Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS CloudWatch RUM

AWS CloudWatch RUM (service prefix: rum) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS CloudWatch RUM
Actions defined by AWS CloudWatch RUM
Resource types defined by AWS CloudWatch RUM
Condition keys for AWS CloudWatch RUM

API operations defined by AWS CloudWatch RUM

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
BatchCreateRumMetricDefinitions	rum:BatchCreateRumMetricDefinitions			Write
BatchDeleteRumMetricDefinitions	rum:BatchDeleteRumMetricDefinitions			Write
BatchGetRumMetricDefinitions	rum:BatchGetRumMetricDefinitions			Read
CreateAppMonitor	rum:CreateAppMonitor			Write
CreateAppMonitor	rum:TagResource			Tagging, Write
DeleteAppMonitor	rum:DeleteAppMonitor			Write
DeleteResourcePolicy	rum:DeleteResourcePolicy			Write
DeleteRumMetricsDestination	rum:DeleteRumMetricsDestination			Write
GetAppMonitor	rum:GetAppMonitor			Read
GetAppMonitorData	rum:GetAppMonitorData			Read
GetResourcePolicy	rum:GetResourcePolicy			Read
ListAppMonitors	rum:ListAppMonitors			List
ListRumMetricsDestinations	rum:ListRumMetricsDestinations			Read
ListTagsForResource	rum:ListTagsForResource			Read
PutResourcePolicy	rum:PutResourcePolicy			Write
PutRumEvents	rum:PutRumEvents			Write
PutRumMetricsDestination	rum:PutRumMetricsDestination			Write
PutRumMetricsDestination	iam:PassRole	iam:PassedToService	rum.amazonaws.com	Write
TagResource	rum:TagResource			Tagging, Write
UntagResource	rum:UntagResource			Tagging, Write
UpdateAppMonitor	rum:UpdateAppMonitor			Write
UpdateRumMetricDefinition	rum:UpdateRumMetricDefinition			Write

Actions defined by AWS CloudWatch RUM

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchCreateRumMetricDefinitions	Grants permission to create rum metric definitions	AppMonitorResource*	aws:ResourceTag/${TagKey}	Write
BatchDeleteRumMetricDefinitions	Grants permission to remove rum metric definitions	AppMonitorResource*	aws:ResourceTag/${TagKey}	Write
BatchGetRumMetricDefinitions	Grants permission to get rum metric definitions	AppMonitorResource*	aws:ResourceTag/${TagKey}	Read
CreateAppMonitor	Grants permission to create appMonitor metadata	AppMonitorResource*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAppMonitor	Grants permission to delete appMonitor metadata	AppMonitorResource*	aws:ResourceTag/${TagKey}	Write
DeleteResourcePolicy	Grants permission to delete a resource policy attached to an app monitor	AppMonitorResource*	aws:ResourceTag/${TagKey}	Write
DeleteRumMetricsDestination	Grants permission to delete rum metrics destinations	AppMonitorResource*	aws:ResourceTag/${TagKey}	Write
GetAppMonitor	Grants permission to get appMonitor metadata	AppMonitorResource*	aws:ResourceTag/${TagKey}	Read
GetAppMonitorData	Grants permission to get appMonitor data	AppMonitorResource*	aws:ResourceTag/${TagKey}	Read
GetResourcePolicy	Grants permission to retrieve a resource policy attached to an app monitor	AppMonitorResource*	aws:ResourceTag/${TagKey}	Read
ListAppMonitors	Grants permission to list appMonitors metadata			List
ListRumMetricsDestinations	Grants permission to list rum metrics destinations	AppMonitorResource*	aws:ResourceTag/${TagKey}	Read
ListTagsForResource	Grants permission to list tags for resources			Read
PutResourcePolicy	Grants permission to attach a resource policy to an app monitor	AppMonitorResource*	aws:ResourceTag/${TagKey}	Write
PutRumEvents	Grants permission to put RUM events for appmonitor	AppMonitorResource*	aws:ResourceTag/${TagKey}	Write
PutRumMetricsDestination	Grants permission to put rum metrics destinations	AppMonitorResource*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag resources	AppMonitorResource*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to untag resources	AppMonitorResource*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateAppMonitor	Grants permission to update appmonitor metadata	AppMonitorResource*	aws:ResourceTag/${TagKey}	Write
UpdateRumMetricDefinition	Grants permission to update rum metric definition	AppMonitorResource*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS CloudWatch RUM

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
AppMonitorResource	arn:${Partition}:rum:${Region}:${Account}:appmonitor/${Name}	aws:ResourceTag/${TagKey}

Condition keys for AWS CloudWatch RUM

AWS CloudWatch RUM defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed the request on behalf of the IAM principal	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource that make the request on behalf of the IAM principal	String
aws:TagKeys	Filters access by the tag keys that are passed in the request on behalf of the IAM principal	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS CloudTrail Data (cloudtrail-data)

AWS CodeArtifact (codeartifact)