Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Connect Cases

Amazon Connect Cases (service prefix: cases) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Connect Cases
Actions defined by Amazon Connect Cases
Resource types defined by Amazon Connect Cases
Condition keys for Amazon Connect Cases

API operations defined by Amazon Connect Cases

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
BatchGetCaseRule	cases:BatchGetCaseRule	Read
BatchGetField	cases:BatchGetField	Read
BatchPutFieldOptions	cases:BatchPutFieldOptions	Write
CreateCase	cases:CreateCase	Write
CreateCase	cases:TagResource	Tagging, Write
CreateCaseRule	cases:CreateCaseRule	Write
CreateDomain	cases:CreateDomain	Write
CreateField	cases:CreateField	Write
CreateLayout	cases:CreateLayout	Write
CreateRelatedItem	cases:CreateRelatedItem	Write
CreateTemplate	cases:CreateTemplate	Write
DeleteCase	cases:DeleteCase	Write
DeleteCaseRule	cases:DeleteCaseRule	Write
DeleteDomain	cases:DeleteDomain	Write
DeleteField	cases:DeleteField	Write
DeleteLayout	cases:DeleteLayout	Write
DeleteRelatedItem	cases:DeleteRelatedItem	Write
DeleteTemplate	cases:DeleteTemplate	Write
GetCase	cases:GetCase	Read
GetCaseAuditEvents	cases:GetCaseAuditEvents	Read
GetCaseEventConfiguration	cases:GetCaseEventConfiguration	Read
GetDomain	cases:GetDomain	Read
GetLayout	cases:GetLayout	Read
GetTemplate	cases:GetTemplate	Read
ListCaseRules	cases:ListCaseRules	List
ListCasesForContact	cases:ListCasesForContact	List
ListDomains	cases:ListDomains	List
ListFieldOptions	cases:ListFieldOptions	List
ListFields	cases:ListFields	List
ListLayouts	cases:ListLayouts	List
ListTagsForResource	cases:ListTagsForResource	Read
ListTemplates	cases:ListTemplates	List
PutCaseEventConfiguration	cases:PutCaseEventConfiguration	Write
SearchAllRelatedItems	cases:SearchAllRelatedItems	Read
SearchCases	cases:SearchCases	Read
SearchRelatedItems	cases:SearchRelatedItems	Read
TagResource	cases:TagResource	Tagging, Write
UntagResource	cases:UntagResource	Tagging, Write
UpdateCase	cases:UpdateCase	Write
UpdateCaseRule	cases:UpdateCaseRule	Write
UpdateField	cases:UpdateField	Write
UpdateLayout	cases:UpdateLayout	Write
UpdateRelatedItem	cases:UpdateRelatedItem	Write
UpdateTemplate	cases:UpdateTemplate	Write

Actions defined by Amazon Connect Cases

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchGetCaseRule	Grants permission to retrieve information about the case rules in the case domain	CaseRule*	aws:ResourceTag/${TagKey}	Read
BatchGetCaseRule		Domain*	aws:ResourceTag/${TagKey}	Read
BatchGetField	Grants permission to retrieve information about the fields in the case domain	Domain*	aws:ResourceTag/${TagKey}	Read
BatchGetField		Field*	aws:ResourceTag/${TagKey}	Read
BatchPutFieldOptions	Grants permission to update the field options in the case domain	Domain*	aws:ResourceTag/${TagKey}	Write
BatchPutFieldOptions		Field*	aws:ResourceTag/${TagKey}	Write
CreateCase	Grants permission to create a case in the case domain	Case*	aws:ResourceTag/${TagKey} connect:UserArn	Write
		Domain*	aws:ResourceTag/${TagKey} connect:UserArn
		Field*	aws:ResourceTag/${TagKey} connect:UserArn
		Template*	aws:ResourceTag/${TagKey} connect:UserArn
CreateCaseRule	Grants permission to create a case rule in the case domain	CaseRule*	aws:ResourceTag/${TagKey}	Write
CreateCaseRule	Grants permission to create a case rule in the case domain	Domain*	aws:ResourceTag/${TagKey}	Write
CreateDomain	Grants permission to create a new case domain			Write
CreateField	Grants permission to create a field in the case domain	Domain*	aws:ResourceTag/${TagKey}	Write
CreateField	Grants permission to create a field in the case domain	Field*	aws:ResourceTag/${TagKey}	Write
CreateLayout	Grants permission to create a layout in the case domain	Domain*	aws:ResourceTag/${TagKey}	Write
CreateLayout	Grants permission to create a layout in the case domain	Layout*	aws:ResourceTag/${TagKey}	Write
CreateRelatedItem	Grants permission to create a related item associated to a case in the case domain	Case*	aws:ResourceTag/${TagKey} connect:UserArn	Write
		Domain*	aws:ResourceTag/${TagKey} connect:UserArn
		RelatedItem*	aws:ResourceTag/${TagKey} cases:CreatedBy cases:RelatedItemType connect:UserArn
CreateTemplate	Grants permission to create a template in the case domain	Domain*	aws:ResourceTag/${TagKey}	Write
		Layout*	aws:ResourceTag/${TagKey}
		Template*	aws:ResourceTag/${TagKey}
DeleteCase	Grants permission to delete the case in the case domain	Case*	aws:ResourceTag/${TagKey}	Write
DeleteCase	Grants permission to delete the case in the case domain	Domain*	aws:ResourceTag/${TagKey}	Write
DeleteCaseRule	Grants permission to delete the case rule in the case domain	CaseRule*	aws:ResourceTag/${TagKey}	Write
DeleteCaseRule		Domain*	aws:ResourceTag/${TagKey}	Write
DeleteDomain	Grants permission to delete the domain	Domain*	aws:ResourceTag/${TagKey}	Write
DeleteField	Grants permission to delete the field in the case domain	Domain*	aws:ResourceTag/${TagKey}	Write
DeleteField	Grants permission to delete the field in the case domain	Field*	aws:ResourceTag/${TagKey}	Write
DeleteLayout	Grants permission to delete the layout in the case domain	Domain*	aws:ResourceTag/${TagKey}	Write
DeleteLayout	Grants permission to delete the layout in the case domain	Layout*	aws:ResourceTag/${TagKey}	Write
DeleteRelatedItem	Grants permission to delete the related item associated to the case in the case domain	Case*	aws:ResourceTag/${TagKey}	Write
		Domain*	aws:ResourceTag/${TagKey}
		RelatedItem*	aws:ResourceTag/${TagKey} cases:CreatedBy cases:RelatedItemType
DeleteTemplate	Grants permission to delete the template in the case domain	Domain*	aws:ResourceTag/${TagKey}	Write
DeleteTemplate	Grants permission to delete the template in the case domain	Template*	aws:ResourceTag/${TagKey}	Write
GetCase	Grants permission to retrieve information about a case in the case domain	Case*	aws:ResourceTag/${TagKey}	Read
		Domain*	aws:ResourceTag/${TagKey}
		Field*	aws:ResourceTag/${TagKey}
GetCaseAuditEvents	Grants permission to view audit history of a case	Case*	aws:ResourceTag/${TagKey}	Read
GetCaseAuditEvents	Grants permission to view audit history of a case	Domain*	aws:ResourceTag/${TagKey}	Read
GetCaseEventConfiguration	Grants permission to retrieve information about the case event configuraton in the case domain	Domain*	aws:ResourceTag/${TagKey}	Read
GetDomain	Grants permission to retrieve information about the case domain	Domain*	aws:ResourceTag/${TagKey}	Read
GetLayout	Grants permission to retrieve information about the layout in the case domain	Domain*	aws:ResourceTag/${TagKey}	Read
GetLayout		Layout*	aws:ResourceTag/${TagKey}	Read
GetTemplate	Grants permission to retrieve information about the template in the case domain	Domain*	aws:ResourceTag/${TagKey}	Read
GetTemplate		Template*	aws:ResourceTag/${TagKey}	Read
ListCaseRules	Grants permission to list case rules in the case domain	Domain*	aws:ResourceTag/${TagKey}	List
ListCasesForContact	Grants permission to list cases for a specific contact in the case domain	Domain*	aws:ResourceTag/${TagKey}	List
ListDomains	Grants permission to list all domains in the aws account			List
ListFieldOptions	Grants permission to list field options for a single select field in the case domain	Domain*	aws:ResourceTag/${TagKey}	List
ListFieldOptions		Field*	aws:ResourceTag/${TagKey}	List
ListFields	Grants permission to list fields in the case domain	Domain*	aws:ResourceTag/${TagKey}	List
ListLayouts	Grants permission to list layouts in the case domain	Domain*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list the tags for the specified resource			Read
ListTemplates	Grants permission to list templates in the case domain	Domain*	aws:ResourceTag/${TagKey}	List
PutCaseEventConfiguration	Grants permission to insert or update the case event configuration in the case domain	Domain*	aws:ResourceTag/${TagKey}	Write
SearchAllRelatedItems	Grants permission to search for related items in the case domain	Domain*	aws:ResourceTag/${TagKey}	Read
SearchCases	Grants permission to search for cases in the case domain	Domain*	aws:ResourceTag/${TagKey}	Read
SearchRelatedItems	Grants permission to search for related items associated to the case in the case domain	Case*	aws:ResourceTag/${TagKey}	Read
SearchRelatedItems		Domain*	aws:ResourceTag/${TagKey}	Read
TagResource	Grants permission to add the specified tags to the specified resource	Case	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		CaseRule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Domain	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Field	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Layout	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		RelatedItem	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys cases:CreatedBy cases:RelatedItemType
		Template	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove the specified tags from the specified resource	Case	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		CaseRule	aws:ResourceTag/${TagKey} aws:TagKeys
		Domain	aws:ResourceTag/${TagKey} aws:TagKeys
		Field	aws:ResourceTag/${TagKey} aws:TagKeys
		Layout	aws:ResourceTag/${TagKey} aws:TagKeys
		RelatedItem	aws:ResourceTag/${TagKey} aws:TagKeys cases:CreatedBy cases:RelatedItemType
		Template	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateCase	Grants permission to update the field values on the case in the case domain	Case*	aws:ResourceTag/${TagKey} connect:UserArn	Write
		Domain*	aws:ResourceTag/${TagKey} connect:UserArn
		Field*	aws:ResourceTag/${TagKey} connect:UserArn
UpdateCaseRule	Grants permission to update the case rule in the case domain	CaseRule*	aws:ResourceTag/${TagKey}	Write
UpdateCaseRule		Domain*	aws:ResourceTag/${TagKey}	Write
UpdateField	Grants permission to update the field in the case domain	Domain*	aws:ResourceTag/${TagKey}	Write
UpdateField	Grants permission to update the field in the case domain	Field*	aws:ResourceTag/${TagKey}	Write
UpdateLayout	Grants permission to update the layout in the case domain	Domain*	aws:ResourceTag/${TagKey}	Write
UpdateLayout	Grants permission to update the layout in the case domain	Layout*	aws:ResourceTag/${TagKey}	Write
UpdateRelatedItem	Grants permission to update a related item associated to a case in the case domain	Case*	aws:ResourceTag/${TagKey}	Write
		Domain*	aws:ResourceTag/${TagKey}
		RelatedItem*	aws:ResourceTag/${TagKey} cases:CreatedBy cases:RelatedItemType
UpdateTemplate	Grants permission to update the template in the case domain	Domain*	aws:ResourceTag/${TagKey}	Write
UpdateTemplate	Grants permission to update the template in the case domain	Template*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Connect Cases

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
Case	arn:${Partition}:cases:${Region}:${Account}:domain/${DomainId}/case/${CaseId}	aws:ResourceTag/${TagKey}
CaseRule	arn:${Partition}:cases:${Region}:${Account}:domain/${DomainId}/case-rule/${CaseRuleId}	aws:ResourceTag/${TagKey}
Domain	arn:${Partition}:cases:${Region}:${Account}:domain/${DomainId}	aws:ResourceTag/${TagKey}
Field	arn:${Partition}:cases:${Region}:${Account}:domain/${DomainId}/field/${FieldId}	aws:ResourceTag/${TagKey}
Layout	arn:${Partition}:cases:${Region}:${Account}:domain/${DomainId}/layout/${LayoutId}	aws:ResourceTag/${TagKey}
RelatedItem	arn:${Partition}:cases:${Region}:${Account}:domain/${DomainId}/case/${CaseId}/related-item/${RelatedItemId}	aws:ResourceTag/${TagKey} cases:CreatedBy cases:RelatedItemType
Template	arn:${Partition}:cases:${Region}:${Account}:domain/${DomainId}/template/${TemplateId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Connect Cases

Amazon Connect Cases defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by tags associated with the resource	String
aws:TagKeys	Filters access by tag keys that are passed in the request	ArrayOfString
cases:CreatedBy	Filters access by who created the the resource (user ARN or custom entity)	String
cases:RelatedItemType	Filters access by the type of related item. Possible values: Contact, Comment, File, Sla, ConnectCase, Custom	String
connect:UserArn	Filters access by connect's UserArn	ARN

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Connect (connect)

Amazon Connect Customer Profiles (profile)