Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon FinSpace

Amazon FinSpace (service prefix: finspace) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon FinSpace
Actions defined by Amazon FinSpace
Permission-only actions for Amazon FinSpace
Resource types defined by Amazon FinSpace
Condition keys for Amazon FinSpace

API operations defined by Amazon FinSpace

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateEnvironment	finspace:CreateEnvironment			Write
CreateEnvironment	finspace:TagResource			Tagging, Write
CreateKxChangeset	finspace:CreateKxChangeset			Write
CreateKxCluster	finspace:CreateKxCluster			Write
CreateKxCluster	finspace:TagResource			Tagging, Write
CreateKxDatabase	finspace:CreateKxDatabase			Write
CreateKxDatabase	finspace:TagResource			Tagging, Write
CreateKxDataview	finspace:CreateKxDataview			Write
CreateKxDataview	finspace:TagResource			Tagging, Write
CreateKxEnvironment	finspace:CreateKxEnvironment			Write
CreateKxEnvironment	finspace:TagResource			Tagging, Write
CreateKxScalingGroup	finspace:CreateKxScalingGroup			Write
CreateKxScalingGroup	finspace:TagResource			Tagging, Write
CreateKxUser	finspace:CreateKxUser			Write
	finspace:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	finspace.amazonaws.com	Write
CreateKxVolume	finspace:CreateKxVolume			Write
CreateKxVolume	finspace:TagResource			Tagging, Write
DeleteEnvironment	finspace:DeleteEnvironment			Write
DeleteKxCluster	finspace:DeleteKxCluster			Write
DeleteKxClusterNode	finspace:DeleteKxClusterNode			Write
DeleteKxDatabase	finspace:DeleteKxDatabase			Write
DeleteKxDataview	finspace:DeleteKxDataview			Write
DeleteKxEnvironment	finspace:DeleteKxEnvironment			Write
DeleteKxScalingGroup	finspace:DeleteKxScalingGroup			Write
DeleteKxUser	finspace:DeleteKxUser			Write
DeleteKxVolume	finspace:DeleteKxVolume			Write
GetEnvironment	finspace:GetEnvironment			Read
GetKxChangeset	finspace:GetKxChangeset			Read
GetKxCluster	finspace:GetKxCluster			Read
GetKxConnectionString	finspace:GetKxConnectionString			Read
GetKxDatabase	finspace:GetKxDatabase			Read
GetKxDataview	finspace:GetKxDataview			Read
GetKxEnvironment	finspace:GetKxEnvironment			Read
GetKxScalingGroup	finspace:GetKxScalingGroup			Read
GetKxUser	finspace:GetKxUser			Read
GetKxVolume	finspace:GetKxVolume			Read
ListEnvironments	finspace:ListEnvironments			List
ListKxChangesets	finspace:ListKxChangesets			List
ListKxClusterNodes	finspace:ListKxClusterNodes			List
ListKxClusters	finspace:ListKxClusters			List
ListKxDatabases	finspace:ListKxDatabases			List
ListKxDataviews	finspace:ListKxDataviews			List
ListKxEnvironments	finspace:ListKxEnvironments			List
ListKxScalingGroups	finspace:ListKxScalingGroups			List
ListKxUsers	finspace:ListKxUsers			List
ListKxVolumes	finspace:ListKxVolumes			List
ListTagsForResource	finspace:ListTagsForResource			List
TagResource	finspace:TagResource			Tagging, Write
UntagResource	finspace:UntagResource			Tagging, Write
UpdateEnvironment	finspace:UpdateEnvironment			Write
UpdateKxClusterCodeConfiguration	finspace:UpdateKxClusterCodeConfiguration			Write
UpdateKxClusterDatabases	finspace:UpdateKxClusterDatabases			Write
UpdateKxDatabase	finspace:UpdateKxDatabase			Write
UpdateKxDataview	finspace:UpdateKxDataview			Write
UpdateKxEnvironment	finspace:UpdateKxEnvironment			Write
UpdateKxEnvironmentNetwork	finspace:UpdateKxEnvironmentNetwork			Write
UpdateKxUser	finspace:UpdateKxUser			Write
UpdateKxUser	iam:PassRole	iam:PassedToService	finspace.amazonaws.com	Write
UpdateKxVolume	finspace:UpdateKxVolume			Write

Actions defined by Amazon FinSpace

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateEnvironment	Grants permission to create a FinSpace environment	environment*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateKxChangeset	Grants permission to create a changeset for a kdb database	kxDatabase*	aws:ResourceTag/${TagKey}	Write
CreateKxCluster	Grants permission to create a cluster in a managed kdb environment	kxCluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateKxDatabase	Grants permission to create a kdb database in a managed kdb environment	kxDatabase*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateKxDataview	Grants permission to create a dataview in a managed kdb environment	kxDataview*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateKxEnvironment	Grants permission to create a managed kdb environment		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateKxScalingGroup	Grants permission to create a scaling group in a managed kdb environment	kxScalingGroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateKxUser	Grants permission to create a user in a managed kdb environment	kxEnvironment*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateKxVolume	Grants permission to create a volume in a managed kdb environment	kxVolume*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateUser	Grants permission to create a FinSpace user	environment*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateUser	Grants permission to create a FinSpace user	user*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteEnvironment	Grants permission to delete a FinSpace environment	environment*	aws:ResourceTag/${TagKey}	Write
DeleteKxCluster	Grants permission to delete a kdb cluster	kxCluster*	aws:ResourceTag/${TagKey}	Write
DeleteKxClusterNode	Grants permission to delete a node from a kdb cluster	kxCluster*	aws:ResourceTag/${TagKey}	Write
DeleteKxDatabase	Grants permission to delete a kdb database	kxDatabase*	aws:ResourceTag/${TagKey}	Write
DeleteKxDataview	Grants permission to delete a dataview in a managed kdb environment	kxDataview*	aws:ResourceTag/${TagKey}	Write
DeleteKxEnvironment	Grants permission to delete a managed kdb environment	kxEnvironment*	aws:ResourceTag/${TagKey}	Write
DeleteKxScalingGroup	Grants permission to delete a scaling group in a managed kdb environment	kxScalingGroup*	aws:ResourceTag/${TagKey}	Write
DeleteKxUser	Grants permission to delete a kdb user	kxUser*	aws:ResourceTag/${TagKey}	Write
DeleteKxVolume	Grants permission to delete a volume in a managed kdb environment	kxVolume*	aws:ResourceTag/${TagKey}	Write
GetEnvironment	Grants permission to describe a FinSpace environment	environment*	aws:ResourceTag/${TagKey}	Read
GetKxChangeset	Grants permission to describe a changeset for a kdb database	kxDatabase*	aws:ResourceTag/${TagKey}	Read
GetKxCluster	Grants permission to describe a cluster in a managed kdb environment	kxCluster*	aws:ResourceTag/${TagKey}	Read
GetKxConnectionString	Grants permission to retrieve a connection string for kdb clusters	kxCluster*	aws:ResourceTag/${TagKey}	Read
GetKxDatabase	Grants permission to describe a kdb database	kxDatabase*	aws:ResourceTag/${TagKey}	Read
GetKxDataview	Grants permission to describe a databiew in a managed kdb environment	kxDataview*	aws:ResourceTag/${TagKey}	Read
GetKxEnvironment	Grants permission to describe a managed kdb environment	kxEnvironment*	aws:ResourceTag/${TagKey}	Read
GetKxScalingGroup	Grants permission to describe a scaling group in a managed kdb environment	kxScalingGroup*	aws:ResourceTag/${TagKey}	Read
GetKxUser	Grants permission to describe a kdb user	kxUser*	aws:ResourceTag/${TagKey}	Read
GetKxVolume	Grants permission to describe a volume in a managed kdb environment	kxVolume*	aws:ResourceTag/${TagKey}	Read
GetLoadSampleDataSetGroupIntoEnvironmentStatus	Grants permission to request status of the loading of sample data bundle	environment*	aws:ResourceTag/${TagKey}	Read
GetUser	Grants permission to describe a FinSpace user	environment*	aws:ResourceTag/${TagKey}	Read
GetUser	Grants permission to describe a FinSpace user	user*	aws:ResourceTag/${TagKey}	Read
ListEnvironments	Grants permission to list FinSpace environments in the AWS account	environment*	aws:ResourceTag/${TagKey}	List
ListKxChangesets	Grants permission to list changesets for a kdb database	kxDatabase*	aws:ResourceTag/${TagKey}	List
ListKxClusterNodes	Grants permission to list cluster nodes in a managed kdb environment	kxCluster*	aws:ResourceTag/${TagKey}	List
ListKxClusters	Grants permission to list clusters in a managed kdb environment	kxEnvironment*	aws:ResourceTag/${TagKey}	List
ListKxDatabases	Grants permission to list kdb databases in a managed kdb environment	kxEnvironment*	aws:ResourceTag/${TagKey}	List
ListKxDataviews	Grants permission to list dataviews in a database	kxDatabase*	aws:ResourceTag/${TagKey}	List
ListKxEnvironments	Grants permission to list managed kdb environments			List
ListKxScalingGroups	Grants permission to list scaling groups in a managed kdb environment	kxEnvironment*	aws:ResourceTag/${TagKey}	List
ListKxUsers	Grants permission to list users in a managed kdb environment	kxEnvironment*	aws:ResourceTag/${TagKey}	List
ListKxVolumes	Grants permission to list volumes in a managed kdb environment	kxEnvironment*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to return a list of tags for a resource	environment*	aws:ResourceTag/${TagKey}	List
		kxCluster*	aws:ResourceTag/${TagKey}
		kxDatabase*	aws:ResourceTag/${TagKey}
		kxDataview*	aws:ResourceTag/${TagKey}
		kxEnvironment*	aws:ResourceTag/${TagKey}
		kxScalingGroup*	aws:ResourceTag/${TagKey}
		kxUser*	aws:ResourceTag/${TagKey}
		kxVolume*	aws:ResourceTag/${TagKey}
ListUsers	Grants permission to list FinSpace users in an environment	environment*	aws:ResourceTag/${TagKey}	List
ListUsers	Grants permission to list FinSpace users in an environment	user*	aws:ResourceTag/${TagKey}	List
LoadSampleDataSetGroupIntoEnvironment	Grants permission to load sample data bundle into your FinSpace environment	environment*	aws:ResourceTag/${TagKey}	Write
ResetUserPassword	Grants permission to reset the password for a FinSpace user	environment*	aws:ResourceTag/${TagKey}	Write
ResetUserPassword	Grants permission to reset the password for a FinSpace user	user*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag a resource	environment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		kxCluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		kxDatabase	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		kxDataview	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		kxEnvironment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		kxScalingGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		kxUser	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		kxVolume	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag a resource	environment	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		kxCluster	aws:ResourceTag/${TagKey} aws:TagKeys
		kxDatabase	aws:ResourceTag/${TagKey} aws:TagKeys
		kxDataview	aws:ResourceTag/${TagKey} aws:TagKeys
		kxEnvironment	aws:ResourceTag/${TagKey} aws:TagKeys
		kxScalingGroup	aws:ResourceTag/${TagKey} aws:TagKeys
		kxUser	aws:ResourceTag/${TagKey} aws:TagKeys
		kxVolume	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateEnvironment	Grants permission to update a FinSpace environment	environment*	aws:ResourceTag/${TagKey}	Write
UpdateKxClusterCodeConfiguration	Grants permission to update code configuration for a cluster in a managed kdb environment	kxCluster*	aws:ResourceTag/${TagKey}	Write
UpdateKxClusterDatabases	Grants permission to update databases for a cluster in a managed kdb environment	kxCluster*	aws:ResourceTag/${TagKey}	Write
UpdateKxDatabase	Grants permission to update a kdb database	kxDatabase*	aws:ResourceTag/${TagKey}	Write
UpdateKxDataview	Grants permission to update a dataview in a managed kdb environment	kxDataview*	aws:ResourceTag/${TagKey}	Write
UpdateKxEnvironment	Grants permission to update a managed kdb environment	kxEnvironment*	aws:ResourceTag/${TagKey}	Write
UpdateKxEnvironmentNetwork	Grants permission to update the network for a managed kdb environment	kxEnvironment*	aws:ResourceTag/${TagKey}	Write
UpdateKxUser	Grants permission to update a kdb user	kxUser*	aws:ResourceTag/${TagKey}	Write
UpdateKxVolume	Grants permission to update a volume in a managed kdb environment	kxVolume*	aws:ResourceTag/${TagKey}	Write
UpdateUser	Grants permission to update a FinSpace user	environment*	aws:ResourceTag/${TagKey}	Write
UpdateUser	Grants permission to update a FinSpace user	user*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon FinSpace

The following actions are defined by Amazon FinSpace but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
ConnectKxCluster	Grants permission to connect to a kdb cluster	kxCluster*	aws:ResourceTag/${TagKey}	Write
MountKxDatabase	Grants permission to mount a database to a kdb cluster	kxDatabase*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon FinSpace

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
environment	arn:${Partition}:finspace:${Region}:${Account}:environment/${EnvironmentId}	aws:ResourceTag/${TagKey}
kxCluster	arn:${Partition}:finspace:${Region}:${Account}:kxEnvironment/${EnvironmentId}/kxCluster/${KxCluster}	aws:ResourceTag/${TagKey}
kxDatabase	arn:${Partition}:finspace:${Region}:${Account}:kxEnvironment/${EnvironmentId}/kxDatabase/${KxDatabase}	aws:ResourceTag/${TagKey}
kxDataview	arn:${Partition}:finspace:${Region}:${Account}:kxEnvironment/${EnvironmentId}/kxDatabase/${KxDatabase}/kxDataview/${KxDataview}	aws:ResourceTag/${TagKey}
kxEnvironment	arn:${Partition}:finspace:${Region}:${Account}:kxEnvironment/${EnvironmentId}	aws:ResourceTag/${TagKey}
kxScalingGroup	arn:${Partition}:finspace:${Region}:${Account}:kxEnvironment/${EnvironmentId}/kxScalingGroup/${KxScalingGroup}	aws:ResourceTag/${TagKey}
kxUser	arn:${Partition}:finspace:${Region}:${Account}:kxEnvironment/${EnvironmentId}/kxUser/${UserName}	aws:ResourceTag/${TagKey}
kxVolume	arn:${Partition}:finspace:${Region}:${Account}:kxEnvironment/${EnvironmentId}/kxVolume/${KxVolume}	aws:ResourceTag/${TagKey}
user	arn:${Partition}:finspace:${Region}:${Account}:user/${UserId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon FinSpace

Amazon FinSpace defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon EventBridge Schemas (schemas)

Amazon FinSpace API (finspace-api)