grant			Read
GetSubscriptionRequestDetails	Grants permission to reject a subscription request for a Data Asset			Read
GetSubscriptionTarget	Grants permission to retireve details of subscription target			Read
GetTimeSeriesDataPoint	Grants permission to get an existing TimeSeriesDataPoints in Amazon DataZone using its identifier			Read
GetUpdateEligibility	Grants permission to get update eligibility status for project constructs			Read
GetUserProfile	Grants permission to retrieve a user profile for an existing user in the DataZone Domain			Read
ListAccountEnvironments	Grants permission to list Environments across all domains in an AWS Account			List
ListAccountPools	Grants permission to list account pools			List
ListAccountsInAccountPool	Grants permission to list accounts in an account pool			List
ListAssetFilters	Grants permission to list asset filters			List
ListAssetRevisions	Grants permission to list revisions of an asset			List
ListCellRuns	Grants permission to list cell runs			List
ListConnections	Grants permission to list connections			List
ListConversations	Grants permission to list conversations			List
ListDataProductRevisions	Grants permission to list data product revisions			List
ListDataSourceRunActivities	Grants permission to list DataSource runs job's activities on Asset			List
ListDataSourceRuns	Grants permission to list DataSource runs job			List
ListDataSources	Grants permission to list existing DataSources			List
ListDomainUnitsForParent	Grants permission to list child domain units for a given parent domain unit			List
ListDomains	Grants permission to retrieve all domains			List
ListEntityOwners	Grants permission to list owners of an entity like domain unit			List
ListEnvironmentActions	Grants permission to list environment actions in a default service blueprint environment			List
ListEnvironmentBlueprintConfigurations	Grants permission to list environment blueprint configurations			List
ListEnvironmentBlueprints	Grants permission to list Domain for Environment Blueprints			List
ListEnvironmentProfiles	Grants permission to list Domain for Environment Profiles			List
ListEnvironments	Grants permission to show Environments in the Domain			List
ListGroupsForUser	Grants permission to list all the DataZone group profiles that the DataZone user profile is a member of			List
ListJobRuns	Grants permission to list job runs			List
ListLineageEvents	Grants permission to list lineage events			List
ListLineageNodeHistory	Grants permission to list historical versions of lineage node			List
ListMetadataGenerationRuns	Grants permission to list metadata generation runs			List
ListNotebooks	Grants permission to list notebooks			List
ListNotifications	Grants permission to list notifications and events for a datazone user			List
ListPolicyGrants	Grants permission to list policy grants			List
ListProjectMemberships	Grants permission to list Project Members			List
ListProjectProfiles	Grants permission to list project profiles			List
ListProjects	Grants permission to list Projects			List
ListRules	Grants permission to list rules			List
ListSubscriptionGrants	Grants permission to List subscription grants for a subscribed principal			List
ListSubscriptionRequests	Grants permission to list subscription requests			List
ListSubscriptionTargets	Grants permission to list subscription targets			List
ListSubscriptions	Grants permission to list subscriptions			List
ListTagsForResource	Grants permission to retrieve all tags associated with a resource	domain	aws:ResourceTag/${TagKey}	Read
ListTimeSeriesDataPoints	Grants permission to list existing TimeSeriesDataPoints			List
PostLineageEvent	Grants permission to post lineage events			Write
PostTimeSeriesDataPoints	Grants permission to post a new TimeSeriesDataPoints			Write
PutCellRunResult	Grants permission to put cell run results			Write
PutDataExportConfiguration	Grants permission to create and update DataZone catalog data export configuration			Write
PutEnvironmentBlueprintConfiguration	Grants permission to put environment blueprint configuration			Write
QueryGraph	Grants permission to query graph			List
RejectPredictions	Grants permission to reject prediction			Write
RejectSubscriptionRequest	Grants permission to reject a subscription request for a Data Asset			Write
RemoveEntityOwner	Grants permission to remove an existing owner of an entity like domain unit			Write
RemovePolicyGrant	Grants permission to remove a policy grant			Permissions management, Write
RevokeSubscription	Grants permission to revoke a subscription			Permissions management, Write
Search	Grants permission to search datazone entities			List
SearchGroupProfiles	Grants permission to search DataZone group profiles and IAM Identity Center groups			List
SearchListings	Grants permission to search listings			List
SearchTypes	Grants permission to search types such asset types and form types in a domain			List
SearchUserProfiles	Grants permission to search DataZone user profiles, IAM Identity Center users, and DataZone IAM principal profiles			List
SendMessage	Grants permission to send messages			Write
StartCompute	Grants permission to start compute			Write
StartConversation	Grants permission to start conversations			Write
StartDataSourceRun	Grants permission to start a DataSource run job			Write
StartMetadataGenerationRun	Grants permission to start metadata generation run			Write
StartNotebookCompute	Grants permission to start notebook compute			Write
StartNotebookExport	Grants permission to export notebooks			Write
StartNotebookImport	Grants permission to import notebooks			Write
StartNotebookSync	Grants permission to start notebook sync			Write
StopCompute	Grants permission to stop compute			Write
StopMetadataGenerationRun	Grants permission to stop metadata generation run			Write
StopNotebookCompute	Grants permission to stop notebook compute			Write
TagResource	Grants permission to add or update tags to a resource	domain*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags associated with a resource	domain*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateAccountPool	Grants permission to update an account pool			Write
UpdateAssetFilter	Grants permission to update asset filter			Write
UpdateCell	Grants permission to update cells			Write
UpdateCellRun	Grants permission to update cell runs			Write
UpdateConnection	Grants permission to update connections			Write
UpdateDataSource	Grants permission to update existing DataSource			Write
UpdateDomain	Grants permission to update information for a domain	domain*	aws:ResourceTag/${TagKey}	Write
UpdateDomainUnit	Grants permission to update an existing domain unit			Write
UpdateEnvironment	Grants permission to update Environment settings			Write
UpdateEnvironmentAction	Grants permission to update an environment action in a default service blueprint environment			Write
UpdateEnvironmentBlueprint	Grants permission to update Environment Blueprint settings			Write
UpdateEnvironmentProfile	Grants permission to update EnvironmentProfile configuration			Write
UpdateGlossary	Grants permission to update a business glossary			Write
UpdateGlossaryTerm	Grants permission to update a glossary term			Write
UpdateGroupProfile	Grants permission to update a DataZone group profile			Write
UpdateNotebook	Grants permission to update notebooks			Write
UpdateProject	Grants permission to update a Project that enables your team to publish and subscribe to data			Write
UpdateProjectProfile	Grants permission to update a project profile			Write
UpdateRule	Grants permission to update rule			Write
UpdateSubscriptionGrantStatus	Grants permission to update a subscription grant status for custom grants			Write
UpdateSubscriptionRequest	Grants permission to update business reason for subscription request for a Data Asset			Write
UpdateSubscriptionTarget	Grants permission to update a subscription target			Write
UpdateUserProfile	Grants permission to update a DataZone user profile			Write

Permission-only actions for Amazon DataZone

The following actions are defined by Amazon DataZone but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchDeleteLinkedTypes	Grants permission to remove linked type items from an Amazon DataZone Domain	domain*	aws:ResourceTag/${TagKey}	Write
BatchPutLinkedTypes	Grants permission to put linked type items to an Amazon DataZone Domain	domain*	aws:ResourceTag/${TagKey}	Write
DeleteDomainSharingPolicy	Grants permission to delete a resource policy for a DataZone Domain			Permissions management, Write
GetDomainExecutionRoleCredentials	Grants permission to use features that require access to domain execution role credentials			Read
GetDomainSharingPolicy	Grants permission to retrieve a resource policy for a DataZone Domain			Read
GetEnvironmentActionLink	Grants permission to get environment action link			Read
GetSubscriptionEligibility	Grants permission to get subscription eligibilty			Read
ListEnvironmentBlueprintConfigurationSummaries	Grants permission to list environment blueprint configuration summaries			List
ListLinkedTypes	Grants permission to list linked type items linked to an Amazon DataZone Domain	domain*	aws:ResourceTag/${TagKey}	List
ListWarehouseMetadata	Grants permission to list available Manager Secrets			List
ProvisionDomain	Grants permission to provision domain with default project setup			Write
PutDomainSharingPolicy	Grants permission to add a resource policy for a DataZone Domain			Permissions management, Write
RefreshToken	Grants permission to refresh token			Write
SearchRules	Grants permission to search rules			List
SsoLogin	Grants permission to login using SSO			Write
SsoLogout	Grants permission to logout as SSO user			Write
StartAccountBootstrapAction	Grants permission to start account bootstrap action for a domain	domain*	aws:ResourceTag/${TagKey}	Write
UpdateDataSourceRunActivities	Grants permission to update data source run activities			Write
UpdateEnvironmentConfiguration	Grants permission to update environment configuration			Write
UpdateEnvironmentDeploymentStatus	Grants permission to update status of the Environment deployment			Write
ValidatePassRole	Grants permission to validate pass role			Write

Resource types defined by Amazon DataZone

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
domain	arn:${Partition}:datazone:${Region}:${Account}:domain/${DomainId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon DataZone

Amazon DataZone defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
datazone:domainId	Filters access by the domain ID passed in the request	String
datazone:projectId	Filters access by the project ID passed in the request	String
datazone:userId	Filters access by the user ID passed in the request	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Data Lifecycle Manager (dlm)

Amazon Detective (detective)