Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Directory Service Data

AWS Directory Service Data (service prefix: ds-data) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Directory Service Data
Actions defined by AWS Directory Service Data
Resource types defined by AWS Directory Service Data
Condition keys for AWS Directory Service Data

API operations defined by AWS Directory Service Data

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AddGroupMember	ds-data:AddGroupMember	Write
AddGroupMember	ds:AccessDSData	Permissions management, Write
CreateGroup	ds-data:CreateGroup	Write
CreateGroup	ds:AccessDSData	Permissions management, Write
CreateUser	ds-data:CreateUser	Write
CreateUser	ds:AccessDSData	Permissions management, Write
DeleteGroup	ds-data:DeleteGroup	Write
DeleteGroup	ds:AccessDSData	Permissions management, Write
DeleteUser	ds-data:DeleteUser	Write
DeleteUser	ds:AccessDSData	Permissions management, Write
DescribeGroup	ds-data:DescribeGroup	Read
DescribeGroup	ds:AccessDSData	Permissions management, Write
DescribeUser	ds-data:DescribeUser	Read
DescribeUser	ds:AccessDSData	Permissions management, Write
DisableUser	ds-data:DisableUser	Write
DisableUser	ds:AccessDSData	Permissions management, Write
ListGroupMembers	ds-data:ListGroupMembers	List
ListGroupMembers	ds:AccessDSData	Permissions management, Write
ListGroups	ds-data:ListGroups	List
ListGroups	ds:AccessDSData	Permissions management, Write
ListGroupsForMember	ds-data:ListGroupsForMember	List
ListGroupsForMember	ds:AccessDSData	Permissions management, Write
ListUsers	ds-data:ListUsers	List
ListUsers	ds:AccessDSData	Permissions management, Write
RemoveGroupMember	ds-data:RemoveGroupMember	Write
RemoveGroupMember	ds:AccessDSData	Permissions management, Write
SearchGroups	ds-data:DescribeGroup	Read
	ds-data:SearchGroups	Read
	ds:AccessDSData	Permissions management, Write
SearchUsers	ds-data:DescribeUser	Read
	ds-data:SearchUsers	Read
	ds:AccessDSData	Permissions management, Write
UpdateGroup	ds-data:UpdateGroup	Write
UpdateGroup	ds:AccessDSData	Permissions management, Write
UpdateUser	ds-data:UpdateUser	Write
UpdateUser	ds:AccessDSData	Permissions management, Write

Actions defined by AWS Directory Service Data

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddGroupMember	Grants permission to add a member to a group on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Identifier ds-data:MemberName ds-data:MemberRealm ds-data:Realm ds-data:SAMAccountName	Write
CreateGroup	Grants permission to create a group on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Identifier ds-data:Realm ds-data:SAMAccountName	Write
CreateUser	Grants permission to create a user on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Identifier ds-data:Realm ds-data:SAMAccountName	Write
DeleteGroup	Grants permission to delete a group on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Identifier ds-data:Realm ds-data:SAMAccountName	Write
DeleteUser	Grants permission to delete a user on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Identifier ds-data:Realm ds-data:SAMAccountName	Write
DescribeGroup	Grants permission to describe a group on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Identifier ds-data:Realm ds-data:SAMAccountName	Read
DescribeUser	Grants permission to describe a user on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Identifier ds-data:Realm ds-data:SAMAccountName	Read
DisableUser	Grants permission to disable a user on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Identifier ds-data:Realm ds-data:SAMAccountName	Write
ListGroupMembers	Grants permission to list members in a group on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Identifier ds-data:MemberRealm ds-data:Realm ds-data:SAMAccountName	List
ListGroups	Grants permission to list groups on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Realm	List
ListGroupsForMember	Grants permission to list the groups that a member is in on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Identifier ds-data:MemberRealm ds-data:Realm ds-data:SAMAccountName	List
ListUsers	Grants permission to list users on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Realm	List
RemoveGroupMember	Grants permission to remove a member from a group on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Identifier ds-data:MemberName ds-data:MemberRealm ds-data:Realm ds-data:SAMAccountName	Write
SearchGroups	Grants permission to search for groups on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Realm	Read
SearchUsers	Grants permission to search for users on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Realm	Read
UpdateGroup	Grants permission to update a group on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Identifier ds-data:Realm ds-data:SAMAccountName	Write
UpdateUser	Grants permission to update a user on a directory	directory*	aws:ResourceTag/${TagKey} ds-data:Identifier ds-data:Realm ds-data:SAMAccountName	Write

Resource types defined by AWS Directory Service Data

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
directory	arn:${Partition}:ds:${Region}:${Account}:directory/${DirectoryId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Directory Service Data

AWS Directory Service Data defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:ResourceTag/${TagKey}	Filters access by the AWS DS Resource being acted upon	String
ds-data:Identifier	Filters access by the type of identifier provided in the request (i.e. SAM Account Name)	String
ds-data:MemberName	Filters access by the directory SAM Account Name included in the MemberName input of the request	String
ds-data:MemberRealm	Filters access by the directory realm name included in the MemberRealm input of the request	String
ds-data:Realm	Filters access by the directory realm name for the request	String
ds-data:SAMAccountName	Filters access by the directory SAM Account Name included in the SAMAccountName input of the request	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Directory Service (ds)

AWS Elastic Beanstalk (elasticbeanstalk)