Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon WorkMail

Amazon WorkMail (service prefix: workmail) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon WorkMail
Actions defined by Amazon WorkMail
Permission-only actions for Amazon WorkMail
Resource types defined by Amazon WorkMail
Condition keys for Amazon WorkMail

API operations defined by Amazon WorkMail

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateDelegateToResource	workmail:AssociateDelegateToResource			Write
AssociateMemberToGroup	workmail:AssociateMemberToGroup			Write
AssumeImpersonationRole	workmail:AssumeImpersonationRole			Write
CancelMailboxExportJob	workmail:CancelMailboxExportJob			Write
CreateAlias	workmail:CreateAlias			Write
CreateAvailabilityConfiguration	workmail:CreateAvailabilityConfiguration			Write
CreateGroup	workmail:CreateGroup			Write
CreateIdentityCenterApplication	workmail:CreateIdentityCenterApplication			Write
CreateImpersonationRole	workmail:CreateImpersonationRole			Write
CreateMobileDeviceAccessRule	workmail:CreateMobileDeviceAccessRule			Write
CreateOrganization	workmail:CreateOrganization			Write
CreateResource	workmail:CreateResource			Write
CreateUser	workmail:CreateUser			Write
DeleteAccessControlRule	workmail:DeleteAccessControlRule			Write
DeleteAlias	workmail:DeleteAlias			Write
DeleteAvailabilityConfiguration	workmail:DeleteAvailabilityConfiguration			Write
DeleteEmailMonitoringConfiguration	workmail:DeleteEmailMonitoringConfiguration			Write
DeleteGroup	workmail:DeleteGroup			Write
DeleteIdentityCenterApplication	workmail:DeleteIdentityCenterApplication			Write
DeleteIdentityProviderConfiguration	workmail:DeleteIdentityProviderConfiguration			Write
DeleteImpersonationRole	workmail:DeleteImpersonationRole			Write
DeleteMailboxPermissions	workmail:DeleteMailboxPermissions			Write
DeleteMobileDeviceAccessOverride	workmail:DeleteMobileDeviceAccessOverride			Write
DeleteMobileDeviceAccessRule	workmail:DeleteMobileDeviceAccessRule			Write
DeleteOrganization	workmail:DeleteOrganization			Write
DeletePersonalAccessToken	workmail:DeletePersonalAccessToken			Write
DeleteResource	workmail:DeleteResource			Write
DeleteRetentionPolicy	workmail:DeleteRetentionPolicy			Write
DeleteUser	workmail:DeleteUser			Write
DeregisterFromWorkMail	workmail:DeregisterFromWorkMail			Write
DeregisterMailDomain	workmail:DeregisterMailDomain			Write
DescribeEmailMonitoringConfiguration	workmail:DescribeEmailMonitoringConfiguration			Read
DescribeEntity	workmail:DescribeEntity			Read
DescribeGroup	workmail:DescribeGroup			List
DescribeIdentityProviderConfiguration	workmail:DescribeIdentityProviderConfiguration			Read
DescribeInboundDmarcSettings	workmail:DescribeInboundDmarcSettings			Read
DescribeMailboxExportJob	workmail:DescribeMailboxExportJob			Read
DescribeOrganization	workmail:DescribeOrganization			List
DescribeResource	workmail:DescribeResource			List
DescribeUser	workmail:DescribeUser			List
DisassociateDelegateFromResource	workmail:DisassociateDelegateFromResource			Write
DisassociateMemberFromGroup	workmail:DisassociateMemberFromGroup			Write
GetAccessControlEffect	workmail:GetAccessControlEffect			Read
GetDefaultRetentionPolicy	workmail:GetDefaultRetentionPolicy			Read
GetImpersonationRole	workmail:GetImpersonationRole			Read
GetImpersonationRoleEffect	workmail:GetImpersonationRoleEffect			Read
GetMailDomain	workmail:GetMailDomain			Read
GetMailboxDetails	workmail:GetMailboxDetails			Read
GetMobileDeviceAccessEffect	workmail:GetMobileDeviceAccessEffect			Read
GetMobileDeviceAccessOverride	workmail:GetMobileDeviceAccessOverride			Read
GetPersonalAccessTokenMetadata	workmail:GetPersonalAccessTokenMetadata			Read
ListAccessControlRules	workmail:ListAccessControlRules			Read
ListAliases	workmail:ListAliases			List
ListAvailabilityConfigurations	workmail:ListAvailabilityConfigurations			Read
ListGroupMembers	workmail:ListGroupMembers			List
ListGroups	workmail:ListGroups			List
ListGroupsForEntity	workmail:ListGroupsForEntity			List
ListImpersonationRoles	workmail:ListImpersonationRoles			List
ListMailDomains	workmail:ListMailDomains			List
ListMailboxExportJobs	workmail:ListMailboxExportJobs			List
ListMailboxPermissions	workmail:ListMailboxPermissions			List
ListMobileDeviceAccessOverrides	workmail:ListMobileDeviceAccessOverrides			Read
ListMobileDeviceAccessRules	workmail:ListMobileDeviceAccessRules			Read
ListOrganizations	workmail:ListOrganizations			List
ListPersonalAccessTokens	workmail:ListPersonalAccessTokens			List
ListResourceDelegates	workmail:ListResourceDelegates			List
ListResources	workmail:ListResources			List
ListTagsForResource	workmail:ListTagsForResource			List
ListUsers	workmail:ListUsers			List
PutAccessControlRule	workmail:PutAccessControlRule			Write
PutEmailMonitoringConfiguration	workmail:PutEmailMonitoringConfiguration			Write
PutEmailMonitoringConfiguration	iam:PassRole	iam:PassedToService	events.workmail.amazonaws.com	Write
PutIdentityProviderConfiguration	workmail:PutIdentityProviderConfiguration			Write
PutInboundDmarcSettings	workmail:PutInboundDmarcSettings			Write
PutMailboxPermissions	workmail:PutMailboxPermissions			Write
PutMobileDeviceAccessOverride	workmail:PutMobileDeviceAccessOverride			Write
PutRetentionPolicy	workmail:PutRetentionPolicy			Write
RegisterMailDomain	workmail:RegisterMailDomain			Write
RegisterToWorkMail	workmail:RegisterToWorkMail			Write
ResetPassword	workmail:ResetPassword			Write
StartMailboxExportJob	workmail:StartMailboxExportJob			Write
StartMailboxExportJob	iam:PassRole	iam:PassedToService	workmail.amazonaws.com	Write
TagResource	workmail:TagResource			Tagging, Write
TestAvailabilityConfiguration	workmail:TestAvailabilityConfiguration			Read
UntagResource	workmail:UntagResource			Tagging, Write
UpdateAvailabilityConfiguration	workmail:UpdateAvailabilityConfiguration			Write
UpdateDefaultMailDomain	workmail:UpdateDefaultMailDomain			Write
UpdateGroup	workmail:UpdateGroup			Write
UpdateImpersonationRole	workmail:UpdateImpersonationRole			Write
UpdateMailboxQuota	workmail:UpdateMailboxQuota			Write
UpdateMobileDeviceAccessRule	workmail:UpdateMobileDeviceAccessRule			Write
UpdatePrimaryEmailAddress	workmail:UpdatePrimaryEmailAddress			Write
UpdateResource	workmail:UpdateResource			Write
UpdateUser	workmail:UpdateUser			Write

Actions defined by Amazon WorkMail

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateDelegateToResource	Grants permission to add a member (user or group) to the resource's set of delegates	organization*	aws:ResourceTag/${TagKey}	Write
AssociateMemberToGroup	Grants permission to add a member (user or group) to the group's set	organization*	aws:ResourceTag/${TagKey}	Write
AssumeImpersonationRole	Grants permission to assume an impersonation role for the given Amazon WorkMail organization	organization*	aws:ResourceTag/${TagKey} workmail:ImpersonationRoleId	Write
CancelMailboxExportJob	Grants permission to cancel a currently running mailbox export job	organization*	aws:ResourceTag/${TagKey}	Write
CreateAlias	Grants permission to add an alias to the set of a given member (user or group) of WorkMail	organization*	aws:ResourceTag/${TagKey}	Write
CreateAvailabilityConfiguration	Grants permission to create an AvailabilityConfiguration for the given Amazon WorkMail organization and domain	organization*	aws:ResourceTag/${TagKey}	Write
CreateGroup	Grants permission to create a group that can be used in WorkMail by calling the RegisterToWorkMail operation	organization*	aws:ResourceTag/${TagKey}	Write
CreateIdentityCenterApplication	Grants permission to create an Identity Center application for WorkMail			Write
CreateImpersonationRole	Grants permission to create an impersonation role for the given Amazon WorkMail organization	organization*	aws:ResourceTag/${TagKey}	Write
CreateMobileDeviceAccessRule	Grants permission to create a new mobile device access rule	organization*	aws:ResourceTag/${TagKey}	Write
CreateOrganization	Grants permission to create a new Amazon WorkMail organization			Write
CreateResource	Grants permission to create a new WorkMail resource	organization*	aws:ResourceTag/${TagKey}	Write
CreateUser	Grants permission to create a user, which can be enabled afterwards by calling the RegisterToWorkMail operation	organization*	aws:ResourceTag/${TagKey}	Write
DeleteAccessControlRule	Grants permission to delete an access control rule	organization*	aws:ResourceTag/${TagKey}	Write
DeleteAlias	Grants permission to remove one or more specified aliases from a set of aliases for a given user	organization*	aws:ResourceTag/${TagKey}	Write
DeleteAvailabilityConfiguration	Grants permission to delete the AvailabilityConfiguration for the given Amazon WorkMail organization and domain	organization*	aws:ResourceTag/${TagKey}	Write
DeleteEmailMonitoringConfiguration	Grants permission to delete the email monitoring configuration for an organization	organization*	aws:ResourceTag/${TagKey}	Write
DeleteGroup	Grants permission to delete a group from WorkMail	organization*	aws:ResourceTag/${TagKey}	Write
DeleteIdentityCenterApplication	Grants permission to delete an Identity Center application for WorkMail			Write
DeleteIdentityProviderConfiguration	Grants permission to delete the identity provider configuration for the organization	organization*	aws:ResourceTag/${TagKey}	Write
DeleteImpersonationRole	Grants permission to delete an impersonation role for the given Amazon WorkMail organization	organization*	aws:ResourceTag/${TagKey}	Write
DeleteMailboxPermissions	Grants permission to delete permissions granted to a member (user or group)	organization*	aws:ResourceTag/${TagKey}	Write
DeleteMobileDeviceAccessOverride	Grants permission to delete a mobile device access override	organization*	aws:ResourceTag/${TagKey}	Write
DeleteMobileDeviceAccessRule	Grants permission to delete a mobile device access rule	organization*	aws:ResourceTag/${TagKey}	Write
DeleteOrganization	Grants permission to delete an Amazon WorkMail organization and all underlying AWS resources managed by Amazon WorkMail as part of the organization	organization*	aws:ResourceTag/${TagKey}	Write
DeletePersonalAccessToken	Grants permission to delete a personal access token	organization*	aws:ResourceTag/${TagKey}	Write
DeleteResource	Grants permission to delete the specified resource	organization*	aws:ResourceTag/${TagKey}	Write
DeleteRetentionPolicy	Grants permission to delete the retention policy based on the supplied organization and policy identifiers	organization*	aws:ResourceTag/${TagKey}	Write
DeleteUser	Grants permission to delete a user from WorkMail and all subsequent systems	organization*	aws:ResourceTag/${TagKey}	Write
DeregisterFromWorkMail	Grants permission to mark a user, group, or resource as no longer used in WorkMail	organization*	aws:ResourceTag/${TagKey}	Write
DeregisterMailDomain	Grants permission to deregister a mail domain from an organization	organization*	aws:ResourceTag/${TagKey}	Write
DescribeEmailMonitoringConfiguration	Grants permission to retrieve the email monitoring configuration for an organization	organization*	aws:ResourceTag/${TagKey}	Read
DescribeEntity	Grants permission to read details of an entity	organization*	aws:ResourceTag/${TagKey}	Read
DescribeGroup	Grants permission to read the details for a group	organization*	aws:ResourceTag/${TagKey}	List
DescribeIdentityProviderConfiguration	Grants permission to read the identity provider configuration for the organization	organization*	aws:ResourceTag/${TagKey}	Read
DescribeInboundDmarcSettings	Grants permission to read the settings in a DMARC policy for a specified organization	organization*	aws:ResourceTag/${TagKey}	Read
DescribeMailboxExportJob	Grants permission to retrieve details of a mailbox export job	organization*	aws:ResourceTag/${TagKey}	Read
DescribeOrganization	Grants permission to read details of an organization	organization*	aws:ResourceTag/${TagKey}	List
DescribeResource	Grants permission to read the details for a resource	organization*	aws:ResourceTag/${TagKey}	List
DescribeUser	Grants permission to read details for a user	organization*	aws:ResourceTag/${TagKey}	List
DisassociateDelegateFromResource	Grants permission to remove a member from the resource's set of delegates	organization*	aws:ResourceTag/${TagKey}	Write
DisassociateMemberFromGroup	Grants permission to remove a member from a group	organization*	aws:ResourceTag/${TagKey}	Write
GetAccessControlEffect	Grants permission to get the effects of access control rules as they apply to a specified IPv4 address, access protocol action, or user ID	organization*	aws:ResourceTag/${TagKey}	Read
GetDefaultRetentionPolicy	Grants permission to retrieve the retention policy associated at an organizational level	organization*	aws:ResourceTag/${TagKey}	Read
GetImpersonationRole	Grants permission to retrieve an impersonation role for the given Amazon WorkMail organization	organization*	aws:ResourceTag/${TagKey}	Read
GetImpersonationRoleEffect	Grants permission to get the effect of the rules associated to an impersonation role for a specific user	organization*	aws:ResourceTag/${TagKey}	Read
GetMailDomain	Grants permission to retrieve details of a given mail domain in an organization	organization*	aws:ResourceTag/${TagKey}	Read
GetMailboxDetails	Grants permission to read the details of the user's mailbox	organization*	aws:ResourceTag/${TagKey}	Read
GetMobileDeviceAccessEffect	Grants permission to simulate the effect of the mobile device access rules for the given attributes of a sample access event	organization*	aws:ResourceTag/${TagKey}	Read
GetMobileDeviceAccessOverride	Grants permission to retrieve a mobile device access override	organization*	aws:ResourceTag/${TagKey}	Read
GetPersonalAccessTokenMetadata	Grants permission to read metadata for a personal access token	organization*	aws:ResourceTag/${TagKey}	Read
ListAccessControlRules	Grants permission to list the access control rules	organization*	aws:ResourceTag/${TagKey}	Read
ListAliases	Grants permission to list the aliases associated with a given entity	organization*	aws:ResourceTag/${TagKey}	List
ListAvailabilityConfigurations	Grants permission to list all the AvailabilityConfiguration's for the given Amazon WorkMail organization	organization*	aws:ResourceTag/${TagKey}	Read
ListGroupMembers	Grants permission to read an overview of the members of a group. Users and groups can be members of a group	organization*	aws:ResourceTag/${TagKey}	List
ListGroups	Grants permission to list summaries of the organization's groups	organization*	aws:ResourceTag/${TagKey}	List
ListGroupsForEntity	Grants permission to list the groups to which an entity belongs	organization*	aws:ResourceTag/${TagKey}	List
ListImpersonationRoles	Grants permission to list the impersonation roles for the given Amazon WorkMail organization	organization*	aws:ResourceTag/${TagKey}	List
ListMailDomains	Grants permission to list the mail domains for a given organization	organization*	aws:ResourceTag/${TagKey}	List
ListMailboxExportJobs	Grants permission to list mailbox export jobs	organization*	aws:ResourceTag/${TagKey}	List
ListMailboxPermissions	Grants permission to list the mailbox permissions associated with a user, group, or resource mailbox	organization*	aws:ResourceTag/${TagKey}	List
ListMobileDeviceAccessOverrides	Grants permission to list the mobile device access overrides	organization*	aws:ResourceTag/${TagKey}	Read
ListMobileDeviceAccessRules	Grants permission to list the mobile device access rules	organization*	aws:ResourceTag/${TagKey}	Read
ListOrganizations	Grants permission to list the non-deleted organizations			List
ListPersonalAccessTokens	Grants permission to list metadata for personal access tokens	organization*	aws:ResourceTag/${TagKey}	List
ListResourceDelegates	Grants permission to list the delegates associated with a resource	organization*	aws:ResourceTag/${TagKey}	List
ListResources	Grants permission to list the organization's resources	organization*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list the tags applied to an Amazon WorkMail organization resource	organization*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	List
ListUsers	Grants permission to list the organization's users	organization*	aws:ResourceTag/${TagKey}	List
PutAccessControlRule	Grants permission to add a new access control rule	organization*	aws:ResourceTag/${TagKey}	Write
PutEmailMonitoringConfiguration	Grants permission to add or update the email monitoring configuration for an organization	organization*	aws:ResourceTag/${TagKey}	Write
PutIdentityProviderConfiguration	Grants permission to add or update the identity provider configuration for the organization	organization*	aws:ResourceTag/${TagKey}	Write
PutInboundDmarcSettings	Grants permission to enable or disable a DMARC policy for a given organization	organization*	aws:ResourceTag/${TagKey}	Write
PutMailboxPermissions	Grants permission to set permissions for a user, group, or resource, replacing any existing permissions	organization*	aws:ResourceTag/${TagKey}	Write
PutMobileDeviceAccessOverride	Grants permission to add or update a mobile device access override	organization*	aws:ResourceTag/${TagKey}	Write
PutRetentionPolicy	Grants permission to add or update the retention policy	organization*	aws:ResourceTag/${TagKey}	Write
RegisterMailDomain	Grants permission to register a new mail domain in an organization	organization*	aws:ResourceTag/${TagKey}	Write
RegisterToWorkMail	Grants permission to register an existing and disabled user, group, or resource for use by associating a mailbox and calendaring capabilities	organization*	aws:ResourceTag/${TagKey}	Write
ResetPassword	Grants permission to allow the administrator to reset the password for a user	organization*	aws:ResourceTag/${TagKey}	Write
StartMailboxExportJob	Grants permission to start a new mailbox export job	organization*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag the specified Amazon WorkMail organization resource	organization*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TestAvailabilityConfiguration	Grants permission to performs a test on an availability provider to ensure that access is allowed	organization*	aws:ResourceTag/${TagKey}	Read
UntagResource	Grants permission to untag the specified Amazon WorkMail organization resource	organization*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateAvailabilityConfiguration	Grants permission to update an existing AvailabilityConfiguration for the given Amazon WorkMail organization and domain	organization*	aws:ResourceTag/${TagKey}	Write
UpdateDefaultMailDomain	Grants permission to update which domain is the default domain for an organization	organization*	aws:ResourceTag/${TagKey}	Write
UpdateGroup	Grants permission to update details of a group	organization*	aws:ResourceTag/${TagKey}	Write
UpdateImpersonationRole	Grants permission to update an existing impersonation role for the given Amazon WorkMail organization	organization*	aws:ResourceTag/${TagKey}	Write
UpdateMailboxQuota	Grants permission to update the maximum size (in MB) of the user's mailbox	organization*	aws:ResourceTag/${TagKey}	Write
UpdateMobileDeviceAccessRule	Grants permission to update a mobile device access rule	organization*	aws:ResourceTag/${TagKey}	Write
UpdatePrimaryEmailAddress	Grants permission to update the primary email for a user, group, or resource	organization*	aws:ResourceTag/${TagKey}	Write
UpdateResource	Grants permission to update details for the resource	organization*	aws:ResourceTag/${TagKey}	Write
UpdateUser	Grants permission to update details of a user	organization*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon WorkMail

The following actions are defined by Amazon WorkMail but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AllowVendedLogDeliveryForResource	Grants permission to configure vended log delivery for WorkMail audit logs	organization*	aws:ResourceTag/${TagKey}	Write
CreateInboundMailFlowRule	Grants permission to create an inbound email flow rule which will apply to all email sent to an organization	organization*	aws:ResourceTag/${TagKey}	Write
CreateMailDomain	Grants permission to create a mail domain	organization*	aws:ResourceTag/${TagKey}	Write
CreateOutboundMailFlowRule	Grants permission to create an outbound email flow rule which will apply to all email sent from an organization	organization*	aws:ResourceTag/${TagKey}	Write
CreateSmtpGateway	Grants permission to register an SMTP gateway to a WorkMail organization	organization*	aws:ResourceTag/${TagKey}	Write
DeleteInboundMailFlowRule	Grants permission to remove an inbound email flow rule to no longer apply to emails sent to an organization	organization*	aws:ResourceTag/${TagKey}	Write
DeleteMailDomain	Grants permission to remove an unused mail domain from an organization	organization*	aws:ResourceTag/${TagKey}	Write
DeleteMobileDevice	Grants permission to remove a mobile device from a user	organization*	aws:ResourceTag/${TagKey}	Write
DeleteOutboundMailFlowRule	Grants permission to remove an outbound email flow rule so that it no longer applies to emails sent from an organization	organization*	aws:ResourceTag/${TagKey}	Write
DeleteSmtpGateway	Grants permission to remove an SMTP gateway from an organization	organization*	aws:ResourceTag/${TagKey}	Write
DeliverToMailbox	Grants permission to deliver emails to a WorkMail organization via the SES MailManager DeliverToMailbox action	organization*	aws:ResourceTag/${TagKey}	Write
DescribeInboundMailFlowRule	Grants permission to read the details of an inbound mail flow rule configured for an organization	organization*	aws:ResourceTag/${TagKey}	Read
DescribeMailDomains	Grants permission to show the details of all mail domains associated with the organization	organization*	aws:ResourceTag/${TagKey}	List
DescribeOutboundMailFlowRule	Grants permission to read the details of an outbound mail flow rule configured for an organization	organization*	aws:ResourceTag/${TagKey}	Read
DescribeSmtpGateway	Grants permission to read the details of an SMTP gateway registered to an organization	organization*	aws:ResourceTag/${TagKey}	Read
EnableMailDomain	Grants permission to enable a mail domain in the organization	organization*	aws:ResourceTag/${TagKey}	Write
GetJournalingRules	Grants permission to read the configured journaling and fallback email addresses for email journaling	organization*	aws:ResourceTag/${TagKey}	Read
GetMailDomainDetails	Grants permission to get the details of the mail domain	organization*	aws:ResourceTag/${TagKey}	Read
GetMobileDeviceDetails	Grants permission to get the details of the mobile device	organization*	aws:ResourceTag/${TagKey}	Read
GetMobileDevicesForUser	Grants permission to get a list of the mobile devices associated with the user	organization*	aws:ResourceTag/${TagKey}	Read
GetMobilePolicyDetails	Grants permission to get the details of the mobile device policy associated with the organization	organization*	aws:ResourceTag/${TagKey}	Read
ListInboundMailFlowRules	Grants permission to list inbound mail flow rules configured for an organization	organization*	aws:ResourceTag/${TagKey}	List
ListOutboundMailFlowRules	Grants permission to list outbound mail flow rules configured for an organization	organization*	aws:ResourceTag/${TagKey}	List
ListSmtpGateways	Grants permission to list SMTP gateways registered to the organization	organization*	aws:ResourceTag/${TagKey}	List
SearchMembers	Grants permission to perform a prefix search to find a specific user in a mail group	organization*	aws:ResourceTag/${TagKey}	Read
SetDefaultMailDomain	Grants permission to set the default mail domain for the organization	organization*	aws:ResourceTag/${TagKey}	Write
SetJournalingRules	Grants permission to set journaling and fallback email addresses for email journaling	organization*	aws:ResourceTag/${TagKey}	Write
SetMobilePolicyDetails	Grants permission to set the details of a mobile policy associated with the organization	organization*	aws:ResourceTag/${TagKey}	Write
TestInboundMailFlowRules	Grants permission to test what inbound rules will apply to an email with a given sender and recipient	organization*	aws:ResourceTag/${TagKey}	Write
TestOutboundMailFlowRules	Grants permission to test what outbound rules will apply to an email with a given sender and recipient	organization*	aws:ResourceTag/${TagKey}	Write
UpdateInboundMailFlowRule	Grants permission to update the details of an inbound email flow rule which will apply to all email sent to an organization	organization*	aws:ResourceTag/${TagKey}	Write
UpdateOutboundMailFlowRule	Grants permission to update the details of an outbound email flow rule which will apply to all email sent from an organization	organization*	aws:ResourceTag/${TagKey}	Write
UpdateSmtpGateway	Grants permission to update the details of an existing SMTP gateway registered to an organization	organization*	aws:ResourceTag/${TagKey}	Write
WipeMobileDevice	Grants permission to remotely wipe the mobile device associated with a user's account	organization*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon WorkMail

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
organization	arn:${Partition}:workmail:${Region}:${Account}:organization/${ResourceId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon WorkMail

Amazon WorkMail defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tag key-value pairs that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
workmail:ImpersonationRoleId	Filters access by the ImpersonationRoleId that is passed in the request	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon WorkLink (worklink)

Amazon WorkMail Message Flow (workmailmessageflow)