Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Payment Cryptography

AWS Payment Cryptography (service prefix: payment-cryptography) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Payment Cryptography
Actions defined by AWS Payment Cryptography
Resource types defined by AWS Payment Cryptography
Condition keys for AWS Payment Cryptography

API operations defined by AWS Payment Cryptography

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Access level
AddKeyReplicationRegions	payment-cryptography	payment-cryptography:AddKeyReplicationRegions	Write
AssociateMpaTeam	payment-cryptography	payment-cryptography:AssociateMpaTeam	Write
CreateAlias	payment-cryptography	payment-cryptography:CreateAlias	Write
CreateKey	payment-cryptography	payment-cryptography:CreateKey	Write
CreateKey	payment-cryptography	payment-cryptography:TagResource	Tagging, Write
DeleteAlias	payment-cryptography	payment-cryptography:DeleteAlias	Write
DeleteKey	payment-cryptography	payment-cryptography:DeleteKey	Write
DeleteResourcePolicy	payment-cryptography	payment-cryptography:DeleteResourcePolicy	Permissions management, Write
DisableDefaultKeyReplicationRegions	payment-cryptography	payment-cryptography:DisableDefaultKeyReplicationRegions	Write
EnableDefaultKeyReplicationRegions	payment-cryptography	payment-cryptography:EnableDefaultKeyReplicationRegions	Write
ExportKey	payment-cryptography	payment-cryptography:ExportKey	Write
GetAlias	payment-cryptography	payment-cryptography:GetAlias	Read
GetCertificateSigningRequest	payment-cryptography	payment-cryptography:GetCertificateSigningRequest	Read
GetDefaultKeyReplicationRegions	payment-cryptography	payment-cryptography:GetDefaultKeyReplicationRegions	Read
GetKey	payment-cryptography	payment-cryptography:GetKey	Read
GetMpaTeamAssociation	payment-cryptography	payment-cryptography:GetMpaTeamAssociation	Read
GetParametersForExport	payment-cryptography	payment-cryptography:GetParametersForExport	Read
GetParametersForImport	payment-cryptography	payment-cryptography:GetParametersForImport	Read
GetPublicKeyCertificate	payment-cryptography	payment-cryptography:GetPublicKeyCertificate	Read
GetResourcePolicy	payment-cryptography	payment-cryptography:GetResourcePolicy	Read
ImportKey	payment-cryptography	payment-cryptography:ImportKey	Write
ImportKey	payment-cryptography	payment-cryptography:TagResource	Tagging, Write
ListAliases	payment-cryptography	payment-cryptography:ListAliases	List
ListKeys	payment-cryptography	payment-cryptography:ListKeys	List
ListTagsForResource	payment-cryptography	payment-cryptography:ListTagsForResource	Read
PutResourcePolicy	payment-cryptography	payment-cryptography:PutResourcePolicy	Permissions management, Write
RemoveKeyReplicationRegions	payment-cryptography	payment-cryptography:RemoveKeyReplicationRegions	Write
RestoreKey	payment-cryptography	payment-cryptography:RestoreKey	Write
StartKeyUsage	payment-cryptography	payment-cryptography:StartKeyUsage	Write
StopKeyUsage	payment-cryptography	payment-cryptography:StopKeyUsage	Write
TagResource	payment-cryptography	payment-cryptography:TagResource	Tagging, Write
UntagResource	payment-cryptography	payment-cryptography:UntagResource	Tagging, Write
UpdateAlias	payment-cryptography	payment-cryptography:UpdateAlias	Write

Actions defined by AWS Payment Cryptography

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddKeyReplicationRegions	Grants permission to add replication regions to an existing AWS Payment Cryptography key	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
AddKeyReplicationRegions		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
AssociateMpaTeam	Grants permission to associate an MPA approval team with a payment cryptography action	approval-team*	aws:ResourceTag/${TagKey}	Write
CreateAlias	Grants permission to create a user-friendly name for a Key	alias*	payment-cryptography:ResourceAliases	Write
CreateAlias	Grants permission to create a user-friendly name for a Key	key*	aws:ResourceTag/${TagKey} payment-cryptography:ResourceAliases	Write
CreateKey	Grants permission to create a unique customer managed key in the caller's AWS account and region		aws:RequestTag/${TagKey} aws:TagKeys payment-cryptography:KeyAlgorithm payment-cryptography:KeyClass payment-cryptography:KeyUsage	Write
DecryptData	Grants permission to decrypt ciphertext data to plaintext using symmetric, asymmetric or DUKPT data encryption key	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
DecryptData		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
DeleteAlias	Grants permission to delete the specified alias	alias*	aws:RequestTag/${TagKey} aws:TagKeys payment-cryptography:ResourceAliases	Write
DeleteKey	Grants permission to schedule the deletion of a Key	key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
DeleteResourcePolicy	Grants permission to delete the resource-based policy attached to a key	key*	aws:ResourceTag/${TagKey} payment-cryptography:ResourceAliases	Permissions management, Write
DisableDefaultKeyReplicationRegions	Grants permission to disable default key replication regions for account-level replication			Write
DisassociateMpaTeam	Grants permission to disassociate an MPA approval team from a payment cryptography action	approval-team*	aws:ResourceTag/${TagKey}	Write
EnableDefaultKeyReplicationRegions	Grants permission to enable default key replication regions for account-level replication			Write
EncryptData	Grants permission to encrypt plaintext data to ciphertext using symmetric, asymmetric or DUKPT data encryption key	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
EncryptData		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
ExportKey	Grants permission to export a key from the service	key*	aws:ResourceTag/${TagKey} payment-cryptography:CertificateAuthorityPublicKeyIdentifier payment-cryptography:RequestAlias payment-cryptography:ResourceAliases payment-cryptography:WrappingKeyIdentifier	Write
GenerateAs2805KekValidation	Grants permission to generate a KekValidationRequest or a KekValidationResponse for node-to-node initialization between payment processing nodes using Australian Standard 2805 (AS2805)	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
GenerateAs2805KekValidation		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
GenerateCardValidationData	Grants permission to generate card-related data using algorithms such as Card Verification Values (CVV/CVV2), Dynamic Card Verification Values (dCVV/dCVV2) or Card Security Codes (CSC) that check the validity of a magnetic stripe card	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
GenerateCardValidationData		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
GenerateMac	Grants permission to generate a MAC (Message Authentication Code) cryptogram	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
GenerateMac		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
GenerateMacEmvPinChange	Grants permission to generate a MAC (Message Authentication Code) cryptogram	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
GenerateMacEmvPinChange		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
GeneratePinData	Grants permission to generate pin-related data such as PIN, PIN Verification Value (PVV), PIN Block and PIN Offset during new card issuance or card re-issuance	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
GeneratePinData		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
GetAlias	Grants permission to return the keyArn associated with an aliasName	alias*	aws:RequestTag/${TagKey} aws:TagKeys payment-cryptography:ResourceAliases	Read
GetAlias		key*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys payment-cryptography:ResourceAliases	Read
GetCertificateSigningRequest	Grants permission to return the Certificate Signing Request for a public key from a key of class PUBLIC_KEY	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Read
GetCertificateSigningRequest		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Read
GetDefaultKeyReplicationRegions	Grants permission to retrieve the default key replication regions configured at the account level			Read
GetKey	Grants permission to return the detailed information about the specified key	key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Read
GetMpaTeamAssociation	Grants permission to retrieve information about an MPA approval team association for a payment cryptography action	approval-team*	aws:ResourceTag/${TagKey}	Read
GetParametersForExport	Grants permission to get the export token and the signing key certificate to initiate a TR-34 key export			Read
GetParametersForImport	Grants permission to get the import token and the wrapping key certificate to initiate a TR-34 key import			Read
GetPublicKeyCertificate	Grants permission to return the public key from a key of class PUBLIC_KEY	key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Read
GetResourcePolicy	Grants permission to retrieve the resource-based policy attached to a key	key*	aws:ResourceTag/${TagKey} payment-cryptography:ResourceAliases	Read
ImportKey	Grants permission to imports keys and public key certificates		aws:RequestTag/${TagKey} aws:TagKeys payment-cryptography:CertificateAuthorityPublicKeyIdentifier payment-cryptography:ImportKeyMaterial payment-cryptography:WrappingKeyIdentifier	Write
ListAliases	Grants permission to return a list of aliases created for all keys in the caller's AWS account and Region			List
ListKeys	Grants permission to return a list of keys created in the caller's AWS account and Region			List
ListTagsForResource	Grants permission to return a list of tags created in the caller's AWS account and Region	key	aws:ResourceTag/${TagKey} payment-cryptography:ResourceAliases	Read
PutResourcePolicy	Grants permission to attach or replace a resource-based policy on a key	key*	aws:ResourceTag/${TagKey} payment-cryptography:ResourceAliases	Permissions management, Write
ReEncryptData	Grants permission to re-encrypt ciphertext using DUKPT, Symmetric and Asymmetric Data Encryption Keys	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
ReEncryptData		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
RemoveKeyReplicationRegions	Grants permission to remove replication regions from an existing AWS Payment Cryptography key	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
RemoveKeyReplicationRegions		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
RestoreKey	Grants permission to cancel a scheduled key deletion if at any point during the waiting period a Key needs to be revived	key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
StartKeyUsage	Grants permission to enable a disabled Key	key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
StopKeyUsage	Grants permission to disable an enabled Key	key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
TagResource	Grants permission to add or overwrites one or more tags for the specified resource	key*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys payment-cryptography:ResourceAliases	Tagging, Write
TranslateKeyMaterial	Grants permission to translate wrapping key type for a wrapped key	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
TranslateKeyMaterial		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
TranslatePinData	Grants permission to translate encrypted PIN block from and to ISO 9564 formats 0,1,3,4	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
TranslatePinData		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
UntagResource	Grants permission to remove the specified tag or tags from the specified resource	key*	aws:ResourceTag/${TagKey} aws:TagKeys payment-cryptography:ResourceAliases	Tagging, Write
UpdateAlias	Grants permission to change the key to which an alias is assigned, or unassign it from its current key	alias*	aws:RequestTag/${TagKey} aws:TagKeys payment-cryptography:ResourceAliases	Write
UpdateAlias		key*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys payment-cryptography:ResourceAliases	Write
VerifyAuthRequestCryptogram	Grants permission to verify Authorization Request Cryptogram (ARQC) for a EMV chip payment card authorization	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
VerifyAuthRequestCryptogram		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
VerifyCardValidationData	Grants permission to verify card-related validation data using algorithms such as Card Verification Values (CVV/CVV2), Dynamic Card Verification Values (dCVV/dCVV2) and Card Security Codes (CSC)	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
VerifyCardValidationData		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
VerifyMac	Grants permission to verify MAC (Message Authentication Code) of input data against a provided MAC	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
VerifyMac		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
VerifyPinData	Grants permission to verify pin-related data such as PIN and PIN Offset using algorithms including VISA PVV and IBM3624	alias*	payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write
VerifyPinData		key*	aws:ResourceTag/${TagKey} payment-cryptography:RequestAlias payment-cryptography:ResourceAliases	Write

Resource types defined by AWS Payment Cryptography

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
alias	arn:${Partition}:payment-cryptography:${Region}:${Account}:alias/${Alias}	payment-cryptography:ResourceAliases
approval-team	arn:${Partition}:mpa:${Region}:${Account}:approval-team/${ApprovalTeamId}	aws:ResourceTag/${TagKey}
key	arn:${Partition}:payment-cryptography:${Region}:${Account}:key/${KeyId}	aws:ResourceTag/${TagKey} payment-cryptography:ResourceAliases

Resource types

ARN

Condition keys

alias

arn:${Partition}:payment-cryptography:${Region}:${Account}:alias/${Alias}

payment-cryptography:ResourceAliases

approval-team

arn:${Partition}:mpa:${Region}:${Account}:approval-team/${ApprovalTeamId}

aws:ResourceTag/${TagKey}

key

arn:${Partition}:payment-cryptography:${Region}:${Account}:key/${KeyId}

aws:ResourceTag/${TagKey}

payment-cryptography:ResourceAliases

Condition keys for AWS Payment Cryptography

AWS Payment Cryptography defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by both the key and value of the tag in the request for the specified operation	String
aws:ResourceTag/${TagKey}	Filters access by tags assigned to a key for the specified operation	String
aws:TagKeys	Filters access by the tag keys in the request for the specified operation	ArrayOfString
payment-cryptography:CertificateAuthorityPublicKeyIdentifier	Filters access by the CertificateAuthorityPublicKeyIdentifier specified in the request or the ImportKey, and ExportKey operations	String
payment-cryptography:ImportKeyMaterial	Filters access by the type of key material being imported [RootCertificatePublicKey, TrustedCertificatePublicKey, Tr34KeyBlock, Tr31KeyBlock, DiffieHellmanTr31KeyBlock, As2805KeyCryptogram, KeyCryptogram] for the ImportKey operation	String
payment-cryptography:KeyAlgorithm	Filters access by KeyAlgorithm specified in the request for the CreateKey operation	String
payment-cryptography:KeyClass	Filters access by KeyClass specified in the request for the CreateKey operation	String
payment-cryptography:KeyUsage	Filters access by KeyClass specified in the request or associated with a key for the CreateKey operation	String
payment-cryptography:RequestAlias	Filters access by aliases in the request for the specified operation	String
payment-cryptography:ResourceAliases	Filters access by aliases associated with a key for the specified operation	ArrayOfString
payment-cryptography:WrappingKeyIdentifier	Filters access by the WrappingKeyIdentifier specified in the request for the ImportKey, and ExportKey operations	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Partner central account management (partnercentral-account-management)

AWS Payments (payments)