Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Amplify

AWS Amplify (service prefix: amplify) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS Amplify

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateApp	amplify:CreateApp			Write
	amplify:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	amplify.amazonaws.com	Write
CreateBackendEnvironment	amplify:CreateBackendEnvironment			Write
CreateBranch	amplify:CreateBranch			Write
	amplify:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	amplify.amazonaws.com	Write
CreateDeployment	amplify:CreateDeployment			Write
CreateDomainAssociation	amplify:CreateDomainAssociation			Write
CreateDomainAssociation	iam:PassRole	iam:PassedToService	amplify.amazonaws.com	Write
CreateWebhook	amplify:CreateWebHook			Write
DeleteApp	amplify:DeleteApp			Write
DeleteBackendEnvironment	amplify:DeleteBackendEnvironment			Write
DeleteBranch	amplify:DeleteBranch			Write
DeleteDomainAssociation	amplify:DeleteDomainAssociation			Write
DeleteJob	amplify:DeleteJob			Write
DeleteWebhook	amplify:DeleteWebHook			Write
GenerateAccessLogs	amplify:GenerateAccessLogs			Write
GetApp	amplify:GetApp			Read
GetArtifactUrl	amplify:GetArtifactUrl			Read
GetBackendEnvironment	amplify:GetBackendEnvironment			Read
GetBranch	amplify:GetBranch			Read
GetDomainAssociation	amplify:GetDomainAssociation			Read
GetJob	amplify:GetJob			Read
GetWebhook	amplify:GetWebHook			Read
ListApps	amplify:ListApps			List
ListArtifacts	amplify:ListArtifacts			List
ListBackendEnvironments	amplify:ListBackendEnvironments			List
ListBranches	amplify:ListBranches			List
ListDomainAssociations	amplify:ListDomainAssociations			List
ListJobs	amplify:ListJobs			List
ListTagsForResource	amplify:ListTagsForResource			Read
ListWebhooks	amplify:ListWebHooks			List
StartDeployment	amplify:StartDeployment			Write
StartJob	amplify:StartJob			Write
StopJob	amplify:StopJob			Write
TagResource	amplify:TagResource			Tagging, Write
UntagResource	amplify:UntagResource			Tagging, Write
UpdateApp	amplify:UpdateApp			Write
UpdateApp	iam:PassRole	iam:PassedToService	amplify.amazonaws.com	Write
UpdateBranch	amplify:UpdateBranch			Write
UpdateBranch	iam:PassRole	iam:PassedToService	amplify.amazonaws.com	Write
UpdateDomainAssociation	amplify:UpdateDomainAssociation			Write
UpdateDomainAssociation	iam:PassRole	iam:PassedToService	amplify.amazonaws.com	Write
UpdateWebhook	amplify:UpdateWebHook			Write

Actions defined by AWS Amplify

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateWebACL	Grants permission to associate a WebACL to a Resource	apps*	aws:ResourceTag/${TagKey}	Write
CreateApp	Grants permission to create a new Amplify App		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateBackendEnvironment	Grants permission to create a new backend environment for an Amplify App	apps*	aws:ResourceTag/${TagKey}	Write
CreateBranch	Grants permission to create a new Branch for an Amplify App	branches*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDeployment	Grants permission to create a deployment for manual deploy apps. (Apps are not connected to repository)	branches*	aws:ResourceTag/${TagKey}	Write
CreateDomainAssociation	Grants permission to create a new DomainAssociation on an App	domains*	aws:ResourceTag/${TagKey}	Write
CreateWebHook	Grants permission to create a new webhook on an App	branches*	aws:ResourceTag/${TagKey}	Write
DeleteApp	Grants permission to delete an existing Amplify App by appId	apps*	aws:ResourceTag/${TagKey}	Write
DeleteBackendEnvironment	Grants permission to delete a branch for an Amplify App	apps*	aws:ResourceTag/${TagKey}	Write
DeleteBranch	Grants permission to delete a branch for an Amplify App	branches*	aws:ResourceTag/${TagKey}	Write
DeleteDomainAssociation	Grants permission to delete a DomainAssociation	domains*	aws:ResourceTag/${TagKey}	Write
DeleteJob	Grants permission to delete a job, for an Amplify branch, part of Amplify App	jobs*		Write
DeleteWebHook	Grants permission to delete a webhook by id	webhooks*	aws:ResourceTag/${TagKey}	Write
DisassociateWebACL	Grants permission to disassociate a WebACL from a Resource	apps*	aws:ResourceTag/${TagKey}	Write
GenerateAccessLogs	Grants permission to generate website access logs for a specific time range via a pre-signed URL	apps*	aws:ResourceTag/${TagKey}	Write
GetApp	Grants permission to retrieve an existing Amplify App by appId	apps*	aws:ResourceTag/${TagKey}	Read
GetArtifactUrl	Grants permission to retrieve artifact info that corresponds to a artifactId	apps*	aws:ResourceTag/${TagKey}	Read
GetBackendEnvironment	Grants permission to retrieve a backend environment for an Amplify App	apps*	aws:ResourceTag/${TagKey}	Read
GetBranch	Grants permission to retrieve a branch for an Amplify App	branches*	aws:ResourceTag/${TagKey}	Read
GetDomainAssociation	Grants permission to retrieve domain info that corresponds to an appId and domainName	domains*	aws:ResourceTag/${TagKey}	Read
GetJob	Grants permission to get a job for a branch, part of an Amplify App	jobs*		Read
GetWebACLForResource	Grants permission to retrieve the WebACL associated with a Resource	apps*	aws:ResourceTag/${TagKey}	Read
GetWebHook	Grants permission to retrieve webhook info that corresponds to a webhookId	webhooks*	aws:ResourceTag/${TagKey}	Read
ListApps	Grants permission to list existing Amplify Apps			List
ListArtifacts	Grants permission to list artifacts with an app, a branch, a job and an artifact type	apps*	aws:ResourceTag/${TagKey}	List
ListBackendEnvironments	Grants permission to list backend environments for an Amplify App	apps*	aws:ResourceTag/${TagKey}	List
ListBranches	Grants permission to list branches for an Amplify App	apps*	aws:ResourceTag/${TagKey}	List
ListDomainAssociations	Grants permission to list domains with an app	apps*	aws:ResourceTag/${TagKey}	List
ListJobs	Grants permission to list Jobs for a branch, part of an Amplify App	branches*	aws:ResourceTag/${TagKey}	List
ListResourcesForWebACL	Grants permission to list the Resources associated with a WebACL			List
ListTagsForResource	Grants permission to list tags for an AWS Amplify Console resource	apps	aws:ResourceTag/${TagKey}	Read
		branches	aws:ResourceTag/${TagKey}
		domains	aws:ResourceTag/${TagKey}
		webhooks	aws:ResourceTag/${TagKey}
ListWebHooks	Grants permission to list webhooks on an App	apps*	aws:ResourceTag/${TagKey}	List
StartDeployment	Grants permission to start a deployment for manual deploy apps. (Apps are not connected to repository)	branches*	aws:ResourceTag/${TagKey}	Write
StartJob	Grants permission to start a new job for a branch, part of an Amplify App	jobs*		Write
StopJob	Grants permission to stop a job that is in progress, for an Amplify branch, part of Amplify App	jobs*		Write
TagResource	Grants permission to tag an AWS Amplify Console resource	apps	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		branches	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		domains	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		webhooks	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove a tag from an AWS Amplify Console resource	apps	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		branches	aws:ResourceTag/${TagKey} aws:TagKeys
		domains	aws:ResourceTag/${TagKey} aws:TagKeys
		webhooks	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateApp	Grants permission to update an existing Amplify App	apps*	aws:ResourceTag/${TagKey}	Write
UpdateBranch	Grants permission to update a branch for an Amplify App	branches*	aws:ResourceTag/${TagKey}	Write
UpdateDomainAssociation	Grants permission to update a DomainAssociation on an App	domains*	aws:ResourceTag/${TagKey}	Write
UpdateWebHook	Grants permission to update a webhook	webhooks*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS Amplify

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
apps	arn:${Partition}:amplify:${Region}:${Account}:apps/${AppId}	aws:ResourceTag/${TagKey}
branches	arn:${Partition}:amplify:${Region}:${Account}:apps/${AppId}/branches/${BranchName}	aws:ResourceTag/${TagKey}
domains	arn:${Partition}:amplify:${Region}:${Account}:apps/${AppId}/domains/${DomainName}	aws:ResourceTag/${TagKey}
jobs	arn:${Partition}:amplify:${Region}:${Account}:apps/${AppId}/branches/${BranchName}/jobs/${JobId}
webhooks	arn:${Partition}:amplify:${Region}:${Account}:webhooks/${WebhookId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Amplify

AWS Amplify defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a tag's key and value in a request	String
aws:ResourceTag/${TagKey}	Filters access by a tag's key associated with the resource	String
aws:TagKeys	Filters access by the tag keys in a request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Activate (activate)

AWS Amplify Admin (amplifybackend)