Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS IoT Managed Integrations

AWS IoT Managed Integrations (service prefix: iotmanagedintegrations) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS IoT Managed Integrations
Actions defined by AWS IoT Managed Integrations
Resource types defined by AWS IoT Managed Integrations
Condition keys for AWS IoT Managed Integrations

API operations defined by AWS IoT Managed Integrations

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
CreateAccountAssociation	iotmanagedintegrations:CreateAccountAssociation	Write
CreateAccountAssociation	iotmanagedintegrations:TagResource	Tagging, Write
CreateCloudConnector	iotmanagedintegrations:CreateCloudConnector	Write
CreateConnectorDestination	iotmanagedintegrations:CreateConnectorDestination	Write
CreateCredentialLocker	iotmanagedintegrations:CreateCredentialLocker	Write
CreateCredentialLocker	iotmanagedintegrations:TagResource	Tagging, Write
CreateDestination	iotmanagedintegrations:CreateDestination	Write
CreateDestination	iam:PassRole	Write
CreateEventLogConfiguration	iotmanagedintegrations:CreateEventLogConfiguration	Write
CreateManagedThing	iotmanagedintegrations:CreateManagedThing	Write
CreateManagedThing	iotmanagedintegrations:TagResource	Tagging, Write
CreateNotificationConfiguration	iotmanagedintegrations:CreateNotificationConfiguration	Write
CreateOtaTask	iotmanagedintegrations:CreateOtaTask	Write
CreateOtaTask	iotmanagedintegrations:TagResource	Tagging, Write
CreateOtaTaskConfiguration	iotmanagedintegrations:CreateOtaTaskConfiguration	Write
CreateProvisioningProfile	iotmanagedintegrations:CreateProvisioningProfile	Write
CreateProvisioningProfile	iotmanagedintegrations:TagResource	Tagging, Write
DeleteAccountAssociation	iotmanagedintegrations:DeleteAccountAssociation	Write
DeleteCloudConnector	iotmanagedintegrations:DeleteCloudConnector	Write
DeleteConnectorDestination	iotmanagedintegrations:DeleteConnectorDestination	Write
DeleteCredentialLocker	iotmanagedintegrations:DeleteCredentialLocker	Write
DeleteDestination	iotmanagedintegrations:DeleteDestination	Write
DeleteEventLogConfiguration	iotmanagedintegrations:DeleteEventLogConfiguration	Write
DeleteManagedThing	iotmanagedintegrations:DeleteManagedThing	Write
DeleteNotificationConfiguration	iotmanagedintegrations:DeleteNotificationConfiguration	Write
DeleteOtaTask	iotmanagedintegrations:DeleteOtaTask	Write
DeleteOtaTaskConfiguration	iotmanagedintegrations:DeleteOtaTaskConfiguration	Write
DeleteProvisioningProfile	iotmanagedintegrations:DeleteProvisioningProfile	Write
DeregisterAccountAssociation	iotmanagedintegrations:DeregisterAccountAssociation	Write
GetAccountAssociation	iotmanagedintegrations:GetAccountAssociation	Read
GetCloudConnector	iotmanagedintegrations:GetCloudConnector	Read
GetConnectorDestination	iotmanagedintegrations:GetConnectorDestination	Read
GetCredentialLocker	iotmanagedintegrations:GetCredentialLocker	Read
GetCustomEndpoint	iotmanagedintegrations:GetCustomEndpoint	Read
GetDefaultEncryptionConfiguration	iotmanagedintegrations:GetDefaultEncryptionConfiguration	Read
GetDestination	iotmanagedintegrations:GetDestination	Read
GetDeviceDiscovery	iotmanagedintegrations:GetDeviceDiscovery	Read
GetEventLogConfiguration	iotmanagedintegrations:GetEventLogConfiguration	Read
GetHubConfiguration	iotmanagedintegrations:GetHubConfiguration	Read
GetManagedThing	iotmanagedintegrations:GetManagedThing	Read
GetManagedThingCapabilities	iotmanagedintegrations:GetManagedThingCapabilities	Read
GetManagedThingConnectivityData	iotmanagedintegrations:GetManagedThingConnectivityData	Read
GetManagedThingMetaData	iotmanagedintegrations:GetManagedThingMetaData	Read
GetManagedThingState	iotmanagedintegrations:GetManagedThingState	Read
GetNotificationConfiguration	iotmanagedintegrations:GetNotificationConfiguration	Read
GetOtaTask	iotmanagedintegrations:GetOtaTask	Read
GetOtaTaskConfiguration	iotmanagedintegrations:GetOtaTaskConfiguration	Read
GetProvisioningProfile	iotmanagedintegrations:GetProvisioningProfile	Read
GetRuntimeLogConfiguration	iotmanagedintegrations:GetRuntimeLogConfiguration	Read
GetSchemaVersion	iotmanagedintegrations:GetSchemaVersion	Read
ListAccountAssociations	iotmanagedintegrations:ListAccountAssociations	List
ListCloudConnectors	iotmanagedintegrations:ListCloudConnectors	List
ListConnectorDestinations	iotmanagedintegrations:ListConnectorDestinations	List
ListCredentialLockers	iotmanagedintegrations:ListCredentialLockers	List
ListDestinations	iotmanagedintegrations:ListDestinations	List
ListDeviceDiscoveries	iotmanagedintegrations:ListDeviceDiscoveries	List
ListDiscoveredDevices	iotmanagedintegrations:ListDiscoveredDevices	Read
ListEventLogConfigurations	iotmanagedintegrations:ListEventLogConfigurations	Read
ListManagedThingAccountAssociations	iotmanagedintegrations:ListManagedThingAccountAssociations	List
ListManagedThingSchemas	iotmanagedintegrations:ListManagedThingSchemas	Read
ListManagedThings	iotmanagedintegrations:ListManagedThings	List
ListNotificationConfigurations	iotmanagedintegrations:ListNotificationConfigurations	Read
ListOtaTaskConfigurations	iotmanagedintegrations:ListOtaTaskConfigurations	Read
ListOtaTaskExecutions	iotmanagedintegrations:ListOtaTaskExecutions	Read
ListOtaTasks	iotmanagedintegrations:ListOtaTasks	List
ListProvisioningProfiles	iotmanagedintegrations:ListProvisioningProfiles	List
ListSchemaVersions	iotmanagedintegrations:ListSchemaVersions	List
ListTagsForResource	iotmanagedintegrations:ListTagsForResource	Read
PutDefaultEncryptionConfiguration	iotmanagedintegrations:PutDefaultEncryptionConfiguration	Write
PutHubConfiguration	iotmanagedintegrations:PutHubConfiguration	Write
PutRuntimeLogConfiguration	iotmanagedintegrations:PutRuntimeLogConfiguration	Write
RegisterAccountAssociation	iotmanagedintegrations:RegisterAccountAssociation	Write
RegisterCustomEndpoint	iotmanagedintegrations:RegisterCustomEndpoint	Write
ResetRuntimeLogConfiguration	iotmanagedintegrations:ResetRuntimeLogConfiguration	Write
SendConnectorEvent	iotmanagedintegrations:SendConnectorEvent	Write
SendManagedThingCommand	iotmanagedintegrations:SendManagedThingCommand	Write
StartAccountAssociationRefresh	iotmanagedintegrations:StartAccountAssociationRefresh	Write
StartDeviceDiscovery	iotmanagedintegrations:StartDeviceDiscovery	Write
TagResource	iotmanagedintegrations:TagResource	Tagging, Write
UntagResource	iotmanagedintegrations:UntagResource	Tagging, Write
UpdateAccountAssociation	iotmanagedintegrations:UpdateAccountAssociation	Write
UpdateCloudConnector	iotmanagedintegrations:UpdateCloudConnector	Write
UpdateConnectorDestination	iotmanagedintegrations:UpdateConnectorDestination	Write
UpdateDestination	iotmanagedintegrations:UpdateDestination	Write
UpdateEventLogConfiguration	iotmanagedintegrations:UpdateEventLogConfiguration	Write
UpdateManagedThing	iotmanagedintegrations:UpdateManagedThing	Write
UpdateNotificationConfiguration	iotmanagedintegrations:UpdateNotificationConfiguration	Write
UpdateOtaTask	iotmanagedintegrations:UpdateOtaTask	Write

Actions defined by AWS IoT Managed Integrations

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateAccountAssociation	Grants permission to create a new account association		aws:RequestTag/${TagKey} aws:TagKeys iotmanagedintegrations:connectorDestinationId	Write
CreateCloudConnector	Grants permission to create a new cloud connector			Write
CreateConnectorDestination	Grants permission to create a new connector destination		iotmanagedintegrations:cloudConnectorId	Write
CreateCredentialLocker	Grants permission to create a product credential locker		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDestination	Grants permission to create a new destination			Write
CreateEventLogConfiguration	Grants permission to create a new event configuration			Write
CreateManagedThing	Grants permission to create a new managed thing	credential-locker	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateNotificationConfiguration	Grants permission to create a new notification configuration			Write
CreateOtaTask	Grants permission to create a new ota task		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateOtaTaskConfiguration	Grants permission to create a new ota task configuration			Write
CreateProvisioningProfile	Grants permission to create a new provisioning profile		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteAccountAssociation	Grants permission to delete an account association	account-association*	aws:ResourceTag/${TagKey}	Write
DeleteCloudConnector	Grants permission to delete a cloud connector		iotmanagedintegrations:cloudConnectorId	Write
DeleteConnectorDestination	Grants permission to delete a connector destination			Write
DeleteCredentialLocker	Grants permission to delete a credential locker	credential-locker*	aws:ResourceTag/${TagKey}	Write
DeleteDestination	Grants permission to delete destination			Write
DeleteEventLogConfiguration	Grants permission to delete event log configuration			Write
DeleteManagedThing	Grants permission to delete managed thing	managed-thing*	aws:ResourceTag/${TagKey}	Write
DeleteNotificationConfiguration	Grants permission to delete notification configuration			Write
DeleteOtaTask	Grants permission to delete ota task	ota-task*	aws:ResourceTag/${TagKey}	Write
DeleteOtaTaskConfiguration	Grants permission to delete ota task configuration			Write
DeleteProvisioningProfile	Grants permission to delete provisioning profile	provisioning-profile*	aws:ResourceTag/${TagKey}	Write
DeregisterAccountAssociation	Grants permission to deregister account association	account-association*	aws:ResourceTag/${TagKey}	Write
DeregisterAccountAssociation	Grants permission to deregister account association	managed-thing*	aws:ResourceTag/${TagKey}	Write
GetAccountAssociation	Grants permission to get information about an account association	account-association*	aws:ResourceTag/${TagKey}	Read
GetCloudConnector	Grants permission to get information about a cloud connector			Read
GetConnectorDestination	Grants permission to get information about a cloud destination			Read
GetCredentialLocker	Grants permission to get information about a credential locker	credential-locker*	aws:ResourceTag/${TagKey}	Read
GetCustomEndpoint	Grants permission to get information about a custom endpoint			Read
GetDefaultEncryptionConfiguration	Grants permission to get information about a default encryption configuration			Read
GetDestination	Grants permission to get information about a destination			Read
GetDeviceDiscovery	Grants permission to get information about a device discovery			Read
GetEventLogConfiguration	Grants permission to get information about an event log configuration			Read
GetHubConfiguration	Grants permission to get information about a hub configuration			Read
GetManagedThing	Grants permission to get information about a managed thing	managed-thing*	aws:ResourceTag/${TagKey}	Read
GetManagedThingCapabilities	Grants permission to get the capability report for a managed thing	managed-thing*	aws:ResourceTag/${TagKey}	Read
GetManagedThingCertificate	Grants permission to get the certificate pem for a managed thing	managed-thing*	aws:ResourceTag/${TagKey}	Read
GetManagedThingConnectivityData	Grants permission to get the connectivity data for a managed thing	managed-thing*	aws:ResourceTag/${TagKey}	Read
GetManagedThingMetaData	Grants permission to get the meta data information for a managed thing	managed-thing*	aws:ResourceTag/${TagKey}	Read
GetManagedThingState	Grants permission to get the device state information for a managed thing	managed-thing*	aws:ResourceTag/${TagKey}	Read
GetNotificationConfiguration	Grants permission to get information for a notification configuration			Read
GetOtaTask	Grants permission to get information for an ota task	ota-task*	aws:ResourceTag/${TagKey}	Read
GetOtaTaskConfiguration	Grants permission to get information for an ota task configuration			Read
GetProvisioningProfile	Grants permission to get information for a provisioning profile	provisioning-profile*	aws:ResourceTag/${TagKey}	Read
GetRuntimeLogConfiguration	Grants permission to get information for a runtime log configuration			Read
GetSchemaVersion	Grants permission to get information for a version of a schema			Read
ListAccountAssociations	Grants permission to list information for account associations			List
ListCloudConnectors	Grants permission to list information for cloud connectors			List
ListConnectorDestinations	Grants permission to list information for connector destinations			List
ListCredentialLockers	Grants permission to list information for credential lockers			List
ListDestinations	Grants permission to list information for destinations			List
ListDeviceDiscoveries	Grants permission to list information for device discoveries			List
ListDiscoveredDevices	Grants permission to list information for device discovered in a device discoveries			Read
ListEventLogConfigurations	Grants permission to list information for event log configurations			Read
ListManagedThingAccountAssociations	Grants permission to list information for associations between managed thing and account associations			List
ListManagedThingSchemas	Grants permission to list schemas associated with a managed thing	managed-thing*	aws:ResourceTag/${TagKey}	Read
ListManagedThings	Grants permission to list information for managed things			List
ListNotificationConfigurations	Grants permission to list information for notification configurations			Read
ListOtaTaskConfigurations	Grants permission to list information for ota task configurations			Read
ListOtaTaskExecutions	Grants permission to list information for ota task executions	ota-task*	aws:ResourceTag/${TagKey}	Read
ListOtaTasks	Grants permission to list information for ota tasks			List
ListProvisioningProfiles	Grants permission to list information for provisioning profiles			List
ListSchemaVersions	Grants permission to list information for schemas			List
ListTagsForResource	Grants permission to list tags for the specified resource	account-association	aws:ResourceTag/${TagKey}	Read
		credential-locker	aws:ResourceTag/${TagKey}
		managed-thing	aws:ResourceTag/${TagKey}
		ota-task	aws:ResourceTag/${TagKey}
		provisioning-profile	aws:ResourceTag/${TagKey}
PutDefaultEncryptionConfiguration	Grants permission to update the default settings for an encryption configuration			Write
PutHubConfiguration	Grants permission to update a hub configuration			Write
PutRuntimeLogConfiguration	Grants permission to update a runtime log configuration			Write
RegisterAccountAssociation	Grants permission to register an account association to a managed thing	account-association*	aws:ResourceTag/${TagKey}	Write
RegisterAccountAssociation		managed-thing*	aws:ResourceTag/${TagKey}	Write
RegisterCustomEndpoint	Grants permission to register a custom endpoint			Write
ResetRuntimeLogConfiguration	Grants permission to reset a runtime log configuration			Write
SendConnectorEvent	Grants permission to send a connector event			Write
SendManagedThingCommand	Grants permission to send a command to a managed thing	account-association	aws:ResourceTag/${TagKey}	Write
SendManagedThingCommand	Grants permission to send a command to a managed thing	managed-thing*	aws:ResourceTag/${TagKey}	Write
StartAccountAssociationRefresh	Grants permission to start a refresh of access tokens associated with an account association	account-association*	aws:ResourceTag/${TagKey}	Write
StartDeviceDiscovery	Grants permission to start a device discovery	account-association	aws:ResourceTag/${TagKey}	Write
StartDeviceDiscovery	Grants permission to start a device discovery	managed-thing	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add tags for the specified resource	account-association	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		credential-locker	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		managed-thing	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		ota-task	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		provisioning-profile	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags for the specified resource	account-association	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		credential-locker	aws:ResourceTag/${TagKey} aws:TagKeys
		managed-thing	aws:ResourceTag/${TagKey} aws:TagKeys
		ota-task	aws:ResourceTag/${TagKey} aws:TagKeys
		provisioning-profile	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAccountAssociation	Grants permission to update an account association	account-association*	aws:ResourceTag/${TagKey}	Write
UpdateCloudConnector	Grants permission to update a cloud connector		iotmanagedintegrations:cloudConnectorId	Write
UpdateConnectorDestination	Grants permission to update a connector destination			Write
UpdateDestination	Grants permission to update a destination			Write
UpdateEventLogConfiguration	Grants permission to update an event log configuration			Write
UpdateManagedThing	Grants permission to update a managed thing	credential-locker	aws:ResourceTag/${TagKey}	Write
UpdateManagedThing	Grants permission to update a managed thing	managed-thing*	aws:ResourceTag/${TagKey}	Write
UpdateNotificationConfiguration	Grants permission to update a notification configuration			Write
UpdateOtaTask	Grants permission to update an ota task	ota-task*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS IoT Managed Integrations

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
account-association	arn:${Partition}:iotmanagedintegrations:${Region}:${Account}:account-association/${AccountAssociationId}	aws:ResourceTag/${TagKey}
credential-locker	arn:${Partition}:iotmanagedintegrations:${Region}:${Account}:credential-locker/${Identifier}	aws:ResourceTag/${TagKey}
managed-thing	arn:${Partition}:iotmanagedintegrations:${Region}:${Account}:managed-thing/${Identifier}	aws:ResourceTag/${TagKey}
ota-task	arn:${Partition}:iotmanagedintegrations:${Region}:${Account}:ota-task/${Identifier}	aws:ResourceTag/${TagKey}
provisioning-profile	arn:${Partition}:iotmanagedintegrations:${Region}:${Account}:provisioning-profile/${Identifier}	aws:ResourceTag/${TagKey}

Condition keys for AWS IoT Managed Integrations

AWS IoT Managed Integrations defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a tag key and value pair that is allowed in the request	String
aws:ResourceTag/${TagKey}	Filters access by a tag key and value pair of a resource	String
aws:TagKeys	Filters access by tag keys that are passed in the request	ArrayOfString
iotmanagedintegrations:cloudConnectorId	Filters access by the CloudConnectorId	String
iotmanagedintegrations:connectorDestinationId	Filters access by the ConnectorDestinationId	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS IoT Jobs DataPlane (iotjobsdata)

AWS IoT SiteWise (iotsitewise)