Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Global Accelerator

AWS Global Accelerator (service prefix: globalaccelerator) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Global Accelerator
Actions defined by AWS Global Accelerator
Resource types defined by AWS Global Accelerator
Condition keys for AWS Global Accelerator

API operations defined by AWS Global Accelerator

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AddCustomRoutingEndpoints	globalaccelerator:AddCustomRoutingEndpoints	Write
AddEndpoints	globalaccelerator:AddEndpoints	Write
AddEndpoints	globalaccelerator:UpdateEndpointGroup	Write
AdvertiseByoipCidr	globalaccelerator:AdvertiseByoipCidr	Write
AllowCustomRoutingTraffic	globalaccelerator:AllowCustomRoutingTraffic	Write
CreateAccelerator	globalaccelerator:CreateAccelerator	Write
CreateAccelerator	globalaccelerator:TagResource	Tagging, Write
CreateCrossAccountAttachment	globalaccelerator:CreateCrossAccountAttachment	Write
CreateCrossAccountAttachment	globalaccelerator:TagResource	Tagging, Write
CreateCustomRoutingAccelerator	globalaccelerator:CreateCustomRoutingAccelerator	Write
CreateCustomRoutingAccelerator	globalaccelerator:TagResource	Tagging, Write
CreateCustomRoutingEndpointGroup	globalaccelerator:CreateCustomRoutingEndpointGroup	Write
CreateCustomRoutingListener	globalaccelerator:CreateCustomRoutingListener	Write
CreateEndpointGroup	globalaccelerator:CreateEndpointGroup	Write
CreateListener	globalaccelerator:CreateListener	Write
DeleteAccelerator	globalaccelerator:DeleteAccelerator	Write
DeleteCrossAccountAttachment	globalaccelerator:DeleteCrossAccountAttachment	Write
DeleteCustomRoutingAccelerator	globalaccelerator:DeleteCustomRoutingAccelerator	Write
DeleteCustomRoutingEndpointGroup	globalaccelerator:DeleteCustomRoutingEndpointGroup	Write
DeleteCustomRoutingListener	globalaccelerator:DeleteCustomRoutingListener	Write
DeleteEndpointGroup	globalaccelerator:DeleteEndpointGroup	Write
DeleteListener	globalaccelerator:DeleteListener	Write
DenyCustomRoutingTraffic	globalaccelerator:DenyCustomRoutingTraffic	Write
DeprovisionByoipCidr	globalaccelerator:DeprovisionByoipCidr	Write
DescribeAccelerator	globalaccelerator:DescribeAccelerator	Read
DescribeAcceleratorAttributes	globalaccelerator:DescribeAcceleratorAttributes	Read
DescribeCrossAccountAttachment	globalaccelerator:DescribeCrossAccountAttachment	Read
DescribeCustomRoutingAccelerator	globalaccelerator:DescribeCustomRoutingAccelerator	Read
DescribeCustomRoutingAcceleratorAttributes	globalaccelerator:DescribeCustomRoutingAcceleratorAttributes	Read
DescribeCustomRoutingEndpointGroup	globalaccelerator:DescribeCustomRoutingEndpointGroup	Read
DescribeCustomRoutingListener	globalaccelerator:DescribeCustomRoutingListener	Read
DescribeEndpointGroup	globalaccelerator:DescribeEndpointGroup	Read
DescribeListener	globalaccelerator:DescribeListener	Read
ListAccelerators	globalaccelerator:ListAccelerators	List
ListByoipCidrs	globalaccelerator:ListByoipCidrs	List
ListCrossAccountAttachments	globalaccelerator:ListCrossAccountAttachments	List
ListCrossAccountResourceAccounts	globalaccelerator:ListCrossAccountResourceAccounts	List
ListCrossAccountResources	globalaccelerator:ListCrossAccountResources	List
ListCustomRoutingAccelerators	globalaccelerator:ListCustomRoutingAccelerators	List
ListCustomRoutingEndpointGroups	globalaccelerator:ListCustomRoutingEndpointGroups	List
ListCustomRoutingListeners	globalaccelerator:ListCustomRoutingListeners	List
ListCustomRoutingPortMappings	globalaccelerator:ListCustomRoutingPortMappings	List
ListCustomRoutingPortMappingsByDestination	globalaccelerator:ListCustomRoutingPortMappingsByDestination	List
ListEndpointGroups	globalaccelerator:ListEndpointGroups	List
ListListeners	globalaccelerator:ListListeners	List
ListTagsForResource	globalaccelerator:ListTagsForResource	Read
ProvisionByoipCidr	globalaccelerator:ProvisionByoipCidr	Write
RemoveCustomRoutingEndpoints	globalaccelerator:RemoveCustomRoutingEndpoints	Write
RemoveEndpoints	globalaccelerator:RemoveEndpoints	Write
RemoveEndpoints	globalaccelerator:UpdateEndpointGroup	Write
TagResource	globalaccelerator:TagResource	Tagging, Write
UntagResource	globalaccelerator:UntagResource	Tagging, Write
UpdateAccelerator	globalaccelerator:UpdateAccelerator	Write
UpdateAcceleratorAttributes	globalaccelerator:UpdateAcceleratorAttributes	Write
UpdateCrossAccountAttachment	globalaccelerator:UpdateCrossAccountAttachment	Write
UpdateCustomRoutingAccelerator	globalaccelerator:UpdateCustomRoutingAccelerator	Write
UpdateCustomRoutingAcceleratorAttributes	globalaccelerator:UpdateCustomRoutingAcceleratorAttributes	Write
UpdateCustomRoutingListener	globalaccelerator:UpdateCustomRoutingListener	Write
UpdateEndpointGroup	globalaccelerator:UpdateEndpointGroup	Write
UpdateListener	globalaccelerator:UpdateListener	Write
WithdrawByoipCidr	globalaccelerator:WithdrawByoipCidr	Write

Actions defined by AWS Global Accelerator

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddCustomRoutingEndpoints	Grants permission to add a virtual private cloud (VPC) subnet endpoint to a custom routing accelerator endpoint group	endpointgroup*	aws:ResourceTag/${TagKey}	Write
AddEndpoints	Grants permission to add an endpoint to a standard accelerator endpoint group	endpointgroup*	aws:ResourceTag/${TagKey}	Write
AdvertiseByoipCidr	Grants permission to advertises an IPv4 address range that is provisioned for use with your accelerator through bring your own IP addresses (BYOIP)			Write
AllowCustomRoutingTraffic	Grants permission to allows custom routing of user traffic to a private destination IP:PORT in a specific VPC subnet	endpointgroup*	aws:ResourceTag/${TagKey}	Write
CreateAccelerator	Grants permission to create a standard accelerator		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateCrossAccountAttachment	Grants permission to create a CrossAccountAttachment		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateCustomRoutingAccelerator	Grants permission to create a Custom Routing accelerator		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateCustomRoutingEndpointGroup	Grants permission to create an endpoint group for the specified listener for a custom routing accelerator	listener*	aws:ResourceTag/${TagKey}	Write
CreateCustomRoutingListener	Grants permission to create a listener to process inbound connections from clients to a custom routing accelerator	accelerator*	aws:ResourceTag/${TagKey}	Write
CreateEndpointGroup	Grants permission to add an endpoint group to a standard accelerator listener	listener*	aws:ResourceTag/${TagKey}	Write
CreateListener	Grants permission to add a listener to a standard accelerator	accelerator*	aws:ResourceTag/${TagKey}	Write
DeleteAccelerator	Grants permission to delete a standard accelerator	accelerator*	aws:ResourceTag/${TagKey}	Write
DeleteCrossAccountAttachment	Grants permission to delete a CrossAccountAttachment	attachment*	aws:ResourceTag/${TagKey}	Write
DeleteCustomRoutingAccelerator	Grants permission to delete a custom routing accelerator	accelerator*	aws:ResourceTag/${TagKey}	Write
DeleteCustomRoutingEndpointGroup	Grants permission to delete an endpoint group from a listener for a custom routing accelerator	endpointgroup*	aws:ResourceTag/${TagKey}	Write
DeleteCustomRoutingListener	Grants permission to delete a listener for a custom routing accelerator	listener*	aws:ResourceTag/${TagKey}	Write
DeleteEndpointGroup	Grants permission to delete an endpoint group associated with a standard accelerator listener	endpointgroup*	aws:ResourceTag/${TagKey}	Write
DeleteListener	Grants permission to delete a listener from a standard accelerator	listener*	aws:ResourceTag/${TagKey}	Write
DenyCustomRoutingTraffic	Grants permission to disallows custom routing of user traffic to a private destination IP:PORT in a specific VPC subnet	endpointgroup*	aws:ResourceTag/${TagKey}	Write
DeprovisionByoipCidr	Grants permission to releases the specified address range that you provisioned for use with your accelerator through bring your own IP addresses (BYOIP)			Write
DescribeAccelerator	Grants permissions to describe a standard accelerator	accelerator*	aws:ResourceTag/${TagKey}	Read
DescribeAcceleratorAttributes	Grants permission to describe a standard accelerator attributes	accelerator*	aws:ResourceTag/${TagKey}	Read
DescribeCrossAccountAttachment	Grants permissions to describe a CrossAccountAttachment	attachment*	aws:ResourceTag/${TagKey}	Read
DescribeCustomRoutingAccelerator	Grants permission to describe a custom routing accelerator	accelerator*	aws:ResourceTag/${TagKey}	Read
DescribeCustomRoutingAcceleratorAttributes	Grants permission to describe the attributes of a custom routing accelerator	accelerator*	aws:ResourceTag/${TagKey}	Read
DescribeCustomRoutingEndpointGroup	Grants permission to describe an endpoint group for a custom routing accelerator	endpointgroup*	aws:ResourceTag/${TagKey}	Read
DescribeCustomRoutingListener	Grants permission to describe a listener for a custom routing accelerator	listener*	aws:ResourceTag/${TagKey}	Read
DescribeEndpointGroup	Grants permission to describe a standard accelerator endpoint group	endpointgroup*	aws:ResourceTag/${TagKey}	Read
DescribeListener	Grants permission to describe a standard accelerator listener	listener*	aws:ResourceTag/${TagKey}	Read
ListAccelerators	Grants permission to list all standard accelerators			List
ListByoipCidrs	Grants permission to list the BYOIP cidrs			List
ListCrossAccountAttachments	Grants permission to list all CrossAccountAttachments			List
ListCrossAccountResourceAccounts	Grants permission to list accounts with CrossAccountAttachments listing caller as a principal			List
ListCrossAccountResources	Grants permission to list all CrossAccountAttachment resources usable by caller			List
ListCustomRoutingAccelerators	Grants permission to list the custom routing accelerators for an AWS account			List
ListCustomRoutingEndpointGroups	Grants permission to list the endpoint groups that are associated with a listener for a custom routing accelerator	listener*	aws:ResourceTag/${TagKey}	List
ListCustomRoutingListeners	Grants permission to list the listeners for a custom routing accelerator	accelerator*	aws:ResourceTag/${TagKey}	List
ListCustomRoutingPortMappings	Grants permission to list the port mappings for a custom routing accelerator	accelerator*	aws:ResourceTag/${TagKey}	List
ListCustomRoutingPortMappingsByDestination	Grants permission to list the port mappings for a specific endpoint IP address (a destination address) in a subnet			List
ListEndpointGroups	Grants permission to list all endpoint groups associated with a standard accelerator listener	listener*	aws:ResourceTag/${TagKey}	List
ListListeners	Grants permission to list all listeners associated with a standard accelerator	accelerator*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags for a globalaccelerator resource	accelerator	aws:ResourceTag/${TagKey}	Read
ListTagsForResource		attachment	aws:ResourceTag/${TagKey}	Read
ProvisionByoipCidr	Grants permission to provisions an address range for use with your accelerator through bring your own IP addresses (BYOIP)			Write
RemoveCustomRoutingEndpoints	Grants permission to remove virtual private cloud (VPC) subnet endpoints from a custom routing accelerator endpoint group	endpointgroup*	aws:ResourceTag/${TagKey}	Write
RemoveEndpoints	Grants permission to remove an endpoint from a standard accelerator endpoint group	endpointgroup*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add tags to a globalaccelerator resource	accelerator	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource		attachment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from a globalaccelerator resource	accelerator	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource		attachment	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateAccelerator	Grants permission to update a standard accelerator	accelerator*	aws:ResourceTag/${TagKey}	Write
UpdateAcceleratorAttributes	Grants permission to update a standard accelerator attributes	accelerator*	aws:ResourceTag/${TagKey}	Write
UpdateCrossAccountAttachment	Grants permission to update a CrossAccountAttachment	attachment*	aws:ResourceTag/${TagKey}	Write
UpdateCustomRoutingAccelerator	Grants permission to update a custom routing accelerator	accelerator*	aws:ResourceTag/${TagKey}	Write
UpdateCustomRoutingAcceleratorAttributes	Grants permission to update the attributes for a custom routing accelerator	accelerator*	aws:ResourceTag/${TagKey}	Write
UpdateCustomRoutingListener	Grants permission to update a listener for a custom routing accelerator	listener*	aws:ResourceTag/${TagKey}	Write
UpdateEndpointGroup	Grants permission to update an endpoint group on a standard accelerator listener	endpointgroup*	aws:ResourceTag/${TagKey}	Write
UpdateListener	Grants permission to update a listener on a standard accelerator	listener*	aws:ResourceTag/${TagKey}	Write
WithdrawByoipCidr	Grants permission to stops advertising a BYOIP IPv4 address			Write

Resource types defined by AWS Global Accelerator

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
accelerator	arn:${Partition}:globalaccelerator::${Account}:accelerator/${ResourceId}	aws:ResourceTag/${TagKey}
attachment	arn:${Partition}:globalaccelerator::${Account}:attachment/${ResourceId}	aws:ResourceTag/${TagKey}
endpointgroup	arn:${Partition}:globalaccelerator::${Account}:accelerator/${ResourceId}/listener/${ListenerId}/endpoint-group/${EndpointGroupId}	aws:ResourceTag/${TagKey}
listener	arn:${Partition}:globalaccelerator::${Account}:accelerator/${ResourceId}/listener/${ListenerId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Global Accelerator

AWS Global Accelerator defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Free Tier (freetier)

AWS Glue (glue)