Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS HealthOmics

AWS HealthOmics (service prefix: omics) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS HealthOmics
Actions defined by AWS HealthOmics
Resource types defined by AWS HealthOmics
Condition keys for AWS HealthOmics

API operations defined by AWS HealthOmics

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AbortMultipartReadSetUpload	omics:AbortMultipartReadSetUpload			Write
AcceptShare	omics:AcceptShare			Write
BatchDeleteReadSet	omics:BatchDeleteReadSet			Write
CancelAnnotationImportJob	omics:CancelAnnotationImportJob			Write
CancelRun	omics:CancelRun			Write
CancelRunBatch	omics:CancelRunBatch			Write
CancelVariantImportJob	omics:CancelVariantImportJob			Write
CompleteMultipartReadSetUpload	omics:CompleteMultipartReadSetUpload			Write
CreateAnnotationStore	omics:CreateAnnotationStore			Write
CreateAnnotationStore	omics:TagResource			Tagging, Write
CreateAnnotationStoreVersion	omics:CreateAnnotationStoreVersion			Write
CreateAnnotationStoreVersion	omics:TagResource			Tagging, Write
CreateConfiguration	omics:CreateConfiguration			Write
	omics:TagResource			Tagging, Write
	codeconnections:PassConnection			Read
	ec2:DescribeSecurityGroups			List
	ec2:DescribeSubnets			List
CreateMultipartReadSetUpload	omics:CreateMultipartReadSetUpload			Write
CreateMultipartReadSetUpload	omics:TagResource			Tagging, Write
CreateReferenceStore	omics:CreateReferenceStore			Write
CreateReferenceStore	omics:TagResource			Tagging, Write
CreateRunCache	omics:CreateRunCache			Write
CreateRunCache	omics:TagResource			Tagging, Write
CreateRunGroup	omics:CreateRunGroup			Write
CreateRunGroup	omics:TagResource			Tagging, Write
CreateSequenceStore	omics:CreateSequenceStore			Write
CreateSequenceStore	omics:TagResource			Tagging, Write
CreateShare	omics:CreateShare			Write
CreateVariantStore	omics:CreateVariantStore			Write
CreateVariantStore	omics:TagResource			Tagging, Write
CreateWorkflow	omics:CreateWorkflow			Write
	omics:TagResource			Tagging, Write
	codeconnections:PassConnection			Read
CreateWorkflowVersion	omics:CreateWorkflowVersion			Write
	omics:TagResource			Tagging, Write
	codeconnections:PassConnection			Read
DeleteAnnotationStore	omics:DeleteAnnotationStore			Write
DeleteAnnotationStoreVersions	omics:DeleteAnnotationStoreVersions			Write
DeleteBatch	omics:DeleteBatch			Write
DeleteConfiguration	omics:DeleteConfiguration			Write
DeleteReference	omics:DeleteReference			Write
DeleteReferenceStore	omics:DeleteReferenceStore			Write
DeleteRun	omics:DeleteRun			Write
DeleteRunBatch	omics:DeleteRunBatch			Write
DeleteRunCache	omics:DeleteRunCache			Write
DeleteRunGroup	omics:DeleteRunGroup			Write
DeleteS3AccessPolicy	omics:DeleteS3AccessPolicy			Write
DeleteSequenceStore	omics:DeleteSequenceStore			Write
DeleteShare	omics:DeleteShare			Write
DeleteVariantStore	omics:DeleteVariantStore			Write
DeleteWorkflow	omics:DeleteWorkflow			Write
DeleteWorkflowVersion	omics:DeleteWorkflowVersion			Write
GetAnnotationImportJob	omics:GetAnnotationImportJob			Read
GetAnnotationStore	omics:GetAnnotationStore			Read
GetAnnotationStoreVersion	omics:GetAnnotationStoreVersion			Read
GetBatch	omics:GetBatch			Read
GetConfiguration	omics:GetConfiguration			Read
GetReadSet	omics:GetReadSet			Read
GetReadSetActivationJob	omics:GetReadSetActivationJob			Read
GetReadSetExportJob	omics:GetReadSetExportJob			Read
GetReadSetImportJob	omics:GetReadSetImportJob			Read
GetReadSetMetadata	omics:GetReadSetMetadata			Read
GetReference	omics:GetReference			Read
GetReferenceImportJob	omics:GetReferenceImportJob			Read
GetReferenceMetadata	omics:GetReferenceMetadata			Read
GetReferenceStore	omics:GetReferenceStore			Read
GetRun	omics:GetRun			Read
GetRunCache	omics:GetRunCache			Read
GetRunGroup	omics:GetRunGroup			Read
GetRunTask	omics:GetRunTask			Read
GetS3AccessPolicy	omics:GetS3AccessPolicy			Read
GetSequenceStore	omics:GetSequenceStore			Read
GetShare	omics:GetShare			Read
GetVariantImportJob	omics:GetVariantImportJob			Read
GetVariantStore	omics:GetVariantStore			Read
GetWorkflow	omics:GetWorkflow			Read
GetWorkflowVersion	omics:GetWorkflowVersion			Read
ListAnnotationImportJobs	omics:ListAnnotationImportJobs			List
ListAnnotationStoreVersions	omics:ListAnnotationStoreVersions			List
ListAnnotationStores	omics:ListAnnotationStores			List
ListBatch	omics:ListBatch			List
ListConfigurations	omics:ListConfigurations			List
ListMultipartReadSetUploads	omics:ListMultipartReadSetUploads			List
ListReadSetActivationJobs	omics:ListReadSetActivationJobs			List
ListReadSetExportJobs	omics:ListReadSetExportJobs			List
ListReadSetImportJobs	omics:ListReadSetImportJobs			List
ListReadSetUploadParts	omics:ListReadSetUploadParts			List
ListReadSets	omics:ListReadSets			List
ListReferenceImportJobs	omics:ListReferenceImportJobs			List
ListReferenceStores	omics:ListReferenceStores			List
ListReferences	omics:ListReferences			List
ListRunCaches	omics:ListRunCaches			List
ListRunGroups	omics:ListRunGroups			List
ListRunTasks	omics:ListRunTasks			List
ListRuns	omics:ListRuns			List
ListRunsInBatch	omics:ListRunsInBatch			List
ListSequenceStores	omics:ListSequenceStores			List
ListShares	omics:ListShares			List
ListTagsForResource	omics:ListTagsForResource			List
ListVariantImportJobs	omics:ListVariantImportJobs			List
ListVariantStores	omics:ListVariantStores			List
ListWorkflowVersions	omics:ListWorkflowVersions			List
ListWorkflows	omics:ListWorkflows			List
PutS3AccessPolicy	omics:PutS3AccessPolicy			Write
StartAnnotationImportJob	omics:StartAnnotationImportJob			Write
StartAnnotationImportJob	iam:PassRole	iam:PassedToService	omics.amazonaws.com	Write
StartReadSetActivationJob	omics:StartReadSetActivationJob			Write
StartReadSetExportJob	omics:StartReadSetExportJob			Write
StartReadSetExportJob	iam:PassRole	iam:PassedToService	omics.amazonaws.com	Write
StartReadSetImportJob	omics:StartReadSetImportJob			Write
	omics:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	omics.amazonaws.com	Write
StartReferenceImportJob	omics:StartReferenceImportJob			Write
	omics:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	omics.amazonaws.com	Write
StartRun	omics:StartRun			Write
	omics:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	omics.amazonaws.com	Write
StartRunBatch	omics:StartRun			Write
	omics:StartRunBatch			Write
	omics:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	omics.amazonaws.com	Write
StartVariantImportJob	omics:StartVariantImportJob			Write
StartVariantImportJob	iam:PassRole	iam:PassedToService	omics.amazonaws.com	Write
TagResource	omics:TagResource			Tagging, Write
UntagResource	omics:UntagResource			Tagging, Write
UpdateAnnotationStore	omics:UpdateAnnotationStore			Write
UpdateAnnotationStoreVersion	omics:UpdateAnnotationStoreVersion			Write
UpdateRunCache	omics:UpdateRunCache			Write
UpdateRunGroup	omics:UpdateRunGroup			Write
UpdateSequenceStore	omics:UpdateSequenceStore			Write
UpdateVariantStore	omics:UpdateVariantStore			Write
UpdateWorkflow	omics:UpdateWorkflow			Write
UpdateWorkflowVersion	omics:UpdateWorkflowVersion			Write
UploadReadSetPart	omics:UploadReadSetPart			Write

Actions defined by AWS HealthOmics

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AbortMultipartReadSetUpload	Grants permission to abort multipart read set uploads	sequenceStore*	aws:ResourceTag/${TagKey}	Write
AcceptShare	Grants permission to accept a share			Write
BatchDeleteReadSet	Grants permission to batch delete Read Sets in the given Sequence Store	sequenceStore*	aws:ResourceTag/${TagKey}	Write
CancelAnnotationImportJob	Grants permission to cancel an Annotation Import Job			Write
CancelRun	Grants permission to cancel a workflow run and stop all workflow tasks	run*	aws:ResourceTag/${TagKey}	Write
CancelRunBatch	Grants permission to cancel a batch of workflow runs	runBatch*	aws:ResourceTag/${TagKey}	Write
CancelVariantImportJob	Grants permission to cancel a Variant Import Job			Write
CompleteMultipartReadSetUpload	Grants permission to complete a multipart read set upload	sequenceStore*	aws:ResourceTag/${TagKey}	Write
CreateAnnotationStore	Grants permission to create an Annotation Store		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateAnnotationStoreVersion	Grants permission to create a Version in an Annotation Store	AnnotationStore*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConfiguration	Grants permission to create a new configuration		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateMultipartReadSetUpload	Grants permission to create a multipart read set upload	sequenceStore*	aws:ResourceTag/${TagKey}	Write
CreateReferenceStore	Grants permission to create a Reference Store		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateRunCache	Grants permission to create a new workflow run cache		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateRunGroup	Grants permission to create a new workflow run group		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateSequenceStore	Grants permission to create a Sequence Store		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateShare	Grants permission to create a share			Write
CreateVariantStore	Grants permission to create a Variant Store		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateWorkflow	Grants permission to create a new workflow with a workflow definition and template of workflow parameters		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateWorkflowVersion	Grants permission to create a new workflow version with a workflow definition and template of workflow parameters	workflow*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAnnotationStore	Grants permission to delete an Annotation Store	AnnotationStore*	aws:ResourceTag/${TagKey}	Write
DeleteAnnotationStoreVersions	Grants permission to delete Versions in an Annotation Store	AnnotationStore*	aws:ResourceTag/${TagKey}	Write
DeleteAnnotationStoreVersions	Grants permission to delete Versions in an Annotation Store	AnnotationStoreVersion*	aws:ResourceTag/${TagKey}	Write
DeleteBatch	Grants permission to delete a batch	runBatch*	aws:ResourceTag/${TagKey}	Write
DeleteConfiguration	Grants permission to delete a configuration	configuration*	aws:ResourceTag/${TagKey}	Write
DeleteReference	Grants permission to delete a Reference in the given Reference Store	reference*	aws:ResourceTag/${TagKey}	Write
DeleteReference		referenceStore*	aws:ResourceTag/${TagKey}	Write
DeleteReferenceStore	Grants permission to delete a Reference Store	referenceStore*	aws:ResourceTag/${TagKey}	Write
DeleteRun	Grants permission to delete a workflow run	run*	aws:ResourceTag/${TagKey}	Write
DeleteRunBatch	Grants permission to delete a batch of workflow runs	run*	aws:ResourceTag/${TagKey}	Write
DeleteRunBatch	Grants permission to delete a batch of workflow runs	runBatch*	aws:ResourceTag/${TagKey}	Write
DeleteRunCache	Grants permission to delete a workflow run cache	runCache*	aws:ResourceTag/${TagKey}	Write
DeleteRunGroup	Grants permission to delete a workflow run group	runGroup*	aws:ResourceTag/${TagKey}	Write
DeleteS3AccessPolicy	Grants permission to delete an access policy on a given store	sequenceStore*	aws:ResourceTag/${TagKey}	Write
DeleteSequenceStore	Grants permission to delete a Sequence Store	sequenceStore*	aws:ResourceTag/${TagKey}	Write
DeleteShare	Grants permission to delete a share			Write
DeleteVariantStore	Grants permission to delete a Variant Store	VariantStore*	aws:ResourceTag/${TagKey}	Write
DeleteWorkflow	Grants permission to delete a workflow	workflow*	aws:ResourceTag/${TagKey}	Write
DeleteWorkflowVersion	Grants permission to delete a workflow version	WorkflowVersion*	aws:ResourceTag/${TagKey}	Write
DeleteWorkflowVersion	Grants permission to delete a workflow version	workflow*	aws:ResourceTag/${TagKey}	Write
GetAnnotationImportJob	Grants permission to get the status of an Annotation Import Job			Read
GetAnnotationStore	Grants permission to get detailed information about an Annotation Store	AnnotationStore*	aws:ResourceTag/${TagKey}	Read
GetAnnotationStoreVersion	Grants permission to get detailed information about a version in an Annotation Store	AnnotationStoreVersion*	aws:ResourceTag/${TagKey}	Read
GetBatch	Grants permission to retrieve batch details and status	runBatch*	aws:ResourceTag/${TagKey}	Read
GetConfiguration	Grants permission to retrieve configuration details	configuration*	aws:ResourceTag/${TagKey}	Read
GetReadSet	Grants permission to get a Read Set in the given Sequence Store	readSet*	aws:ResourceTag/${TagKey}	Read
GetReadSet		sequenceStore*	aws:ResourceTag/${TagKey}	Read
GetReadSetActivationJob	Grants permission to get details about a Read Set activation job for the given Sequence Store	sequenceStore*	aws:ResourceTag/${TagKey}	Read
GetReadSetExportJob	Grants permission to get details about a Read Set export job for the given Sequence Store	sequenceStore*	aws:ResourceTag/${TagKey}	Read
GetReadSetImportJob	Grants permission to get details about a Read Set import job for the given Sequence Store	sequenceStore*	aws:ResourceTag/${TagKey}	Read
GetReadSetMetadata	Grants permission to get details about a Read Set in the given Sequence Store	readSet*	aws:ResourceTag/${TagKey}	Read
GetReadSetMetadata		sequenceStore*	aws:ResourceTag/${TagKey}	Read
GetReference	Grants permission to get a Reference in the given Reference Store	reference*	aws:ResourceTag/${TagKey}	Read
GetReference		referenceStore*	aws:ResourceTag/${TagKey}	Read
GetReferenceImportJob	Grants permission to get details about a Reference import job for the given Reference Store	referenceStore*	aws:ResourceTag/${TagKey}	Read
GetReferenceMetadata	Grants permission to get details about a Reference in the given Reference Store	reference*	aws:ResourceTag/${TagKey}	Read
GetReferenceMetadata		referenceStore*	aws:ResourceTag/${TagKey}	Read
GetReferenceStore	Grants permission to get details about a Reference Store	referenceStore*	aws:ResourceTag/${TagKey}	Read
GetRun	Grants permission to retrieve workflow run details	run*	aws:ResourceTag/${TagKey}	Read
GetRunCache	Grants permission to retrieve workflow run cache details	runCache*	aws:ResourceTag/${TagKey}	Read
GetRunGroup	Grants permission to retrieve workflow run group details	runGroup*	aws:ResourceTag/${TagKey}	Read
GetRunTask	Grants permission to retrieve workflow task details	TaskResource*		Read
GetRunTask	Grants permission to retrieve workflow task details	run*	aws:ResourceTag/${TagKey}	Read
GetS3AccessPolicy	Grants permission to get details about an access policy on a given store	sequenceStore*	aws:ResourceTag/${TagKey}	Read
GetSequenceStore	Grants permission to get details about a Sequence Store	sequenceStore*	aws:ResourceTag/${TagKey}	Read
GetShare	Grants permission to get detailed information about a Share			Read
GetVariantImportJob	Grants permission to get the status of a Variant Import Job			Read
GetVariantStore	Grants permission to get detailed information about a Variant Store	VariantStore*	aws:ResourceTag/${TagKey}	Read
GetWorkflow	Grants permission to retrieve workflow details	workflow*	aws:ResourceTag/${TagKey}	Read
GetWorkflowVersion	Grants permission to retrieve workflow version details	WorkflowVersion*	aws:ResourceTag/${TagKey}	Read
GetWorkflowVersion	Grants permission to retrieve workflow version details	workflow*	aws:ResourceTag/${TagKey}	Read
ListAnnotationImportJobs	Grants permission to get a list of Annotation Import Jobs			List
ListAnnotationStoreVersions	Grants permission to retrieve a list of information about Versions in an Annotation Store	AnnotationStore*	aws:ResourceTag/${TagKey}	List
ListAnnotationStores	Grants permission to retrieve a list of information about Annotation Stores			List
ListBatch	Grants permission to retrieve list of batches			List
ListConfigurations	Grants permission to retrieve a list of configurations			List
ListMultipartReadSetUploads	Grants permission to list multipart read set uploads	sequenceStore*	aws:ResourceTag/${TagKey}	List
ListReadSetActivationJobs	Grants permission to list Read Set activation jobs for the given Sequence Store	sequenceStore*	aws:ResourceTag/${TagKey}	List
ListReadSetExportJobs	Grants permission to list Read Set export jobs for the given Sequence Store	sequenceStore*	aws:ResourceTag/${TagKey}	List
ListReadSetImportJobs	Grants permission to list Read Set import jobs for the given Sequence Store	sequenceStore*	aws:ResourceTag/${TagKey}	List
ListReadSetUploadParts	Grants permission to list read set upload parts	sequenceStore*	aws:ResourceTag/${TagKey}	List
ListReadSets	Grants permission to list Read Sets in the given Sequence Store	sequenceStore*	aws:ResourceTag/${TagKey}	List
ListReferenceImportJobs	Grants permission to list Reference import jobs for the given Reference Store	referenceStore*	aws:ResourceTag/${TagKey}	List
ListReferenceStores	Grants permission to list Reference Stores			List
ListReferences	Grants permission to list References in the given Reference Store	referenceStore*	aws:ResourceTag/${TagKey}	List
ListRunCaches	Grants permission to retrieve a list of workflow run caches			List
ListRunGroups	Grants permission to retrieve a list of workflow run groups			List
ListRunTasks	Grants permission to retrieve a list of tasks for a workflow run	run*	aws:ResourceTag/${TagKey}	List
ListRuns	Grants permission to retrieve a list of workflow runs			List
ListRunsInBatch	Grants permission to retrieve list of workflow runs in batch	runBatch*	aws:ResourceTag/${TagKey}	List
ListSequenceStores	Grants permission to list Sequence Stores			List
ListShares	Grants permission to retrieve a list of information about shares			List
ListTagsForResource	Grants permission to retrieve a list of resource AWS tags			List
ListVariantImportJobs	Grants permission to get a list of Variant Import Jobs			List
ListVariantStores	Grants permission to retrieve a list of metadata for Variant Stores			List
ListWorkflowVersions	Grants permission to retrieve a list of available versions for a workflow	workflow*	aws:ResourceTag/${TagKey}	List
ListWorkflows	Grants permission to retrieve a list of available workflows			List
PutS3AccessPolicy	Grants permission to put an access policy on a given store	sequenceStore*	aws:ResourceTag/${TagKey}	Write
StartAnnotationImportJob	Grants permission to import a list of Annotation files to an Annotation Store	AnnotationStore*	aws:ResourceTag/${TagKey}	Write
StartAnnotationImportJob		AnnotationStoreVersion*	aws:ResourceTag/${TagKey}	Write
StartReadSetActivationJob	Grants permission to start a Read Set activation job from the given Sequence Store	sequenceStore*	aws:ResourceTag/${TagKey}	Write
StartReadSetExportJob	Grants permission to start a Read Set export job from the given Sequence Store	sequenceStore*	aws:ResourceTag/${TagKey}	Write
StartReadSetImportJob	Grants permission to start a Read Set import job into the given Sequence Store	sequenceStore*	aws:ResourceTag/${TagKey}	Write
StartReferenceImportJob	Grants permission to start a Reference import job into the given Reference Store	referenceStore*	aws:ResourceTag/${TagKey}	Write
StartRun	Grants permission to start a workflow run	configuration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		run*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		runBatch	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		runCache	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		runGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workflow	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
StartRunBatch	Grants permission to start batch of workflow runs	run*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		runBatch*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		runCache	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		runGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workflow	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
StartVariantImportJob	Grants permission to import a list of variant files to an Variant Store	VariantStore*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add AWS tags to a resource	AnnotationStore	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		AnnotationStoreVersion	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		VariantStore	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		WorkflowVersion	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		configuration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		readSet	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		reference	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		referenceStore	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		run	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		runBatch	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		runCache	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		runGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		sequenceStore	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workflow	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove resource AWS tags	AnnotationStore	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		AnnotationStoreVersion	aws:ResourceTag/${TagKey} aws:TagKeys
		VariantStore	aws:ResourceTag/${TagKey} aws:TagKeys
		WorkflowVersion	aws:ResourceTag/${TagKey} aws:TagKeys
		configuration	aws:ResourceTag/${TagKey} aws:TagKeys
		readSet	aws:ResourceTag/${TagKey} aws:TagKeys
		reference	aws:ResourceTag/${TagKey} aws:TagKeys
		referenceStore	aws:ResourceTag/${TagKey} aws:TagKeys
		run	aws:ResourceTag/${TagKey} aws:TagKeys
		runBatch	aws:ResourceTag/${TagKey} aws:TagKeys
		runCache	aws:ResourceTag/${TagKey} aws:TagKeys
		runGroup	aws:ResourceTag/${TagKey} aws:TagKeys
		sequenceStore	aws:ResourceTag/${TagKey} aws:TagKeys
		workflow	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAnnotationStore	Grants permission to update information about the Annotation Store	AnnotationStore*	aws:ResourceTag/${TagKey}	Write
UpdateAnnotationStoreVersion	Grants permission to update information about the Version in an Annotation Store	AnnotationStoreVersion*	aws:ResourceTag/${TagKey}	Write
UpdateRunCache	Grants permission to update a workflow run cache	runCache*	aws:ResourceTag/${TagKey}	Write
UpdateRunGroup	Grants permission to update a workflow run group	runGroup*	aws:ResourceTag/${TagKey}	Write
UpdateSequenceStore	Grants permission to update details about a Sequence Store	sequenceStore*	aws:ResourceTag/${TagKey}	Write
UpdateVariantStore	Grants permission to update metadata about the Variant Store	VariantStore*	aws:ResourceTag/${TagKey}	Write
UpdateWorkflow	Grants permission to update workflow details	workflow*	aws:ResourceTag/${TagKey}	Write
UpdateWorkflowVersion	Grants permission to update workflow version details	WorkflowVersion*	aws:ResourceTag/${TagKey}	Write
UpdateWorkflowVersion	Grants permission to update workflow version details	workflow*	aws:ResourceTag/${TagKey}	Write
UploadReadSetPart	Grants permission to upload read set parts	sequenceStore*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS HealthOmics

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
AnnotationStore	arn:${Partition}:omics:${Region}:${Account}:annotationStore/${AnnotationStoreName}	aws:ResourceTag/${TagKey}
AnnotationStoreVersion	arn:${Partition}:omics:${Region}:${Account}:annotationStore/${AnnotationStoreName}/version/${AnnotationStoreVersionName}	aws:ResourceTag/${TagKey}
TaskResource	arn:${Partition}:omics:${Region}:${Account}:task/${Id}
VariantStore	arn:${Partition}:omics:${Region}:${Account}:variantStore/${VariantStoreName}	aws:ResourceTag/${TagKey}
WorkflowVersion	arn:${Partition}:omics:${Region}:${Account}:workflow/${Id}/version/${VersionName}	aws:ResourceTag/${TagKey}
configuration	arn:${Partition}:omics:${Region}:${Account}:configuration/${Name}	aws:ResourceTag/${TagKey}
readSet	arn:${Partition}:omics:${Region}:${Account}:sequenceStore/${SequenceStoreId}/readSet/${ReadSetId}	aws:ResourceTag/${TagKey}
reference	arn:${Partition}:omics:${Region}:${Account}:referenceStore/${ReferenceStoreId}/reference/${ReferenceId}	aws:ResourceTag/${TagKey}
referenceStore	arn:${Partition}:omics:${Region}:${Account}:referenceStore/${ReferenceStoreId}	aws:ResourceTag/${TagKey}
run	arn:${Partition}:omics:${Region}:${Account}:run/${Id}	aws:ResourceTag/${TagKey}
runBatch	arn:${Partition}:omics:${Region}:${Account}:runBatch/${BatchId}	aws:ResourceTag/${TagKey}
runCache	arn:${Partition}:omics:${Region}:${Account}:runCache/${Id}	aws:ResourceTag/${TagKey}
runGroup	arn:${Partition}:omics:${Region}:${Account}:runGroup/${Id}	aws:ResourceTag/${TagKey}
sequenceStore	arn:${Partition}:omics:${Region}:${Account}:sequenceStore/${SequenceStoreId}	aws:ResourceTag/${TagKey}
workflow	arn:${Partition}:omics:${Region}:${Account}:workflow/${Id}	aws:ResourceTag/${TagKey}

Condition keys for AWS HealthOmics

AWS HealthOmics defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by the presence of tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS HealthLake (healthlake)

AWS IAM Access Analyzer (access-analyzer)