Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Macie

Amazon Macie (service prefix: macie2) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by Amazon Macie

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AcceptInvitation	macie2:AcceptInvitation			Write
BatchGetCustomDataIdentifiers	macie2:BatchGetCustomDataIdentifiers			Read
BatchUpdateAutomatedDiscoveryAccounts	macie2:BatchUpdateAutomatedDiscoveryAccounts			Write
CreateAllowList	macie2:CreateAllowList			Write
CreateAllowList	macie2:TagResource			Tagging, Write
CreateClassificationJob	macie2:CreateClassificationJob			Write
CreateClassificationJob	macie2:TagResource			Tagging, Write
CreateCustomDataIdentifier	macie2:CreateCustomDataIdentifier			Write
CreateCustomDataIdentifier	macie2:TagResource			Tagging, Write
CreateFindingsFilter	macie2:CreateFindingsFilter			Write
CreateFindingsFilter	macie2:TagResource			Tagging, Write
CreateInvitations	macie2:CreateInvitations			Write
CreateMember	macie2:CreateMember			Write
CreateMember	macie2:TagResource			Tagging, Write
CreateSampleFindings	macie2:CreateSampleFindings			Write
DeclineInvitations	macie2:DeclineInvitations			Write
DeleteAllowList	macie2:DeleteAllowList			Write
DeleteCustomDataIdentifier	macie2:DeleteCustomDataIdentifier			Write
DeleteFindingsFilter	macie2:DeleteFindingsFilter			Write
DeleteInvitations	macie2:DeleteInvitations			Write
DeleteMember	macie2:DeleteMember			Write
DescribeBuckets	macie2:DescribeBuckets			Read
DescribeClassificationJob	macie2:DescribeClassificationJob			Read
DescribeOrganizationConfiguration	macie2:DescribeOrganizationConfiguration			Read
DisableMacie	macie2:DisableMacie			Write
DisableOrganizationAdminAccount	macie2:DisableOrganizationAdminAccount			Write
DisassociateFromAdministratorAccount	macie2:DisassociateFromAdministratorAccount			Write
DisassociateFromMasterAccount	macie2:DisassociateFromMasterAccount			Write
DisassociateMember	macie2:DisassociateMember			Write
EnableMacie	macie2:EnableMacie			Write
EnableOrganizationAdminAccount	macie2:EnableOrganizationAdminAccount			Write
GetAdministratorAccount	macie2:GetAdministratorAccount			Read
GetAllowList	macie2:GetAllowList			Read
GetAutomatedDiscoveryConfiguration	macie2:GetAutomatedDiscoveryConfiguration			Read
GetBucketStatistics	macie2:GetBucketStatistics			Read
GetClassificationExportConfiguration	macie2:GetClassificationExportConfiguration			Read
GetClassificationScope	macie2:GetClassificationScope			Read
GetCustomDataIdentifier	macie2:GetCustomDataIdentifier			Read
GetFindingStatistics	macie2:GetFindingStatistics			Read
GetFindings	macie2:GetFindings			Read
GetFindingsFilter	macie2:GetFindingsFilter			Read
GetFindingsPublicationConfiguration	macie2:GetFindingsPublicationConfiguration			Read
GetInvitationsCount	macie2:GetInvitationsCount			Read
GetMacieSession	macie2:GetMacieSession			Read
GetMasterAccount	macie2:GetMasterAccount			Read
GetMember	macie2:GetMember			Read
GetResourceProfile	macie2:GetResourceProfile			Read
GetRevealConfiguration	macie2:GetRevealConfiguration			Read
GetSensitiveDataOccurrences	macie2:GetSensitiveDataOccurrences			Read
GetSensitiveDataOccurrencesAvailability	macie2:GetSensitiveDataOccurrencesAvailability			Read
GetSensitivityInspectionTemplate	macie2:GetSensitivityInspectionTemplate			Read
GetUsageStatistics	macie2:GetUsageStatistics			Read
GetUsageTotals	macie2:GetUsageTotals			Read
ListAllowLists	macie2:ListAllowLists			List
ListAutomatedDiscoveryAccounts	macie2:ListAutomatedDiscoveryAccounts			List
ListClassificationJobs	macie2:ListClassificationJobs			List
ListClassificationScopes	macie2:ListClassificationScopes			List
ListCustomDataIdentifiers	macie2:ListCustomDataIdentifiers			List
ListFindings	macie2:ListFindings			List
ListFindingsFilters	macie2:ListFindingsFilters			List
ListInvitations	macie2:ListInvitations			List
ListManagedDataIdentifiers	macie2:ListManagedDataIdentifiers			List
ListMembers	macie2:ListMembers			List
ListOrganizationAdminAccounts	macie2:ListOrganizationAdminAccounts			List
ListResourceProfileArtifacts	macie2:ListResourceProfileArtifacts			List
ListResourceProfileDetections	macie2:ListResourceProfileDetections			List
ListSensitivityInspectionTemplates	macie2:ListSensitivityInspectionTemplates			List
ListTagsForResource	macie2:ListTagsForResource			Read
PutClassificationExportConfiguration	macie2:PutClassificationExportConfiguration			Write
PutFindingsPublicationConfiguration	macie2:PutFindingsPublicationConfiguration			Write
SearchResources	macie2:SearchResources			Read
TagResource	macie2:TagResource			Tagging, Write
TestCustomDataIdentifier	macie2:TestCustomDataIdentifier			Write
UntagResource	macie2:UntagResource			Tagging, Write
UpdateAllowList	macie2:UpdateAllowList			Write
UpdateAutomatedDiscoveryConfiguration	macie2:UpdateAutomatedDiscoveryConfiguration			Write
UpdateClassificationJob	macie2:UpdateClassificationJob			Write
UpdateClassificationScope	macie2:UpdateClassificationScope			Write
UpdateFindingsFilter	macie2:UpdateFindingsFilter			Write
UpdateMacieSession	macie2:UpdateMacieSession			Write
UpdateMemberSession	macie2:UpdateMemberSession			Write
UpdateOrganizationConfiguration	macie2:UpdateOrganizationConfiguration			Write
UpdateResourceProfile	macie2:UpdateResourceProfile			Write
UpdateResourceProfileDetections	macie2:UpdateResourceProfileDetections			Write
UpdateRevealConfiguration	macie2:UpdateRevealConfiguration			Write
UpdateRevealConfiguration	iam:PassRole	iam:PassedToService	reveal-samples.macie.amazonaws.com	Write
UpdateSensitivityInspectionTemplate	macie2:UpdateSensitivityInspectionTemplate			Write

Actions defined by Amazon Macie

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptInvitation	Grants permission to accept an Amazon Macie membership invitation			Write
BatchGetCustomDataIdentifiers	Grants permission to retrieve information about one or more custom data identifiers	CustomDataIdentifier*	aws:ResourceTag/${TagKey}	Read
BatchUpdateAutomatedDiscoveryAccounts	Grants permission to an Amazon Macie administrator to change the status of automated sensitive data discovery for one or more accounts in their organization			Write
CreateAllowList	Grants permission to create and define the settings for an allow list		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateClassificationJob	Grants permission to create and define the settings for a sensitive data discovery job	ClassificationJob*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCustomDataIdentifier	Grants permission to create and define the settings for a custom data identifier	CustomDataIdentifier*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFindingsFilter	Grants permission to create and define the settings for a findings filter	FindingsFilter*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateInvitations	Grants permission to send an Amazon Macie membership invitation			Write
CreateMember	Grants permission to associate an account with an Amazon Macie administrator account	Member*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSampleFindings	Grants permission to create sample findings			Write
DeclineInvitations	Grants permission to decline Amazon Macie membership invitations			Write
DeleteAllowList	Grants permission to delete an allow list	AllowList*	aws:ResourceTag/${TagKey}	Write
DeleteCustomDataIdentifier	Grants permission to delete a custom data identifier	CustomDataIdentifier*	aws:ResourceTag/${TagKey}	Write
DeleteFindingsFilter	Grants permission to delete a findings filter	FindingsFilter*	aws:ResourceTag/${TagKey}	Write
DeleteInvitations	Grants permission to delete Amazon Macie membership invitations			Write
DeleteMember	Grants permission to delete the association between an Amazon Macie administrator account and an account	Member*	aws:ResourceTag/${TagKey}	Write
DescribeBuckets	Grants permission to retrieve statistical data and other information about S3 buckets that Amazon Macie monitors and analyzes			Read
DescribeClassificationJob	Grants permission to retrieve information about the status and settings for a sensitive data discovery job	ClassificationJob*	aws:ResourceTag/${TagKey}	Read
DescribeOrganizationConfiguration	Grants permission to retrieve information about the Amazon Macie configuration settings for an AWS organization			Read
DisableMacie	Grants permission to disable an Amazon Macie account, which also deletes Macie resources for the account			Write
DisableOrganizationAdminAccount	Grants permission to disable an account as the delegated Amazon Macie administrator account for an AWS organization			Write
DisassociateFromAdministratorAccount	Grants permission to an Amazon Macie member account to disassociate from its Macie administrator account			Write
DisassociateFromMasterAccount	Grants permission to an Amazon Macie member account to disassociate from its Macie administrator account			Write
DisassociateMember	Grants permission to an Amazon Macie administrator account to disassociate from a Macie member account	Member*	aws:ResourceTag/${TagKey}	Write
EnableMacie	Grants permission to enable and specify the configuration settings for a new Amazon Macie account			Write
EnableOrganizationAdminAccount	Grants permission to enable an account as the delegated Amazon Macie administrator account for an AWS organization			Write
GetAdministratorAccount	Grants permission to retrieve information about the Amazon Macie administrator account for an account			Read
GetAllowList	Grants permission to retrieve the settings and status of an allow list	AllowList*	aws:ResourceTag/${TagKey}	Read
GetAutomatedDiscoveryConfiguration	Grants permission to retrieve the configuration settings and status of automated sensitive data discovery for an Amazon Macie administrator account, organization, or standalone account			Read
GetBucketStatistics	Grants permission to retrieve aggregated statistical data for all the S3 buckets that Amazon Macie monitors and analyzes			Read
GetClassificationExportConfiguration	Grants permission to retrieve the settings for exporting sensitive data discovery results			Read
GetClassificationScope	Grants permission to retrieve the classification scope settings for an account			Read
GetCustomDataIdentifier	Grants permission to retrieve information about the settings for a custom data identifier	CustomDataIdentifier*	aws:ResourceTag/${TagKey}	Read
GetFindingStatistics	Grants permission to retrieve aggregated statistical data about findings			Read
GetFindings	Grants permission to retrieve the details of one or more findings			Read
GetFindingsFilter	Grants permission to retrieve information about the settings for a findings filter	FindingsFilter*	aws:ResourceTag/${TagKey}	Read
GetFindingsPublicationConfiguration	Grants permission to retrieve the configuration settings for publishing findings to AWS Security Hub			Read
GetInvitationsCount	Grants permission to retrieve the count of Amazon Macie membership invitations that were received by an account			Read
GetMacieSession	Grants permission to retrieve information about the status and configuration settings for an Amazon Macie account			Read
GetMasterAccount	Grants permission to retrieve information about the Amazon Macie administrator account for an account			Read
GetMember	Grants permission to retrieve information about an account that's associated with an Amazon Macie administrator account	Member*	aws:ResourceTag/${TagKey}	Read
GetResourceProfile	Grants permission to retrieve sensitive data discovery statistics and the sensitivity score for an S3 bucket			Read
GetRevealConfiguration	Grants permission to retrieve the status and configuration settings for retrieving occurrences of sensitive data reported by findings			Read
GetSensitiveDataOccurrences	Grants permission to retrieve occurrences of sensitive data reported by a finding			Read
GetSensitiveDataOccurrencesAvailability	Grants permission to check whether occurrences of sensitive data can be retrieved for a finding			Read
GetSensitivityInspectionTemplate	Grants permission to retrieve the sensitivity inspection template settings for an account			Read
GetUsageStatistics	Grants permission to retrieve quotas and aggregated usage data for one or more accounts			Read
GetUsageTotals	Grants permission to retrieve aggregated usage data for an account			Read
ListAllowLists	Grants permission to retrieve a subset of information about all the allow lists for an account			List
ListAutomatedDiscoveryAccounts	Grants permission to retrieve the status of automated sensitive data discovery for an account			List
ListClassificationJobs	Grants permission to retrieve a subset of information about the status and settings for one or more sensitive data discovery jobs			List
ListClassificationScopes	Grants permission to retrieve a subset of information about the classification scope for an account			List
ListCustomDataIdentifiers	Grants permission to retrieve information about all custom data identifiers			List
ListFindings	Grants permission to retrieve a subset of information about one or more findings			List
ListFindingsFilters	Grants permission to retrieve information about all findings filters			List
ListInvitations	Grants permission to retrieve information about all the Amazon Macie membership invitations that were received by an account			List
ListManagedDataIdentifiers	Grants permission to retrieve information about managed data identifiers			List
ListMembers	Grants permission to retrieve information about the Amazon Macie member accounts that are associated with a Macie administrator account			List
ListOrganizationAdminAccounts	Grants permission to retrieve information about the delegated Amazon Macie administrator account for an AWS organization			List
ListResourceProfileArtifacts	Grants permission to retrieve information about objects that Amazon Macie selected from an S3 bucket for automated sensitive data discovery			List
ListResourceProfileDetections	Grants permission to retrieve information about the types and amount of sensitive data that Amazon Macie found in an S3 bucket			List
ListSensitivityInspectionTemplates	Grants permission to retrieve a subset of information about the sensitivity inspection template for an account			List
ListTagsForResource	Grants permission to retrieve the tags for an Amazon Macie resource	AllowList	aws:ResourceTag/${TagKey}	Read
		ClassificationJob	aws:ResourceTag/${TagKey}
		CustomDataIdentifier	aws:ResourceTag/${TagKey}
		FindingsFilter	aws:ResourceTag/${TagKey}
		Member	aws:ResourceTag/${TagKey}
PutClassificationExportConfiguration	Grants permission to create or update the settings for storing sensitive data discovery results			Write
PutFindingsPublicationConfiguration	Grants permission to update the configuration settings for publishing findings to AWS Security Hub			Write
SearchResources	Grants permission to retrieve statistical data and other information about AWS resources that Amazon Macie monitors and analyzes			Read
TagResource	Grants permission to add or update the tags for an Amazon Macie resource	AllowList	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		ClassificationJob	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		CustomDataIdentifier	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		FindingsFilter	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Member	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
TestCustomDataIdentifier	Grants permission to test a custom data identifier			Write
UntagResource	Grants permission to remove tags from an Amazon Macie resource	AllowList	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		ClassificationJob	aws:ResourceTag/${TagKey} aws:TagKeys
		CustomDataIdentifier	aws:ResourceTag/${TagKey} aws:TagKeys
		FindingsFilter	aws:ResourceTag/${TagKey} aws:TagKeys
		Member	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAllowList	Grants permission to update the settings for an allow list	AllowList*	aws:ResourceTag/${TagKey}	Write
UpdateAutomatedDiscoveryConfiguration	Grants permission to change the status of automated sensitive data discovery for an Amazon Macie administrator account, organization, or standalone account			Write
UpdateClassificationJob	Grants permission to change the status of a sensitive data discovery job	ClassificationJob*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateClassificationScope	Grants permission to update the classification scope settings for an account			Write
UpdateFindingsFilter	Grants permission to update the settings for a findings filter	FindingsFilter*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateMacieSession	Grants permission to an Amazon Macie administrator account to suspend or re-enable Macie for a member account			Write
UpdateMemberSession	Grants permission to an Amazon Macie administrator account to suspend or re-enable a Macie member account			Write
UpdateOrganizationConfiguration	Grants permission to update Amazon Macie configuration settings for an AWS organization			Write
UpdateResourceProfile	Grants permission to update the sensitivity score for an S3 bucket			Write
UpdateResourceProfileDetections	Grants permission to update the sensitivity scoring settings for an S3 bucket			Write
UpdateRevealConfiguration	Grants permission to update the status and configuration settings for retrieving occurrences of sensitive data reported by findings			Write
UpdateSensitivityInspectionTemplate	Grants permission to update the sensitivity inspection template settings for an account			Write

Resource types defined by Amazon Macie

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
AllowList	arn:${Partition}:macie2:${Region}:${Account}:allow-list/${ResourceId}	aws:ResourceTag/${TagKey}
ClassificationJob	arn:${Partition}:macie2:${Region}:${Account}:classification-job/${ResourceId}	aws:ResourceTag/${TagKey}
CustomDataIdentifier	arn:${Partition}:macie2:${Region}:${Account}:custom-data-identifier/${ResourceId}	aws:ResourceTag/${TagKey}
FindingsFilter	arn:${Partition}:macie2:${Region}:${Account}:findings-filter/${ResourceId}	aws:ResourceTag/${TagKey}
Member	arn:${Partition}:macie2:${Region}:${Account}:member/${ResourceId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Macie

Amazon Macie defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a tag key and value pair that is allowed in the request	String
aws:ResourceTag/${TagKey}	Filters access by a tag key and value pair of a resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Machine Learning (machinelearning)

Amazon Managed Blockchain (managedblockchain)