View a markdown version of this page

Actions, resources, and condition keys for AWS Elastic Disaster Recovery - Service Authorization Reference

Actions, resources, and condition keys for AWS Elastic Disaster Recovery

AWS Elastic Disaster Recovery (service prefix: drs) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

API operations defined by AWS Elastic Disaster Recovery

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation IAM action Condition key Possible value(s) Access level

AssociateSourceNetworkStack

drs:AssociateSourceNetworkStack

Write

CreateExtendedSourceServer

drs:CreateExtendedSourceServer

Write

drs:TagResource

Tagging, Write

CreateLaunchConfigurationTemplate

drs:CreateLaunchConfigurationTemplate

Write

drs:TagResource

Tagging, Write

CreateReplicationConfigurationTemplate

drs:CreateReplicationConfigurationTemplate

Write

drs:TagResource

Tagging, Write

CreateSourceNetwork

drs:CreateSourceNetwork

Write

drs:TagResource

Tagging, Write

DeleteJob

drs:DeleteJob

Write

DeleteLaunchAction

drs:DeleteLaunchAction

Write

DeleteLaunchConfigurationTemplate

drs:DeleteLaunchConfigurationTemplate

Write

DeleteRecoveryInstance

drs:DeleteRecoveryInstance

Write

DeleteReplicationConfigurationTemplate

drs:DeleteReplicationConfigurationTemplate

Write

DeleteSourceNetwork

drs:DeleteSourceNetwork

Write

DeleteSourceServer

drs:DeleteSourceServer

Write

DescribeJobLogItems

drs:DescribeJobLogItems

Read

DescribeJobs

drs:DescribeJobs

Read

DescribeLaunchConfigurationTemplates

drs:DescribeLaunchConfigurationTemplates

Read

DescribeRecoveryInstances

drs:DescribeRecoveryInstances

Read

DescribeRecoverySnapshots

drs:DescribeRecoverySnapshots

Read

DescribeReplicationConfigurationTemplates

drs:DescribeReplicationConfigurationTemplates

Read

DescribeSourceNetworks

drs:DescribeSourceNetworks

Read

DescribeSourceServers

drs:DescribeSourceServers

Read

DisconnectRecoveryInstance

drs:DisconnectRecoveryInstance

Write

DisconnectSourceServer

drs:DisconnectSourceServer

Write

ExportSourceNetworkCfnTemplate

drs:ExportSourceNetworkCfnTemplate

Write

GetFailbackReplicationConfiguration

drs:GetFailbackReplicationConfiguration

Read

GetLaunchConfiguration

drs:GetLaunchConfiguration

Read

GetReplicationConfiguration

drs:GetReplicationConfiguration

Read

InitializeService

drs:InitializeService

Write

ListExtensibleSourceServers

drs:ListExtensibleSourceServers

Read

ListLaunchActions

drs:ListLaunchActions

Read

ListStagingAccounts

drs:ListStagingAccounts

Read

ListTagsForResource

drs:ListTagsForResource

Read

PutLaunchAction

drs:PutLaunchAction

Write

RetryDataReplication

drs:RetryDataReplication

Write

ReverseReplication

drs:ReverseReplication

Write

StartRecovery

drs:StartRecovery

Write

drs:TagResource

Tagging, Write

StartReplication

drs:StartReplication

Write

StartSourceNetworkReplication

drs:StartSourceNetworkReplication

Write

StopFailback

drs:StopFailback

Write

StopReplication

drs:StopReplication

Write

StopSourceNetworkReplication

drs:StopSourceNetworkReplication

Write

TagResource

drs:TagResource

Tagging, Write

TerminateRecoveryInstances

drs:TerminateRecoveryInstances

Write

UntagResource

drs:UntagResource

Tagging, Write

UpdateFailbackReplicationConfiguration

drs:UpdateFailbackReplicationConfiguration

Write

UpdateLaunchConfiguration

drs:UpdateLaunchConfiguration

Write

UpdateLaunchConfigurationTemplate

drs:UpdateLaunchConfigurationTemplate

Write

UpdateReplicationConfiguration

drs:UpdateReplicationConfiguration

Write

UpdateReplicationConfigurationTemplate

drs:UpdateReplicationConfigurationTemplate

Write

Actions defined by AWS Elastic Disaster Recovery

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions Description Resource types (*required) Condition keys Access level

AssociateSourceNetworkStack

Grants permission to associate CloudFormation stack with source network

SourceNetworkResource*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateExtendedSourceServer

Grants permission to extend a source server

aws:RequestTag/${TagKey}

aws:TagKeys

Write

CreateLaunchConfigurationTemplate

Grants permission to create launch configuration template

aws:RequestTag/${TagKey}

aws:TagKeys

Write

CreateReplicationConfigurationTemplate

Grants permission to create replication configuration template

aws:RequestTag/${TagKey}

aws:TagKeys

Write

CreateSourceNetwork

Grants permission to create a source network

aws:RequestTag/${TagKey}

aws:TagKeys

Write

DeleteJob

Grants permission to delete a job

JobResource*

aws:ResourceTag/${TagKey}

Write

DeleteLaunchAction

Grants permission to delete a launch action

LaunchConfigurationTemplateResource

aws:ResourceTag/${TagKey}

Write

SourceServerResource

aws:ResourceTag/${TagKey}

DeleteLaunchConfigurationTemplate

Grants permission to delete launch configuration template

LaunchConfigurationTemplateResource*

aws:ResourceTag/${TagKey}

Write

DeleteRecoveryInstance

Grants permission to delete recovery instance

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

DeleteReplicationConfigurationTemplate

Grants permission to delete replication configuration template

ReplicationConfigurationTemplateResource*

aws:ResourceTag/${TagKey}

Write

DeleteSourceNetwork

Grants permission to delete source network

SourceNetworkResource*

aws:ResourceTag/${TagKey}

Write

DeleteSourceServer

Grants permission to delete source server

SourceServerResource*

aws:ResourceTag/${TagKey}

Write

DescribeJobLogItems

Grants permission to describe job log items

JobResource*

aws:ResourceTag/${TagKey}

Read

DescribeJobs

Grants permission to describe jobs

Read

DescribeLaunchConfigurationTemplates

Grants permission to describe launch configuration template

Read

DescribeRecoveryInstances

Grants permission to describe recovery instances

Read

DescribeRecoverySnapshots

Grants permission to describe recovery snapshots

SourceServerResource*

aws:ResourceTag/${TagKey}

Read

DescribeReplicationConfigurationTemplates

Grants permission to describe replication configuration template

Read

DescribeSourceNetworks

Grants permission to describe source networks

Read

DescribeSourceServers

Grants permission to describe source servers

Read

DisconnectRecoveryInstance

Grants permission to disconnect recovery instance

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

DisconnectSourceServer

Grants permission to disconnect source server

SourceServerResource*

aws:ResourceTag/${TagKey}

Write

ExportSourceNetworkCfnTemplate

Grants permission to export CloudFormation template which contains source network resources

SourceNetworkResource*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

GetFailbackReplicationConfiguration

Grants permission to get failback replication configuration

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Read

GetLaunchConfiguration

Grants permission to get launch configuration

SourceServerResource*

aws:ResourceTag/${TagKey}

Read

GetReplicationConfiguration

Grants permission to get replication configuration

SourceServerResource*

aws:ResourceTag/${TagKey}

Read

InitializeService

Grants permission to initialize service

Write

ListExtensibleSourceServers

Grants permission to list extensible source servers

Read

ListLaunchActions

Grants permission to list launch actions

LaunchConfigurationTemplateResource

aws:ResourceTag/${TagKey}

Read

SourceServerResource

aws:ResourceTag/${TagKey}

ListStagingAccounts

Grants permission to list staging accounts

Read

ListTagsForResource

Grants permission to list tags for a resource

Read

PutLaunchAction

Grants permission to put a launch action

LaunchConfigurationTemplateResource

aws:ResourceTag/${TagKey}

Write

SourceServerResource

aws:ResourceTag/${TagKey}

RetryDataReplication

Grants permission to retry data replication

SourceServerResource*

aws:ResourceTag/${TagKey}

Write

ReverseReplication

Grants permission to reverse replication

RecoveryInstanceResource*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

drs:EC2InstanceARN

Write

StartFailbackLaunch

Grants permission to start failback launch

RecoveryInstanceResource*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

drs:EC2InstanceARN

Write

StartRecovery

Grants permission to start recovery

SourceServerResource*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

StartReplication

Grants permission to start replication

SourceServerResource*

aws:ResourceTag/${TagKey}

Write

StartSourceNetworkRecovery

Grants permission to start network recovery

SourceNetworkResource*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

StartSourceNetworkReplication

Grants permission to start network replication

SourceNetworkResource*

aws:ResourceTag/${TagKey}

Write

StopFailback

Grants permission to stop failback

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

StopReplication

Grants permission to stop replication

SourceServerResource*

aws:ResourceTag/${TagKey}

Write

StopSourceNetworkReplication

Grants permission to stop network replication

SourceNetworkResource*

aws:ResourceTag/${TagKey}

Write

TagResource

Grants permission to assign a resource tag

JobResource

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

drs:CreateAction

Tagging, Write

LaunchConfigurationTemplateResource

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

drs:CreateAction

RecoveryInstanceResource

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

drs:CreateAction

drs:EC2InstanceARN

ReplicationConfigurationTemplateResource

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

drs:CreateAction

SourceNetworkResource

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

drs:CreateAction

SourceServerResource

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

drs:CreateAction

TerminateRecoveryInstances

Grants permission to terminate recovery instances

RecoveryInstanceResource*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

drs:EC2InstanceARN

Write

UntagResource

Grants permission to untag a resource

JobResource

aws:ResourceTag/${TagKey}

aws:TagKeys

Tagging, Write

LaunchConfigurationTemplateResource

aws:ResourceTag/${TagKey}

aws:TagKeys

RecoveryInstanceResource

aws:ResourceTag/${TagKey}

aws:TagKeys

drs:EC2InstanceARN

ReplicationConfigurationTemplateResource

aws:ResourceTag/${TagKey}

aws:TagKeys

SourceNetworkResource

aws:ResourceTag/${TagKey}

aws:TagKeys

SourceServerResource

aws:ResourceTag/${TagKey}

aws:TagKeys

UpdateFailbackReplicationConfiguration

Grants permission to update failback replication configuration

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

UpdateLaunchConfiguration

Grants permission to update launch configuration

SourceServerResource*

aws:ResourceTag/${TagKey}

Write

UpdateLaunchConfigurationTemplate

Grants permission to update launch configuration

LaunchConfigurationTemplateResource*

aws:ResourceTag/${TagKey}

Write

UpdateReplicationConfiguration

Grants permission to update replication configuration

SourceServerResource*

aws:ResourceTag/${TagKey}

Write

UpdateReplicationConfigurationTemplate

Grants permission to update replication configuration template

ReplicationConfigurationTemplateResource*

aws:ResourceTag/${TagKey}

Write

Permission-only actions for AWS Elastic Disaster Recovery

The following actions are defined by AWS Elastic Disaster Recovery but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions Description Resource types (*required) Condition keys Access level

AssociateFailbackClientToRecoveryInstanceForDrs

Grants permission to get associate failback client to recovery instance

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

BatchCreateVolumeSnapshotGroupForDrs

Grants permission to batch create volume snapshot group

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

SourceServerResource*

aws:ResourceTag/${TagKey}

BatchDeleteSnapshotRequestForDrs

Grants permission to batch delete snapshot request

Write

CreateConvertedSnapshotForDrs

Grants permission to create converted snapshot

SourceServerResource*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateRecoveryInstanceForDrs

Grants permission to create recovery instance

SourceServerResource*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateSourceServerForDrs

Grants permission to create a source server

aws:RequestTag/${TagKey}

aws:TagKeys

Write

DescribeReplicationServerAssociationsForDrs

Grants permission to describe replication server associations

Read

DescribeSnapshotRequestsForDrs

Grants permission to describe snapshot requests

Read

GetAgentCommandForDrs

Grants permission to get agent command

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Read

SourceServerResource*

aws:ResourceTag/${TagKey}

GetAgentConfirmedResumeInfoForDrs

Grants permission to get agent confirmed resume info

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Read

SourceServerResource*

aws:ResourceTag/${TagKey}

GetAgentInstallationAssetsForDrs

Grants permission to get agent installation assets

Read

GetAgentReplicationInfoForDrs

Grants permission to get agent replication info

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Read

SourceServerResource*

aws:ResourceTag/${TagKey}

GetAgentRuntimeConfigurationForDrs

Grants permission to get agent runtime configuration

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Read

SourceServerResource*

aws:ResourceTag/${TagKey}

GetAgentSnapshotCreditsForDrs

Grants permission to get agent snapshot credits

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Read

SourceServerResource*

aws:ResourceTag/${TagKey}

GetChannelCommandsForDrs

Grants permission to get channel commands

Read

GetFailbackCommandForDrs

Grants permission to get failback command

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Read

GetFailbackLaunchRequestedForDrs

Grants permission to get failback launch requested

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Read

GetSuggestedFailbackClientDeviceMappingForDrs

Grants permission to get suggested failback client device mapping

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Read

IssueAgentCertificateForDrs

Grants permission to issue an agent certificate

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

SourceServerResource*

aws:ResourceTag/${TagKey}

NotifyAgentAuthenticationForDrs

Grants permission to notify agent authentication

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

SourceServerResource*

aws:ResourceTag/${TagKey}

NotifyAgentConnectedForDrs

Grants permission to notify agent is connected

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

SourceServerResource*

aws:ResourceTag/${TagKey}

NotifyAgentDisconnectedForDrs

Grants permission to notify agent is disconnected

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

SourceServerResource*

aws:ResourceTag/${TagKey}

NotifyAgentReplicationProgressForDrs

Grants permission to notify agent replication progress

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

SourceServerResource*

aws:ResourceTag/${TagKey}

NotifyConsistencyAttainedForDrs

Grants permission to notify consistency attained

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

NotifyReplicationServerAuthenticationForDrs

Grants permission to notify replication server authentication

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

NotifyVolumeEventForDrs

Grants permission to notify replicator volume events

SourceServerResource*

aws:ResourceTag/${TagKey}

Write

SendAgentLogsForDrs

Grants permission to send agent logs

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

SourceServerResource*

aws:ResourceTag/${TagKey}

SendAgentMetricsForDrs

Grants permission to send agent metrics

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

SourceServerResource*

aws:ResourceTag/${TagKey}

SendChannelCommandResultForDrs

Grants permission to send channel command result

Write

SendClientLogsForDrs

Grants permission to send client logs

Write

SendClientMetricsForDrs

Grants permission to send client metrics

Write

SendVolumeStatsForDrs

Grants permission to send volume throughput statistics

SourceServerResource*

aws:ResourceTag/${TagKey}

Write

UpdateAgentBacklogForDrs

Grants permission to update agent backlog

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

SourceServerResource*

aws:ResourceTag/${TagKey}

UpdateAgentConversionInfoForDrs

Grants permission to update agent conversion info

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

SourceServerResource*

aws:ResourceTag/${TagKey}

UpdateAgentReplicationInfoForDrs

Grants permission to update agent replication info

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

SourceServerResource*

aws:ResourceTag/${TagKey}

UpdateAgentReplicationProcessStateForDrs

Grants permission to update agent replication process state

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

SourceServerResource*

aws:ResourceTag/${TagKey}

UpdateAgentSourcePropertiesForDrs

Grants permission to update agent source properties

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

SourceServerResource*

aws:ResourceTag/${TagKey}

UpdateFailbackClientDeviceMappingForDrs

Grants permission to update failback client device mapping

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

UpdateFailbackClientLastSeenForDrs

Grants permission to update failback client last seen

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

UpdateReplicationCertificateForDrs

Grants permission to update a replication certificate

RecoveryInstanceResource*

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

Write

Resource types defined by AWS Elastic Disaster Recovery

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types ARN Condition keys

JobResource

arn:${Partition}:drs:${Region}:${Account}:job/${JobID}

aws:ResourceTag/${TagKey}

LaunchConfigurationTemplateResource

arn:${Partition}:drs:${Region}:${Account}:launch-configuration-template/${LaunchConfigurationTemplateID}

aws:ResourceTag/${TagKey}

RecoveryInstanceResource

arn:${Partition}:drs:${Region}:${Account}:recovery-instance/${RecoveryInstanceID}

aws:ResourceTag/${TagKey}

drs:EC2InstanceARN

ReplicationConfigurationTemplateResource

arn:${Partition}:drs:${Region}:${Account}:replication-configuration-template/${ReplicationConfigurationTemplateID}

aws:ResourceTag/${TagKey}

SourceNetworkResource

arn:${Partition}:drs:${Region}:${Account}:source-network/${SourceNetworkID}

aws:ResourceTag/${TagKey}

SourceServerResource

arn:${Partition}:drs:${Region}:${Account}:source-server/${SourceServerID}

aws:ResourceTag/${TagKey}

Condition keys for AWS Elastic Disaster Recovery

AWS Elastic Disaster Recovery defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys Description Type

aws:RequestTag/${TagKey}

Filters access by the presence of tag key-value pairs in the request

String

aws:ResourceTag/${TagKey}

Filters access by tag key-value pairs attached to the resource

String

aws:TagKeys

Filters access by the presence of tag keys in the request

ArrayOfString

drs:CreateAction

Filters access by the name of a resource-creating API action

String

drs:EC2InstanceARN

Filters access by the EC2 instance the request originated from

ARN