Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Lex

Amazon Lex (service prefix: lex) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by Amazon Lex

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
CreateBotVersion	lex-models	lex:CreateBotVersion			Write
CreateSlotTypeVersion	lex-models	lex:CreateSlotTypeVersion			Write
DeleteBot	lex-models	lex:DeleteBot			Write
		lex:DeleteBotAlias			Write
		lex:DeleteBotChannel			Write
		lex:DeleteBotLocale			Write
		lex:DeleteBotVersion			Write
		lex:DeleteCustomVocabulary			Write
		lex:DeleteIntent			Write
		lex:DeleteResourcePolicy			Write
		lex:DeleteSlot			Write
		lex:DeleteSlotType			Write
DeleteBotAlias	lex-models	lex:DeleteBotAlias			Write
DeleteBotAlias	lex-models	lex:DeleteResourcePolicy			Write
DeleteBotChannelAssociation	lex-models	lex:DeleteBotChannelAssociation			Write
DeleteBotVersion	lex-models	lex:DeleteBotVersion			Write
DeleteIntent	lex-models	lex:DeleteIntent			Write
DeleteIntentVersion	lex-models	lex:DeleteIntentVersion			Write
DeleteSlotType	lex-models	lex:DeleteSlotType			Write
DeleteSlotTypeVersion	lex-models	lex:DeleteSlotTypeVersion			Write
DeleteUtterances	lex-models	lex:DeleteUtterances			Write
GetBot	lex-models	lex:GetBot			Read
GetBotAlias	lex-models	lex:GetBotAlias			Read
GetBotAliases	lex-models	lex:GetBotAliases			List
GetBotChannelAssociation	lex-models	lex:GetBotChannelAssociation			Read
GetBotChannelAssociations	lex-models	lex:GetBotChannelAssociations			List
GetBotVersions	lex-models	lex:GetBotVersions			List
GetBots	lex-models	lex:GetBots			List
GetBuiltinIntent	lex-models	lex:GetBuiltinIntent			Read
GetBuiltinIntents	lex-models	lex:GetBuiltinIntents			Read
GetBuiltinSlotTypes	lex-models	lex:GetBuiltinSlotTypes			Read
GetExport	lex-models	lex:GetExport			Read
GetImport	lex-models	lex:GetImport			Read
GetIntent	lex-models	lex:GetIntent			Read
GetIntentVersions	lex-models	lex:GetIntentVersions			List
GetIntents	lex-models	lex:GetIntents			List
GetMigration	lex-models	lex:GetMigration			Read
GetMigrations	lex-models	lex:GetMigrations			List
GetSlotType	lex-models	lex:GetSlotType			Read
GetSlotTypeVersions	lex-models	lex:GetSlotTypeVersions			List
GetSlotTypes	lex-models	lex:GetSlotTypes			List
GetUtterancesView	lex-models	lex:GetUtterancesView			List
ListTagsForResource	lex-models	lex:ListTagsForResource			Read
PutBot	lex-models	lex:PutBot			Write
PutBotAlias	lex-models	lex:PutBotAlias			Write
PutBotAlias	lex-models	lex:TagResource			Tagging, Write
PutIntent	lex-models	lex:PutIntent			Write
PutSlotType	lex-models	lex:PutSlotType			Write
StartImport	lex-models	lex:CreateBot			Write
		lex:CreateBotLocale			Write
		lex:CreateCustomVocabulary			Write
		lex:CreateIntent			Write
		lex:CreateSlot			Write
		lex:CreateSlotType			Write
		lex:CreateTestSet			Write
		lex:DeleteBotLocale			Write
		lex:DeleteCustomVocabulary			Write
		lex:DeleteIntent			Write
		lex:DeleteSlot			Write
		lex:DeleteSlotType			Write
		lex:StartImport			Write
		lex:TagResource			Tagging, Write
		lex:UpdateBot			Write
		lex:UpdateBotLocale			Write
		lex:UpdateCustomVocabulary			Write
		lex:UpdateIntent			Write
		lex:UpdateSlot			Write
		lex:UpdateSlotType			Write
		lex:UpdateTestSet			Write
		iam:PassRole	iam:PassedToService	lexv2.amazonaws.com	Write
TagResource	lex-models	lex:TagResource			Tagging, Write
UntagResource	lex-models	lex:UntagResource			Tagging, Write
DeleteSession	lex-runtime	lex:DeleteSession			Write
GetSession	lex-runtime	lex:GetSession			Read
PostContent	lex-runtime	lex:PostContent			Write
PostText	lex-runtime	lex:PostText			Write
PutSession	lex-runtime	lex:PutSession			Write

Actions defined by Amazon Lex

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateBotVersion	Creates a new version based on the $LATEST version of the specified bot	bot	aws:ResourceTag/${TagKey}	Write
CreateBotVersion		bot version*	aws:ResourceTag/${TagKey}	Write
CreateIntentVersion	Creates a new version based on the $LATEST version of the specified intent	intent version*		Write
CreateSlotTypeVersion	Creates a new version based on the $LATEST version of the specified slot type	slottype version*		Write
DeleteBot	Deletes all versions of a bot	bot	aws:ResourceTag/${TagKey}	Write
		bot alias	aws:ResourceTag/${TagKey}
		bot version*	aws:ResourceTag/${TagKey}
DeleteBotAlias	Deletes an alias for a specific bot	bot alias*	aws:ResourceTag/${TagKey}	Write
DeleteBotChannelAssociation	Deletes the association between a Amazon Lex bot alias and a messaging platform	channel*	aws:ResourceTag/${TagKey}	Write
DeleteBotVersion	Deletes a specific version of a bot	bot	aws:ResourceTag/${TagKey}	Write
DeleteBotVersion	Deletes a specific version of a bot	bot version*	aws:ResourceTag/${TagKey}	Write
DeleteIntent	Deletes all versions of an intent	bot	aws:ResourceTag/${TagKey}	Write
DeleteIntent	Deletes all versions of an intent	intent version*		Write
DeleteIntentVersion	Deletes a specific version of an intent	intent version*		Write
DeleteSession	Removes session information for a specified bot, alias, and user ID	bot alias	aws:ResourceTag/${TagKey}	Write
DeleteSession		bot version	aws:ResourceTag/${TagKey}	Write
DeleteSlotType	Deletes all versions of a slot type	bot	aws:ResourceTag/${TagKey}	Write
DeleteSlotType	Deletes all versions of a slot type	slottype version*		Write
DeleteSlotTypeVersion	Deletes a specific version of a slot type	slottype version*		Write
DeleteUtterances	Deletes the information Amazon Lex maintains for utterances on a specific bot and userId	bot	aws:ResourceTag/${TagKey}	Write
DeleteUtterances		bot version*	aws:ResourceTag/${TagKey}	Write
GetBot	Returns information for a specific bot. In addition to the bot name, the bot version or alias is required	bot alias	aws:ResourceTag/${TagKey}	Read
GetBot		bot version	aws:ResourceTag/${TagKey}	Read
GetBotAlias	Returns information about a Amazon Lex bot alias	bot alias*	aws:ResourceTag/${TagKey}	Read
GetBotAliases	Returns a list of aliases for a given Amazon Lex bot			List
GetBotChannelAssociation	Returns information about the association between a Amazon Lex bot and a messaging platform	channel*	aws:ResourceTag/${TagKey}	Read
GetBotChannelAssociations	Returns a list of all of the channels associated with a single bot	channel*	aws:ResourceTag/${TagKey}	List
GetBotVersions	Returns information for all versions of a specific bot	bot version*	aws:ResourceTag/${TagKey}	List
GetBots	Returns information for the $LATEST version of all bots, subject to filters provided by the client			List
GetBuiltinIntent	Returns information about a built-in intent			Read
GetBuiltinIntents	Gets a list of built-in intents that meet the specified criteria			Read
GetBuiltinSlotTypes	Gets a list of built-in slot types that meet the specified criteria			Read
GetExport	Exports Amazon Lex Resource in a requested format	bot version*	aws:ResourceTag/${TagKey}	Read
GetImport	Gets information about an import job started with StartImport			Read
GetIntent	Returns information for a specific intent. In addition to the intent name, you must also specify the intent version	intent version*		Read
GetIntentVersions	Returns information for all versions of a specific intent	intent version*		List
GetIntents	Returns information for the $LATEST version of all intents, subject to filters provided by the client			List
GetMigration	Grants permission to view an ongoing or completed migration			Read
GetMigrations	Grants permission to view list of migrations from Amazon Lex v1 to Amazon Lex v2			List
GetSession	Returns session information for a specified bot, alias, and user ID	bot alias	aws:ResourceTag/${TagKey}	Read
GetSession		bot version	aws:ResourceTag/${TagKey}	Read
GetSlotType	Returns information about a specific version of a slot type. In addition to specifying the slot type name, you must also specify the slot type version	slottype version*		Read
GetSlotTypeVersions	Returns information for all versions of a specific slot type	slottype version*		List
GetSlotTypes	Returns information for the $LATEST version of all slot types, subject to filters provided by the client			List
GetUtterancesView	Returns a view of aggregate utterance data for versions of a bot for a recent time period	bot version*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Lists tags for a Lex resource	bot	aws:ResourceTag/${TagKey}	Read
		bot alias	aws:ResourceTag/${TagKey}
		channel	aws:ResourceTag/${TagKey}
PostContent	Sends user input (text or speech) to Amazon Lex	bot alias	aws:ResourceTag/${TagKey}	Write
PostContent	Sends user input (text or speech) to Amazon Lex	bot version	aws:ResourceTag/${TagKey}	Write
PostText	Sends user input (text-only) to Amazon Lex	bot alias	aws:ResourceTag/${TagKey}	Write
PostText	Sends user input (text-only) to Amazon Lex	bot version	aws:ResourceTag/${TagKey}	Write
PutBot	Creates or updates the $LATEST version of a Amazon Lex conversational bot	bot version*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutBotAlias	Creates or updates an alias for the specific bot	bot alias*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutIntent	Creates or updates the $LATEST version of an intent	intent version*		Write
PutSession	Creates a new session or modifies an existing session with an Amazon Lex bot	bot alias	aws:ResourceTag/${TagKey}	Write
PutSession		bot version	aws:ResourceTag/${TagKey}	Write
PutSlotType	Creates or updates the $LATEST version of a slot type	slottype version*		Write
StartImport	Starts a job to import a resource to Amazon Lex	bot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
StartImport	Starts a job to import a resource to Amazon Lex	bot alias	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
StartMigration	Grants permission to migrate a bot from Amazon Lex v1 to Amazon Lex v2	bot version*	aws:ResourceTag/${TagKey}	Write
TagResource	Adds or overwrites tags to a Lex resource	bot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		bot alias	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		channel	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Removes tags from a Lex resource	bot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		bot alias	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		channel	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys

Resource types defined by Amazon Lex

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
bot	arn:${Partition}:lex:${Region}:${Account}:bot/${BotId}, arn:${Partition}:lex:${Region}:${Account}:bot:${BotName}	aws:ResourceTag/${TagKey}
bot alias	arn:${Partition}:lex:${Region}:${Account}:bot-alias/${BotId}/${BotAliasId}, arn:${Partition}:lex:${Region}:${Account}:bot:${BotName}:${BotAlias}	aws:ResourceTag/${TagKey}
bot version	arn:${Partition}:lex:${Region}:${Account}:bot:${BotName}:${BotVersion}	aws:ResourceTag/${TagKey}
channel	arn:${Partition}:lex:${Region}:${Account}:bot-channel:${BotName}:${BotAlias}:${ChannelName}	aws:ResourceTag/${TagKey}
intent version	arn:${Partition}:lex:${Region}:${Account}:intent:${IntentName}:${IntentVersion}
slottype version	arn:${Partition}:lex:${Region}:${Account}:slottype:${SlotName}:${SlotVersion}

Condition keys for Amazon Lex

Amazon Lex defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access based on the tags in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags attached to a Lex resource	String
aws:TagKeys	Filters access based on the set of tag keys in the request	ArrayOfString
lex:associatedIntents	Enables you to control access based on the intents included in the request	ArrayOfString
lex:associatedSlotTypes	Enables you to control access based on the slot types included in the request	ArrayOfString
lex:channelType	Enables you to control access based on the channel type included in the request	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Kinesis Video Streams (kinesisvideo)

Amazon Lex V2 (lex)