Actions, resources, and condition keys for Amazon One Enterprise
Amazon One Enterprise (service prefix: one) provides the following
service-specific operations, resources, actions, and condition keys for use in IAM permission
policies.
References:
-
Learn how to configure this service.
-
View a list of the API operations available for this service.
-
Learn how to secure this service and its resources by using IAM permission policies.
-
View the programmatic service authorization reference
for this service.
Topics
Actions defined by Amazon One Enterprise
You can specify the following actions in the Action element of an IAM
policy statement. Use policies to grant permissions to perform an operation in AWS. When
you use an action in a policy, you usually allow or deny access to the API operation or CLI
command with the same name. However, in some cases, a single action controls access to more
than one operation. Alternatively, some operations require several different actions.
| Actions | Description | Resource types (*required) | Condition keys | Access level |
|---|---|---|---|---|
Grants permission to create a QR code for a Device Instance |
Write |
|||
Grants permission to create a Device Configuration Template |
Write |
|||
Grants permission to create a Device Instance |
Write |
|||
Grants permission to create a Device Instance Configuration |
Write |
|||
Grants permission to create a Site |
Write |
|||
Grants permission to disassociate Device from a Device Instance |
Write |
|||
Grants permission to delete a Device Configuration Template |
Write |
|||
Grants permission to delete a Device Instance |
Write |
|||
Grants permission to delete a Site |
Write |
|||
Grants permission to delete a User |
Write |
|||
Grants permission to view a Device Configuration Template |
Read |
|||
Grants permission to view a Device Instance |
Read |
|||
Grants permission to view a Device Instance Configuration |
Read |
|||
Grants permission to view a Site |
Read |
|||
Grants permission to view address of a Site |
Read |
|||
Grants permission to retrieve list of Device Configuration Templates |
List |
|||
Grants permission to retrieve list of Device Instances |
List |
|||
Grants permission to view list of Sites |
List |
|||
Grants permission to list tags for an Amazon One Enterprise resource |
Read |
|||
Grants permission to view list of Users |
List |
|||
Grants permission to view list of Users |
List |
|||
Grants permission to reboot Device associated with a Device Instance |
Write |
|||
Grants permission to add tags to an Amazon One Enterprise resource |
Tagging, Write |
|||
Grants permission to remove tags from an Amazon One Enterprise resource |
Tagging, Write |
|||
Grants permission to update a Device Configuration Template |
Write |
|||
Grants permission to update a Device Instance |
Write |
|||
Grants permission to update a Site |
Write |
|||
Grants permission to update address of a Site |
Write |
Resource types defined by Amazon One Enterprise
The following resource types are defined by this service and can be used in the
Resource element of IAM permission policy statements.
| Resource types | ARN | Condition keys |
|---|---|---|
arn:${Partition}:one:${Region}:${Account}:device-instance/${DeviceInstanceId}/configuration/${Version} |
||
arn:${Partition}:one:${Region}:${Account}:device-configuration-template/${TemplateId} |
||
arn:${Partition}:one:${Region}:${Account}:device-instance/${DeviceInstanceId} |
||
arn:${Partition}:one:${Region}:${Account}:site/${SiteId} |
||
arn:${Partition}:one:${Region}:${Account}:user/${UserId} |
Condition keys for Amazon One Enterprise
Amazon One Enterprise defines the following condition keys that can be used in the
Condition element of an IAM policy.
| Condition keys | Description | Type |
|---|---|---|
Filters access by using tag key-value pairs in the request |
String |
|
Filters access by using tag key-value pairs attached to the resource |
String |
|
Filters access by the tag keys that are passed in the request |
ArrayOfString |
