Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Parallel Computing Service

AWS Parallel Computing Service (service prefix: pcs) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Parallel Computing Service
Actions defined by AWS Parallel Computing Service
Permission-only actions for AWS Parallel Computing Service
Resource types defined by AWS Parallel Computing Service
Condition keys for AWS Parallel Computing Service

API operations defined by AWS Parallel Computing Service

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateCluster	pcs:CreateCluster			Write
CreateCluster	pcs:TagResource			Tagging, Write
CreateComputeNodeGroup	pcs:CreateComputeNodeGroup			Write
	pcs:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ec2.amazonaws.com	Write
CreateQueue	pcs:CreateQueue			Write
CreateQueue	pcs:TagResource			Tagging, Write
DeleteCluster	pcs:DeleteCluster			Write
DeleteComputeNodeGroup	pcs:DeleteComputeNodeGroup			Write
DeleteQueue	pcs:DeleteQueue			Write
GetCluster	pcs:GetCluster			Read
GetComputeNodeGroup	pcs:GetComputeNodeGroup			Read
GetQueue	pcs:GetQueue			Read
ListClusters	pcs:ListClusters			List
ListComputeNodeGroups	pcs:ListComputeNodeGroups			List
ListQueues	pcs:ListQueues			List
ListTagsForResource	pcs:ListTagsForResource			Read
RegisterComputeNodeGroupInstance	pcs:RegisterComputeNodeGroupInstance			Write
TagResource	pcs:TagResource			Tagging, Write
UntagResource	pcs:UntagResource			Tagging, Write
UpdateCluster	pcs:UpdateCluster			Write
UpdateComputeNodeGroup	pcs:UpdateComputeNodeGroup			Write
UpdateComputeNodeGroup	iam:PassRole	iam:PassedToService	ec2.amazonaws.com	Write
UpdateQueue	pcs:UpdateQueue			Write

Actions defined by AWS Parallel Computing Service

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateCluster	Grants permission to create clusters		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateComputeNodeGroup	Grants permission to create compute node groups	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateQueue	Grants permission to create queues	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteCluster	Grants permission to delete clusters	cluster*	aws:ResourceTag/${TagKey}	Write
DeleteComputeNodeGroup	Grants permission to delete compute node groups	cluster*	aws:ResourceTag/${TagKey}	Write
DeleteComputeNodeGroup	Grants permission to delete compute node groups	computenodegroup*	aws:ResourceTag/${TagKey}	Write
DeleteQueue	Grants permission to delete queues	cluster*	aws:ResourceTag/${TagKey}	Write
DeleteQueue	Grants permission to delete queues	queue*	aws:ResourceTag/${TagKey}	Write
GetCluster	Grants permission to get cluster properties	cluster*	aws:ResourceTag/${TagKey}	Read
GetComputeNodeGroup	Grants permission to get compute node group properties	cluster*	aws:ResourceTag/${TagKey}	Read
GetComputeNodeGroup	Grants permission to get compute node group properties	computenodegroup*	aws:ResourceTag/${TagKey}	Read
GetQueue	Grants permission to get queue properties	cluster*	aws:ResourceTag/${TagKey}	Read
GetQueue	Grants permission to get queue properties	queue*	aws:ResourceTag/${TagKey}	Read
ListClusters	Grants permission to list clusters			List
ListComputeNodeGroups	Grants permission to list compute node groups	cluster*	aws:ResourceTag/${TagKey}	List
ListQueues	Grants permission to list queues	cluster*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list the tags for a resource			Read
RegisterComputeNodeGroupInstance	Grants permission to register a compute instance in a compute node group	cluster*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag a resource	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		computenodegroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		queue	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag a resource	cluster	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		computenodegroup	aws:ResourceTag/${TagKey} aws:TagKeys
		queue	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateCluster	Grants permission to update cluster properties	cluster*	aws:ResourceTag/${TagKey}	Write
UpdateComputeNodeGroup	Grants permission to update compute node group properties	cluster*	aws:ResourceTag/${TagKey}	Write
UpdateComputeNodeGroup	Grants permission to update compute node group properties	computenodegroup*	aws:ResourceTag/${TagKey}	Write
UpdateQueue	Grants permission to update queue properties	cluster*	aws:ResourceTag/${TagKey}	Write
UpdateQueue	Grants permission to update queue properties	queue*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for AWS Parallel Computing Service

The following actions are defined by AWS Parallel Computing Service but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AllowVendedLogDeliveryForResource	Grants permission to configure vended log delivery for AWS PCS cluster logs	cluster*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS Parallel Computing Service

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
cluster	arn:${Partition}:pcs:${Region}:${Account}:cluster/${ClusterIdentifier}	aws:ResourceTag/${TagKey}
computenodegroup	arn:${Partition}:pcs:${Region}:${Account}:cluster/${ClusterIdentifier}/computenodegroup/${ComputeNodeGroupIdentifier}	aws:ResourceTag/${TagKey}
queue	arn:${Partition}:pcs:${Region}:${Account}:cluster/${ClusterIdentifier}/queue/${QueueIdentifier}	aws:ResourceTag/${TagKey}

Condition keys for AWS Parallel Computing Service

AWS Parallel Computing Service defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Panorama (panorama)

AWS Partner Central (partnercentral)