Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Cloud Directory

Amazon Cloud Directory (service prefix: clouddirectory) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Cloud Directory
Actions defined by Amazon Cloud Directory
Resource types defined by Amazon Cloud Directory
Condition keys for Amazon Cloud Directory

API operations defined by Amazon Cloud Directory

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AddFacetToObject	clouddirectory:AddFacetToObject	Write
ApplySchema	clouddirectory:ApplySchema	Write
AttachObject	clouddirectory:AttachObject	Write
AttachPolicy	clouddirectory:AttachPolicy	Write
AttachToIndex	clouddirectory:AttachToIndex	Write
AttachTypedLink	clouddirectory:AttachTypedLink	Write
BatchRead	clouddirectory:BatchRead	Read
	clouddirectory:GetLinkAttributes	Read
	clouddirectory:GetObjectAttributes	Read
	clouddirectory:GetObjectInformation	Read
	clouddirectory:ListAttachedIndices	Read
	clouddirectory:ListIncomingTypedLinks	Read
	clouddirectory:ListIndex	Read
	clouddirectory:ListObjectAttributes	Read
	clouddirectory:ListObjectChildren	Read
	clouddirectory:ListObjectParentPaths	Read
	clouddirectory:ListObjectParents	Read
	clouddirectory:ListObjectPolicies	Read
	clouddirectory:ListOutgoingTypedLinks	Read
	clouddirectory:ListPolicyAttachments	Read
	clouddirectory:LookupPolicy	Read
BatchWrite	clouddirectory:AddFacetToObject	Write
	clouddirectory:AttachObject	Write
	clouddirectory:AttachPolicy	Write
	clouddirectory:AttachToIndex	Write
	clouddirectory:AttachTypedLink	Write
	clouddirectory:BatchWrite	Write
	clouddirectory:CreateIndex	Write
	clouddirectory:CreateObject	Write
	clouddirectory:DeleteObject	Write
	clouddirectory:DetachFromIndex	Write
	clouddirectory:DetachObject	Write
	clouddirectory:DetachTypedLink	Write
	clouddirectory:RemoveFacetFromObject	Write
	clouddirectory:UpdateLinkAttributes	Write
	clouddirectory:UpdateObjectAttributes	Write
CreateDirectory	clouddirectory:CreateDirectory	Write
CreateFacet	clouddirectory:CreateFacet	Write
CreateIndex	clouddirectory:AttachObject	Write
CreateIndex	clouddirectory:CreateIndex	Write
CreateObject	clouddirectory:AttachObject	Write
CreateObject	clouddirectory:CreateObject	Write
CreateSchema	clouddirectory:CreateSchema	Write
CreateTypedLinkFacet	clouddirectory:CreateTypedLinkFacet	Write
DeleteDirectory	clouddirectory:DeleteDirectory	Write
DeleteFacet	clouddirectory:DeleteFacet	Write
DeleteObject	clouddirectory:DeleteObject	Write
DeleteSchema	clouddirectory:DeleteSchema	Write
DeleteTypedLinkFacet	clouddirectory:DeleteTypedLinkFacet	Write
DetachFromIndex	clouddirectory:DetachFromIndex	Write
DetachObject	clouddirectory:DetachObject	Write
DetachPolicy	clouddirectory:DetachPolicy	Write
DetachTypedLink	clouddirectory:DetachTypedLink	Write
DisableDirectory	clouddirectory:DisableDirectory	Write
EnableDirectory	clouddirectory:EnableDirectory	Write
GetAppliedSchemaVersion	clouddirectory:GetAppliedSchemaVersion	Read
GetDirectory	clouddirectory:GetDirectory	Read
GetFacet	clouddirectory:GetFacet	Read
GetLinkAttributes	clouddirectory:GetLinkAttributes	Read
GetObjectAttributes	clouddirectory:GetObjectAttributes	Read
GetObjectInformation	clouddirectory:GetObjectInformation	Read
GetSchemaAsJson	clouddirectory:GetSchemaAsJson	Read
GetTypedLinkFacetInformation	clouddirectory:GetTypedLinkFacetInformation	Read
ListAppliedSchemaArns	clouddirectory:ListAppliedSchemaArns	List
ListAttachedIndices	clouddirectory:ListAttachedIndices	Read
ListDevelopmentSchemaArns	clouddirectory:ListDevelopmentSchemaArns	List
ListDirectories	clouddirectory:ListDirectories	List
ListFacetAttributes	clouddirectory:ListFacetAttributes	Read
ListFacetNames	clouddirectory:ListFacetNames	Read
ListIncomingTypedLinks	clouddirectory:ListIncomingTypedLinks	Read
ListIndex	clouddirectory:ListIndex	Read
ListManagedSchemaArns	clouddirectory:ListManagedSchemaArns	List
ListObjectAttributes	clouddirectory:ListObjectAttributes	Read
ListObjectChildren	clouddirectory:ListObjectChildren	Read
ListObjectParentPaths	clouddirectory:ListObjectParentPaths	Read
ListObjectParents	clouddirectory:ListObjectParents	Read
ListObjectPolicies	clouddirectory:ListObjectPolicies	Read
ListOutgoingTypedLinks	clouddirectory:ListOutgoingTypedLinks	Read
ListPolicyAttachments	clouddirectory:ListPolicyAttachments	Read
ListPublishedSchemaArns	clouddirectory:ListPublishedSchemaArns	List
ListTagsForResource	clouddirectory:ListTagsForResource	Read
ListTypedLinkFacetAttributes	clouddirectory:ListTypedLinkFacetAttributes	Read
ListTypedLinkFacetNames	clouddirectory:ListTypedLinkFacetNames	Read
LookupPolicy	clouddirectory:LookupPolicy	Read
PublishSchema	clouddirectory:PublishSchema	Write
PutSchemaFromJson	clouddirectory:PutSchemaFromJson	Write
RemoveFacetFromObject	clouddirectory:RemoveFacetFromObject	Write
TagResource	clouddirectory:TagResource	Tagging, Write
UntagResource	clouddirectory:UntagResource	Tagging, Write
UpdateFacet	clouddirectory:UpdateFacet	Write
UpdateLinkAttributes	clouddirectory:UpdateLinkAttributes	Write
UpdateObjectAttributes	clouddirectory:UpdateObjectAttributes	Write
UpdateSchema	clouddirectory:UpdateSchema	Write
UpdateTypedLinkFacet	clouddirectory:UpdateTypedLinkFacet	Write
UpgradeAppliedSchema	clouddirectory:UpgradeAppliedSchema	Write
UpgradePublishedSchema	clouddirectory:UpgradePublishedSchema	Write

Actions defined by Amazon Cloud Directory

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Access level
AddFacetToObject	Grants permission to add a new Facet to an object	directory*	Write
ApplySchema	Grants permission to copy input published schema into Directory with same name and version as that of published schema	directory*	Write
ApplySchema		publishedSchema*	Write
AttachObject	Grants permission to attach an existing object to another existing object	directory*	Write
AttachPolicy	Grants permission to attach a policy object to any other object	directory*	Write
AttachToIndex	Grants permission to attach the specified object to the specified index	directory*	Write
AttachTypedLink	Grants permission to attach a typed link b/w a source & target object reference	directory*	Write
BatchRead	Grants permission to perform all the read operations in a batch. Each individual operation inside BatchRead needs to be granted permissions explicitly	directory*	Read
BatchWrite	Grants permission to perform all the write operations in a batch. Each individual operation inside BatchWrite needs to be granted permissions explicitly	directory*	Write
CreateDirectory	Grants permission to create a Directory by copying the published schema into the directory	publishedSchema*	Write
CreateFacet	Grants permission to create a new Facet in a schema	appliedSchema*	Write
CreateFacet	Grants permission to create a new Facet in a schema	developmentSchema*	Write
CreateIndex	Grants permission to create an index object	directory*	Write
CreateObject	Grants permission to create an object in a Directory	directory*	Write
CreateSchema	Grants permission to create a new schema in a development state		Write
CreateTypedLinkFacet	Grants permission to create a new Typed Link facet in a schema	appliedSchema*	Write
CreateTypedLinkFacet		developmentSchema*	Write
DeleteDirectory	Grants permission to delete a directory. Only disabled directories can be deleted	directory*	Write
DeleteFacet	Grants permission to delete a given Facet. All attributes and Rules associated with the facet will be deleted	developmentSchema*	Write
DeleteObject	Grants permission to delete an object and its associated attributes	directory*	Write
DeleteSchema	Grants permission to delete a given schema	developmentSchema*	Write
DeleteSchema	Grants permission to delete a given schema	publishedSchema*	Write
DeleteTypedLinkFacet	Grants permission to delete a given TypedLink Facet. All attributes and Rules associated with the facet will be deleted	developmentSchema*	Write
DetachFromIndex	Grants permission to detach the specified object from the specified index	directory*	Write
DetachObject	Grants permission to detach a given object from the parent object	directory*	Write
DetachPolicy	Grants permission to detach a policy from an object	directory*	Write
DetachTypedLink	Grants permission to detach a given typed link b/w given source and target object reference	directory*	Write
DisableDirectory	Grants permission to disable the specified directory	directory*	Write
EnableDirectory	Grants permission to enable the specified directory	directory*	Write
GetAppliedSchemaVersion	Grants permission to return current applied schema version ARN, including the minor version in use	appliedSchema*	Read
GetDirectory	Grants permission to retrieve metadata about a directory	directory*	Read
GetFacet	Grants permission to get details of the Facet, such as Facet Name, Attributes, Rules, or ObjectType	appliedSchema*	Read
		developmentSchema*
		publishedSchema*
GetLinkAttributes	Grants permission to retrieve attributes that are associated with a typed link	directory*	Read
GetObjectAttributes	Grants permission to retrieve attributes within a facet that are associated with an object	directory*	Read
GetObjectInformation	Grants permission to retrieve metadata about an object	directory*	Read
GetSchemaAsJson	Grants permission to retrieve a JSON representation of the schema	appliedSchema*	Read
		developmentSchema*
		publishedSchema*
GetTypedLinkFacetInformation	Grants permission to return identity attributes order information associated with a given typed link facet	appliedSchema*	Read
		developmentSchema*
		publishedSchema*
ListAppliedSchemaArns	Grants permission to list schemas applied to a directory	directory*	List
ListAttachedIndices	Grants permission to list indices attached to an object	directory*	Read
ListDevelopmentSchemaArns	Grants permission to retrieve the ARNs of schemas in the development state		List
ListDirectories	Grants permission to list directories created within an account		List
ListFacetAttributes	Grants permission to retrieve attributes attached to the facet	appliedSchema*	Read
		developmentSchema*
		publishedSchema*
ListFacetNames	Grants permission to retrieve the names of facets that exist in a schema	appliedSchema*	Read
		developmentSchema*
		publishedSchema*
ListIncomingTypedLinks	Grants permission to return a paginated list of all incoming TypedLinks for a given object	directory*	Read
ListIndex	Grants permission to list objects attached to the specified index	directory*	Read
ListManagedSchemaArns	Grants permission to list the major version families of each managed schema. If a major version ARN is provided as SchemaArn, the minor version revisions in that family are listed instead		List
ListObjectAttributes	Grants permission to list all attributes associated with an object	directory*	Read
ListObjectChildren	Grants permission to return a paginated list of child objects associated with a given object	directory*	Read
ListObjectParentPaths	Grants permission to retrieve all available parent paths for any object type such as node, leaf node, policy node, and index node objects	directory*	Read
ListObjectParents	Grants permission to list parent objects associated with a given object in pagination fashion	directory*	Read
ListObjectPolicies	Grants permission to return policies attached to an object in pagination fashion	directory*	Read
ListOutgoingTypedLinks	Grants permission to return a paginated list of all outgoing TypedLinks for a given object	directory*	Read
ListPolicyAttachments	Grants permission to return all of the ObjectIdentifiers to which a given policy is attached	directory*	Read
ListPublishedSchemaArns	Grants permission to retrieve published schema ARNs		List
ListTagsForResource	Grants permission to return tags for a resource	directory*	Read
ListTypedLinkFacetAttributes	Grants permission to return a paginated list of attributes associated with typed link facet	appliedSchema*	Read
		developmentSchema*
		publishedSchema*
ListTypedLinkFacetNames	Grants permission to return a paginated list of typed link facet names that exist in a schema	appliedSchema*	Read
		developmentSchema*
		publishedSchema*
LookupPolicy	Grants permission to list all policies from the root of the Directory to the object specified	directory*	Read
PublishSchema	Grants permission to publish a development schema with a version	developmentSchema*	Write
PutSchemaFromJson	Grants permission to update a schema using JSON upload. Only available for development schemas		Write
RemoveFacetFromObject	Grants permission to remove the specified facet from the specified object	directory*	Write
TagResource	Grants permission to add tags to a resource	directory*	Tagging, Write
UntagResource	Grants permission to remove tags from a resource	directory*	Tagging, Write
UpdateFacet	Grants permission to add/update/delete existing Attributes, Rules, or ObjectType of a Facet	appliedSchema*	Write
UpdateFacet		developmentSchema*	Write
UpdateLinkAttributes	Grants permission to update a given typed link's attributes. Attributes to be updated must not contribute to the typed link's identity, as defined by its IdentityAttributeOrder	directory*	Write
UpdateObjectAttributes	Grants permission to update a given object's attributes	directory*	Write
UpdateSchema	Grants permission to update the schema name with a new name	developmentSchema*	Write
UpdateTypedLinkFacet	Grants permission to add/update/delete existing Attributes, Rules, identity attribute order of a TypedLink Facet	developmentSchema*	Write
UpgradeAppliedSchema	Grants permission to upgrade a single directory in-place using the PublishedSchemaArn with schema updates found in MinorVersion. Backwards-compatible minor version upgrades are instantaneously available for readers on all objects in the directory	directory*	Write
UpgradeAppliedSchema		publishedSchema*	Write
UpgradePublishedSchema	Grants permission to upgrade a published schema under a new minor version revision using the current contents of DevelopmentSchemaArn	developmentSchema*	Write
UpgradePublishedSchema		publishedSchema*	Write

Resource types defined by Amazon Cloud Directory

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
appliedSchema	arn:${Partition}:clouddirectory:${Region}:${Account}:directory/${DirectoryId}/schema/${SchemaName}/${Version}
developmentSchema	arn:${Partition}:clouddirectory:${Region}:${Account}:schema/development/${SchemaName}
directory	arn:${Partition}:clouddirectory:${Region}:${Account}:directory/${DirectoryId}
publishedSchema	arn:${Partition}:clouddirectory:${Region}:${Account}:schema/published/${SchemaName}/${Version}

Condition keys for Amazon Cloud Directory

Amazon Cloud Directory has no service-specific condition keys that can be used in the Condition element of policy statements.

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Chime (chime)

Amazon CloudFront (cloudfront)