Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Application Discovery Service

AWS Application Discovery Service (service prefix: discovery) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Application Discovery Service
Actions defined by AWS Application Discovery Service
Resource types defined by AWS Application Discovery Service
Condition keys for AWS Application Discovery Service

API operations defined by AWS Application Discovery Service

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AssociateConfigurationItemsToApplication	discovery:AssociateConfigurationItemsToApplication	Write
BatchDeleteAgents	discovery:BatchDeleteAgents	Write
BatchDeleteImportData	discovery:BatchDeleteImportData	Write
CreateApplication	discovery:CreateApplication	Write
CreateTags	discovery:CreateTags	Tagging, Write
DeleteApplications	discovery:DeleteApplications	Write
DeleteTags	discovery:DeleteTags	Tagging, Write
DescribeAgents	discovery:DescribeAgents	Read
DescribeBatchDeleteConfigurationTask	discovery:DescribeBatchDeleteConfigurationTask	Read
DescribeConfigurations	discovery:DescribeConfigurations	Read
DescribeContinuousExports	discovery:DescribeContinuousExports	Read
DescribeExportConfigurations	discovery:DescribeExportConfigurations	Read
DescribeExportTasks	discovery:DescribeExportTasks	Read
DescribeImportTasks	discovery:DescribeImportTasks	List
DescribeTags	discovery:DescribeTags	Read
DisassociateConfigurationItemsFromApplication	discovery:DisassociateConfigurationItemsFromApplication	Write
ExportConfigurations	discovery:ExportConfigurations	Write
GetDiscoverySummary	discovery:GetDiscoverySummary	Read
ListConfigurations	discovery:ListConfigurations	List
ListServerNeighbors	discovery:ListServerNeighbors	List
StartBatchDeleteConfigurationTask	discovery:StartBatchDeleteConfigurationTask	Write
StartContinuousExport	discovery:StartContinuousExport	Write
StartDataCollectionByAgentIds	discovery:StartDataCollectionByAgentIds	Write
StartExportTask	discovery:StartExportTask	Write
StartImportTask	discovery:StartImportTask	Write
StopContinuousExport	discovery:StopContinuousExport	Write
StopDataCollectionByAgentIds	discovery:StopDataCollectionByAgentIds	Write
UpdateApplication	discovery:UpdateApplication	Write

Actions defined by AWS Application Discovery Service

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Condition keys	Access level
AssociateConfigurationItemsToApplication	Grants permission to AssociateConfigurationItemsToApplication API. AssociateConfigurationItemsToApplication associates one or more configuration items with an application		Write
BatchDeleteAgents	Grants permission to BatchDeleteAgents API. BatchDeleteAgents deletes one or more agents/data collectors associated with your account, each identified by its agent ID. Deleting a data collector does not delete the previous data collected		Write
BatchDeleteImportData	Grants permission to BatchDeleteImportData API. BatchDeleteImportData deletes one or more Migration Hub import tasks, each identified by their import ID. Each import task has a number of records, which can identify servers or applications		Write
CreateApplication	Grants permission to CreateApplication API. CreateApplication creates an application with the given name and description		Write
CreateTags	Grants permission to CreateTags API. CreateTags creates one or more tags for configuration items. Tags are metadata that help you categorize IT assets. This API accepts a list of multiple configuration items		Tagging, Write
DeleteApplications	Grants permission to DeleteApplications API. DeleteApplications deletes a list of applications and their associations with configuration items		Write
DeleteTags	Grants permission to DeleteTags API. DeleteTags deletes the association between configuration items and one or more tags. This API accepts a list of multiple configuration items	aws:TagKeys	Tagging, Write
DescribeAgents	Grants permission to DescribeAgents API. DescribeAgents lists agents or the Connector by ID or lists all agents/Connectors associated with your user if you did not specify an ID		Read
DescribeBatchDeleteConfigurationTask	Grants permission to DescribeBatchDeleteConfigurationTask API. DescribeBatchDeleteConfigurationTask returns attributes about a batched deletion task to delete a set of configuration items. The supplied task ID should be the task ID receieved from the output of StartBatchDeleteConfigurationTask		Read
DescribeConfigurations	Grants permission to DescribeConfigurations API. DescribeConfigurations retrieves attributes for a list of configuration item IDs. All of the supplied IDs must be for the same asset type (server, application, process, or connection). Output fields are specific to the asset type selected. For example, the output for a server configuration item includes a list of attributes about the server, such as host name, operating system, and number of network cards		Read
DescribeContinuousExports	Grants permission to DescribeContinuousExports API. DescribeContinuousExports lists exports as specified by ID. All continuous exports associated with your user can be listed if you call DescribeContinuousExports as is without passing any parameters		Read
DescribeExportConfigurations	Grants permission to DescribeExportConfigurations API. DescribeExportConfigurations retrieves the status of a given export process. You can retrieve status from a maximum of 100 processes		Read
DescribeExportTasks	Grants permission to DescribeExportTasks API. DescribeExportTasks retrieve status of one or more export tasks. You can retrieve the status of up to 100 export tasks		Read
DescribeImportTasks	Grants permission to DescribeImportTasks API. DescribeImportTasks returns an array of import tasks for your user, including status information, times, IDs, the Amazon S3 Object URL for the import file, and more		List
DescribeTags	Grants permission to DescribeTags API. DescribeTags retrieves a list of configuration items that are tagged with a specific tag. Or retrieves a list of all tags assigned to a specific configuration item		Read
DisassociateConfigurationItemsFromApplication	Grants permission to DisassociateConfigurationItemsFromApplication API. DisassociateConfigurationItemsFromApplication disassociates one or more configuration items from an application		Write
ExportConfigurations	Grants permission to ExportConfigurations API. ExportConfigurations exports all discovered configuration data to an Amazon S3 bucket or an application that enables you to view and evaluate the data. Data includes tags and tag associations, processes, connections, servers, and system performance		Write
GetDiscoverySummary	Grants permission to GetDiscoverySummary API. GetDiscoverySummary retrieves a short summary of discovered assets		Read
GetNetworkConnectionGraph	Grants permission to GetNetworkConnectionGraph API. GetNetworkConnectionGraph accepts input list of one of - Ip Addresses, server ids or node ids. Returns a list of nodes and edges which help customer visualize network connection graph. This API is used for visualize network graph functionality in MigrationHub console		Read
ListConfigurations	Grants permission to ListConfigurations API. ListConfigurations retrieves a list of configuration items according to criteria you specify in a filter. The filter criteria identify relationship requirements		List
ListServerNeighbors	Grants permission to ListServerNeighbors API. ListServerNeighbors retrieves a list of servers which are one network hop away from a specified server		List
StartBatchDeleteConfigurationTask	Grants permission to StartBatchDeleteConfigurationTask API. StartBatchDeleteConfigurationTask starts an asynchronous batch deletion of your configuration items. All of the supplied IDs must be for the same asset type (server, application, process, or connection). Output is a unique task ID you can use to check back on the deletions progress		Write
StartContinuousExport	Grants permission to StartContinuousExport API. StartContinuousExport start the continuous flow of agent's discovered data into Amazon Athena		Write
StartDataCollectionByAgentIds	Grants permission to StartDataCollectionByAgentIds API. StartDataCollectionByAgentIds instructs the specified agents or Connectors to start collecting data		Write
StartExportTask	Grants permission to StartExportTask API. StartExportTask export the configuration data about discovered configuration items and relationships to an S3 bucket in a specified format		Write
StartImportTask	Grants permission to StartImportTask API. StartImportTask starts an import task. The Migration Hub import feature allows you to import details of your on-premises environment directly into AWS without having to use the Application Discovery Service (ADS) tools such as the Discovery Connector or Discovery Agent. This gives you the option to perform migration assessment and planning directly from your imported data including the ability to group your devices as applications and track their migration status		Write
StopContinuousExport	Grants permission to StopContinuousExport API. StopContinuousExport stops the continuous flow of agent's discovered data into Amazon Athena		Write
StopDataCollectionByAgentIds	Grants permission to StopDataCollectionByAgentIds API. StopDataCollectionByAgentIds instructs the specified agents or Connectors to stop collecting data		Write
UpdateApplication	Grants permission to UpdateApplication API. UpdateApplication updates metadata about an application		Write

Resource types defined by AWS Application Discovery Service

AWS Application Discovery Service does not support specifying a resource ARN in the Resource element of an IAM policy statement.

Condition keys for AWS Application Discovery Service

AWS Application Discovery Service defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Application Auto Scaling (application-autoscaling)

AWS Application Migration Service (mgn)