Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon EventBridge Schemas

Amazon EventBridge Schemas (service prefix: schemas) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon EventBridge Schemas
Actions defined by Amazon EventBridge Schemas
Resource types defined by Amazon EventBridge Schemas
Condition keys for Amazon EventBridge Schemas

API operations defined by Amazon EventBridge Schemas

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
CreateDiscoverer	schemas:CreateDiscoverer	Write
CreateDiscoverer	schemas:TagResource	Tagging, Write
CreateRegistry	schemas:CreateRegistry	Write
CreateRegistry	schemas:TagResource	Tagging, Write
CreateSchema	schemas:CreateSchema	Write
CreateSchema	schemas:TagResource	Tagging, Write
DeleteDiscoverer	schemas:DeleteDiscoverer	Write
DeleteRegistry	schemas:DeleteRegistry	Write
DeleteResourcePolicy	schemas:DeleteResourcePolicy	Write
DeleteSchema	schemas:DeleteSchema	Write
DeleteSchemaVersion	schemas:DeleteSchemaVersion	Write
DescribeCodeBinding	schemas:DescribeCodeBinding	Read
DescribeDiscoverer	schemas:DescribeDiscoverer	Read
DescribeRegistry	schemas:DescribeRegistry	Read
DescribeSchema	schemas:DescribeSchema	Read
ExportSchema	schemas:ExportSchema	Read
GetCodeBindingSource	schemas:GetCodeBindingSource	Read
GetDiscoveredSchema	schemas:GetDiscoveredSchema	Read
GetResourcePolicy	schemas:GetResourcePolicy	Read
ListDiscoverers	schemas:ListDiscoverers	List
ListRegistries	schemas:ListRegistries	List
ListSchemaVersions	schemas:ListSchemaVersions	List
ListSchemas	schemas:ListSchemas	List
ListTagsForResource	schemas:ListTagsForResource	Read
PutCodeBinding	schemas:PutCodeBinding	Write
PutResourcePolicy	schemas:PutResourcePolicy	Write
SearchSchemas	schemas:SearchSchemas	List
StartDiscoverer	schemas:StartDiscoverer	Write
StopDiscoverer	schemas:StopDiscoverer	Write
TagResource	schemas:TagResource	Tagging, Write
UntagResource	schemas:UntagResource	Tagging, Write
UpdateDiscoverer	schemas:UpdateDiscoverer	Write
UpdateRegistry	schemas:UpdateRegistry	Write
UpdateSchema	schemas:UpdateSchema	Write

Actions defined by Amazon EventBridge Schemas

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateDiscoverer	Grants permission to create an event schema discoverer. Once created, your events will be automatically map into corresponding schema documents		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateRegistry	Grants permission to create a new schema registry in your account	registry*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSchema	Grants permission to create a new schema in your account	schema*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteDiscoverer	Grants permission to delete discoverer in your account	discoverer*	aws:ResourceTag/${TagKey}	Write
DeleteRegistry	Grants permission to delete an existing registry in your account	registry*	aws:ResourceTag/${TagKey}	Write
DeleteResourcePolicy	Grants permission to delete the resource-based policy attached to a given registry	registry*	aws:ResourceTag/${TagKey}	Write
DeleteSchema	Grants permission to delete an existing schema in your account	schema*	aws:ResourceTag/${TagKey}	Write
DeleteSchemaVersion	Grants permission to delete a specific version of schema in your account	schema*	aws:ResourceTag/${TagKey}	Write
DescribeCodeBinding	Grants permission to retrieve metadata for generated code for specific schema in your account	schema*	aws:ResourceTag/${TagKey}	Read
DescribeDiscoverer	Grants permission to retrieve discoverer metadata in your account	discoverer*	aws:ResourceTag/${TagKey}	Read
DescribeRegistry	Grants permission to describe an existing registry metadata in your account	registry*	aws:ResourceTag/${TagKey}	Read
DescribeSchema	Grants permission to retrieve an existing schema in your account	schema*	aws:ResourceTag/${TagKey}	Read
ExportSchema	Grants permission to export the AWS registry or discovered schemas in OpenAPI 3 format to JSONSchema format	registry*	aws:ResourceTag/${TagKey}	Read
ExportSchema		schema*	aws:ResourceTag/${TagKey}	Read
GetCodeBindingSource	Grants permission to retrieve metadata for generated code for specific schema in your account	schema*	aws:ResourceTag/${TagKey}	Read
GetDiscoveredSchema	Grants permission to retrieve a schema for the provided list of sample events			Read
GetResourcePolicy	Grants permission to retrieve the resource-based policy attached to a given registry	registry*	aws:ResourceTag/${TagKey}	Read
ListDiscoverers	Grants permission to list all discoverers in your account	discoverer*	aws:ResourceTag/${TagKey}	List
ListRegistries	Grants permission to list all registries in your account	registry*	aws:ResourceTag/${TagKey}	List
ListSchemaVersions	Grants permission to list all versions of a schema	schema*	aws:ResourceTag/${TagKey}	List
ListSchemas	Grants permission to list all schemas	schema*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to lists tags for a resource	discoverer	aws:ResourceTag/${TagKey}	Read
		registry	aws:ResourceTag/${TagKey}
		schema	aws:ResourceTag/${TagKey}
PutCodeBinding	Grants permission to generate code for specific schema in your account	schema*	aws:ResourceTag/${TagKey}	Write
PutResourcePolicy	Grants permission to attach a resource-based policy to a given registry	registry*	aws:ResourceTag/${TagKey}	Write
SearchSchemas	Grants permission to search schemas based on specified keywords in your account	schema*	aws:ResourceTag/${TagKey}	List
StartDiscoverer	Grants permission to start the specified discoverer. Once started the discoverer will automatically register schemas for published events to configured source in your account	discoverer*	aws:ResourceTag/${TagKey}	Write
StopDiscoverer	Grants permission to stop the specified discoverer. Once stopped the discoverer will no longer register schemas for published events to configured source in your account	discoverer*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag a resource	discoverer	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		registry	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		schema	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove a tag from a resource	discoverer	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		registry	aws:ResourceTag/${TagKey} aws:TagKeys
		schema	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateDiscoverer	Grants permission to update an existing discoverer in your account	discoverer*	aws:ResourceTag/${TagKey}	Write
UpdateRegistry	Grants permission to update an existing registry metadata in your account	registry*	aws:ResourceTag/${TagKey}	Write
UpdateSchema	Grants permission to update an existing schema in your account	schema*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon EventBridge Schemas

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
discoverer	arn:${Partition}:schemas:${Region}:${Account}:discoverer/${DiscovererId}	aws:ResourceTag/${TagKey}
registry	arn:${Partition}:schemas:${Region}:${Account}:registry/${RegistryName}	aws:ResourceTag/${TagKey}
schema	arn:${Partition}:schemas:${Region}:${Account}:schema/${RegistryName}/${SchemaName}	aws:ResourceTag/${TagKey}

Condition keys for Amazon EventBridge Schemas

Amazon EventBridge Schemas defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by allowed set of values for each of the tags	String
aws:ResourceTag/${TagKey}	Filters access by tag-value associated with the resource	String
aws:TagKeys	Filters access by the presence of mandatory tags in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon EventBridge Scheduler (scheduler)

Amazon FinSpace (finspace)