Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Q Business Q Apps

Amazon Q Business Q Apps (service prefix: qapps) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Q Business Q Apps
Actions defined by Amazon Q Business Q Apps
Permission-only actions for Amazon Q Business Q Apps
Resource types defined by Amazon Q Business Q Apps
Condition keys for Amazon Q Business Q Apps

API operations defined by Amazon Q Business Q Apps

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
BatchCreateCategory	qapps:BatchCreateCategory	Write
BatchDeleteCategory	qapps:BatchDeleteCategory	Write
BatchUpdateCategory	qapps:BatchUpdateCategory	Write
CreateLibraryItem	qapps:CreateLibraryItem	Write
CreatePresignedUrl	qapps:ImportDocument	Write
CreateQApp	qapps:CreateQApp	Write
DeleteLibraryItem	qapps:DeleteLibraryItem	Write
DeleteQApp	qapps:DeleteQApp	Write
DescribeQAppPermissions	qapps:DescribeQAppPermissions	Read
DisassociateQAppFromUser	qapps:DisassociateQAppFromUser	Write
GetLibraryItem	qapps:GetLibraryItem	Read
GetQApp	qapps:GetQApp	Read
GetQAppSession	qapps:GetQAppSession	Read
GetQAppSessionMetadata	qapps:GetQAppSessionMetadata	Read
ImportDocument	qapps:ImportDocument	Write
ListCategories	qapps:ListCategories	List
ListLibraryItems	qapps:ListLibraryItems	List
ListQAppSessionData	qapps:ListQAppSessionData	Read
ListQApps	qapps:ListQApps	List
ListTagsForResource	qapps:ListTagsForResource	Read
StartQAppSession	qapps:StartQAppSession	Write
StopQAppSession	qapps:StopQAppSession	Write
TagResource	qapps:TagResource	Tagging, Write
UntagResource	qapps:UntagResource	Tagging, Write
UpdateLibraryItem	qapps:UpdateLibraryItem	Write
UpdateLibraryItemMetadata	qapps:UpdateLibraryItemMetadata	Write
UpdateQApp	qapps:UpdateQApp	Write
UpdateQAppPermissions	qapps:UpdateQAppPermissions	Write
UpdateQAppSession	qapps:UpdateQAppSession	Write
UpdateQAppSessionMetadata	qapps:UpdateQAppSessionMetadata	Write

Actions defined by Amazon Q Business Q Apps

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateLibraryItemReview	Grants permission to associate a library item review in the Q Business application environment	qapp*	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:UserIsAppOwner	Write
AssociateQAppWithUser	Grants permission to associate Q App with a user in the Q Business application environment	application	qapps:AppIsPublished qapps:UserIsAppOwner	Write
AssociateQAppWithUser		qapp	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:UserIsAppOwner	Write
BatchCreateCategory	Grants permission to create the categories of a library in the Q Business application environment	application*		Write
BatchDeleteCategory	Grants permission to delete the categories of a library in the Q Business application environment	application*		Write
BatchUpdateCategory	Grants permission to update the categories of a library in the Q Business application environment	application*		Write
CreateLibraryItem	Grants permission to create a library item in the Q Business application environment	application	qapps:AppIsPublished qapps:UserIsAppOwner	Write
CreateLibraryItem		qapp	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:UserIsAppOwner	Write
CreateQApp	Grants permission to create Q App in the Q Business application environment	application*	aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteLibraryItem	Grants permission to delete a library item in the Q Business application environment	application	qapps:AppIsPublished qapps:UserIsAppOwner	Write
DeleteLibraryItem		qapp	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:UserIsAppOwner	Write
DeleteQApp	Grants permission to delete Q App in the Q Business application environment	application	qapps:AppIsPublished qapps:UserIsAppOwner	Write
DeleteQApp		qapp	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:UserIsAppOwner	Write
DescribeQAppPermissions	Grants permission to get Q App sharing permissions in the Q Business application environment	application	qapps:AppIsPublished qapps:UserIsAppOwner	Read
DescribeQAppPermissions		qapp	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:UserIsAppOwner	Read
DisassociateLibraryItemReview	Grants permission to disassociate a library item review in the Q Business application environment	qapp*	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:UserIsAppOwner	Write
DisassociateQAppFromUser	Grants permission to disassociate Q App with a user in the Q Business application environment	application	qapps:AppIsPublished qapps:UserIsAppOwner	Write
DisassociateQAppFromUser		qapp	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:UserIsAppOwner	Write
ExportQAppSessionData	Grants permission to export Q App session data in the Q Business application environment	qapp-session*	aws:ResourceTag/${TagKey}	Write
GetLibraryItem	Grants permission to get a library item in the Q Business application environment	application	qapps:AppIsPublished qapps:UserIsAppOwner	Read
GetLibraryItem		qapp	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:UserIsAppOwner	Read
GetQApp	Grants permission to get Q App in the Q Business application environment	application	qapps:AppIsPublished qapps:UserIsAppOwner	Read
GetQApp		qapp	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:UserIsAppOwner	Read
GetQAppSession	Grants permission to get Q App session in the Q Business application environment	qapp-session*	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:SessionIsShared qapps:UserIsAppOwner qapps:UserIsSessionModerator	Read
GetQAppSessionMetadata	Grants permission to get Q App session metadata in the Q Business application environment	qapp-session*	aws:ResourceTag/${TagKey}	Read
ImportDocument	Grants permission to import a document to Q App or Q App Session in the Q Business application environment	qapp	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:SessionIsShared qapps:UserIsAppOwner qapps:UserIsSessionModerator	Write
ImportDocument		qapp-session	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:SessionIsShared qapps:UserIsAppOwner qapps:UserIsSessionModerator	Write
ListCategories	Grants permission to list categories in the Q Business application environment	application*		List
ListLibraryItems	Grants permission to list library items in the Q Business application environment	application*		List
ListQAppSessionData	Grants permission to get Q App session data in the Q Business application environment	qapp-session*	aws:ResourceTag/${TagKey}	Read
ListQApps	Grants permission to list Q Apps in the Q Business application environment	application*		List
ListTagsForResource	Grants permission to list tags for a resource	qapp	aws:ResourceTag/${TagKey}	Read
ListTagsForResource	Grants permission to list tags for a resource	qapp-session	aws:ResourceTag/${TagKey}	Read
PredictQApp	Grants permission to predict Q App from conversation log or problem statement in the Q Business application environment	application*		Write
StartQAppSession	Grants permission to start Q App session in the Q Business application environment	application	aws:RequestTag/${TagKey} aws:TagKeys qapps:AppIsPublished qapps:UserIsAppOwner	Write
StartQAppSession		qapp	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys qapps:AppIsPublished qapps:UserIsAppOwner	Write
StopQAppSession	Grants permission to stop Q App session in the Q Business application environment	application	qapps:AppIsPublished qapps:SessionIsShared qapps:UserIsAppOwner qapps:UserIsSessionModerator	Write
StopQAppSession		qapp-session	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:SessionIsShared qapps:UserIsAppOwner qapps:UserIsSessionModerator	Write
TagResource	Grants permission to tag a resource with given key value pairs	qapp	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource		qapp-session	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove the tag with the given key from a resource	qapp	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource		qapp-session	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateLibraryItem	Grants permission to update a library item in the Q Business application environment	application	qapps:AppIsPublished qapps:UserIsAppOwner	Write
UpdateLibraryItem		qapp	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:UserIsAppOwner	Write
UpdateLibraryItemMetadata	Grants permission to update the metadata of a library item in the Q Business application environment	qapp*	aws:ResourceTag/${TagKey} qapps:AppIsPublished	Write
UpdateQApp	Grants permission to update Q App in the Q Business application environment	application	qapps:AppIsPublished qapps:UserIsAppOwner	Write
UpdateQApp		qapp	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:UserIsAppOwner	Write
UpdateQAppPermissions	Grants permission to update Q App sharing permissions in the Q Business application environment	application	qapps:AppIsPublished qapps:UserIsAppOwner	Write
UpdateQAppPermissions		qapp	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:UserIsAppOwner	Write
UpdateQAppSession	Grants permission to update Q App session in the Q Business application environment	qapp-session*	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:SessionIsShared qapps:UserIsAppOwner qapps:UserIsSessionModerator	Write
UpdateQAppSessionMetadata	Grants permission to update Q App session metadata in the Q Business application environment	qapp-session*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon Q Business Q Apps

The following actions are defined by Amazon Q Business Q Apps but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CopyQApp	Grants permission to copy Q App in the Q Business application environment	application	qapps:AppIsPublished qapps:UserIsAppOwner	Write
CopyQApp		qapp	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:UserIsAppOwner	Write
CreateLibraryItemReview	Grants permission to create a library item review in the Q Business application environment	application	qapps:AppIsPublished qapps:UserIsAppOwner	Write
CreateLibraryItemReview		qapp	aws:ResourceTag/${TagKey} qapps:AppIsPublished qapps:UserIsAppOwner	Write
CreateSubscriptionToken	Grants permission to subscribe to a Q App event bus topic in the Q Business application environment	application*		Write
PredictProblemStatementFromConversation	Grants permission to predict problem statement from conversation log in the Q Business application environment	application*		Write
PredictQAppFromProblemStatement	Grants permission to predict Q App metadata from problem statement in the Q Business application environment	application*		Write

Resource types defined by Amazon Q Business Q Apps

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
application	arn:${Partition}:qbusiness:${Region}:${Account}:application/${ApplicationId}
qapp	arn:${Partition}:qapps:${Region}:${Account}:application/${ApplicationId}/qapp/${AppId}	aws:ResourceTag/${TagKey}
qapp-session	arn:${Partition}:qapps:${Region}:${Account}:application/${ApplicationId}/qapp/${AppId}/session/${SessionId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Q Business Q Apps

Amazon Q Business Q Apps defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
qapps:AppIsPublished	Filters access by whether Q App is published	String
qapps:SessionIsShared	Filters access by whether Q App Session is shared	String
qapps:UserIsAppOwner	Filters access by whether requester is Q App owner	String
qapps:UserIsSessionModerator	Filters access by whether requester is Q App Session moderator	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Q Business (qbusiness)

Amazon Q Developer (qdeveloper)