Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Inspector

Amazon Inspector (service prefix: inspector) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Inspector
Actions defined by Amazon Inspector
Resource types defined by Amazon Inspector
Condition keys for Amazon Inspector

API operations defined by Amazon Inspector

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AddAttributesToFindings	inspector:AddAttributesToFindings			Write
CreateAssessmentTarget	inspector:CreateAssessmentTarget			Write
CreateAssessmentTemplate	inspector:CreateAssessmentTemplate			Write
CreateExclusionsPreview	inspector:CreateExclusionsPreview			Write
CreateResourceGroup	inspector:CreateResourceGroup			Write
DeleteAssessmentRun	inspector:DeleteAssessmentRun			Write
DeleteAssessmentTarget	inspector:DeleteAssessmentTarget			Write
DeleteAssessmentTemplate	inspector:DeleteAssessmentTemplate			Write
DescribeAssessmentRuns	inspector:DescribeAssessmentRuns			Read
DescribeAssessmentTargets	inspector:DescribeAssessmentTargets			Read
DescribeAssessmentTemplates	inspector:DescribeAssessmentTemplates			Read
DescribeCrossAccountAccessRole	inspector:DescribeCrossAccountAccessRole			Read
DescribeExclusions	inspector:DescribeExclusions			Read
DescribeFindings	inspector:DescribeFindings			Read
DescribeResourceGroups	inspector:DescribeResourceGroups			Read
DescribeRulesPackages	inspector:DescribeRulesPackages			Read
GetAssessmentReport	inspector:GetAssessmentReport			Read
GetExclusionsPreview	inspector:GetExclusionsPreview			Read
GetTelemetryMetadata	inspector:GetTelemetryMetadata			Read
ListAssessmentRunAgents	inspector:ListAssessmentRunAgents			List
ListAssessmentRuns	inspector:ListAssessmentRuns			List
ListAssessmentTargets	inspector:ListAssessmentTargets			List
ListAssessmentTemplates	inspector:ListAssessmentTemplates			List
ListEventSubscriptions	inspector:ListEventSubscriptions			List
ListExclusions	inspector:ListExclusions			List
ListFindings	inspector:ListFindings			List
ListRulesPackages	inspector:ListRulesPackages			List
ListTagsForResource	inspector:ListTagsForResource			Read
PreviewAgents	inspector:PreviewAgents			Read
RegisterCrossAccountAccessRole	inspector:RegisterCrossAccountAccessRole			Write
RegisterCrossAccountAccessRole	iam:PassRole	iam:PassedToService	inspector.amazonaws.com	Write
RemoveAttributesFromFindings	inspector:RemoveAttributesFromFindings			Write
SetTagsForResource	inspector:SetTagsForResource			Tagging, Write
StartAssessmentRun	inspector:StartAssessmentRun			Write
StopAssessmentRun	inspector:StopAssessmentRun			Write
SubscribeToEvent	inspector:SubscribeToEvent			Write
UnsubscribeFromEvent	inspector:UnsubscribeFromEvent			Write
UpdateAssessmentTarget	inspector:UpdateAssessmentTarget			Write

Actions defined by Amazon Inspector

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Access level
AddAttributesToFindings	Grants permission to assign attributes (key and value pairs) to the findings that are specified by the ARNs of the findings	Write
CreateAssessmentTarget	Grants permission to create a new assessment target using the ARN of the resource group that is generated by CreateResourceGroup	Write
CreateAssessmentTemplate	Grants permission to create an assessment template for the assessment target that is specified by the ARN of the assessment target	Write
CreateExclusionsPreview	Grants permission to start the generation of an exclusions preview for the specified assessment template	Write
CreateResourceGroup	Grants permission to create a resource group using the specified set of tags (key and value pairs) that are used to select the EC2 instances to be included in an Amazon Inspector assessment target	Write
DeleteAssessmentRun	Grants permission to delete the assessment run that is specified by the ARN of the assessment run	Write
DeleteAssessmentTarget	Grants permission to delete the assessment target that is specified by the ARN of the assessment target	Write
DeleteAssessmentTemplate	Grants permission to delete the assessment template that is specified by the ARN of the assessment template	Write
DescribeAssessmentRuns	Grants permission to describe the assessment runs that are specified by the ARNs of the assessment runs	Read
DescribeAssessmentTargets	Grants permission to describe the assessment targets that are specified by the ARNs of the assessment targets	Read
DescribeAssessmentTemplates	Grants permission to describe the assessment templates that are specified by the ARNs of the assessment templates	Read
DescribeCrossAccountAccessRole	Grants permission to describe the IAM role that enables Amazon Inspector to access your AWS account	Read
DescribeExclusions	Grants permission to describe the exclusions that are specified by the exclusions' ARNs	Read
DescribeFindings	Grants permission to describe the findings that are specified by the ARNs of the findings	Read
DescribeResourceGroups	Grants permission to describe the resource groups that are specified by the ARNs of the resource groups	Read
DescribeRulesPackages	Grants permission to describe the rules packages that are specified by the ARNs of the rules packages	Read
GetAssessmentReport	Grants permission to produce an assessment report that includes detailed and comprehensive results of a specified assessment run	Read
GetExclusionsPreview	Grants permission to retrieve the exclusions preview (a list of ExclusionPreview objects) specified by the preview token	Read
GetTelemetryMetadata	Grants permission to get information about the data that is collected for the specified assessment run	Read
ListAssessmentRunAgents	Grants permission to list the agents of the assessment runs that are specified by the ARNs of the assessment runs	List
ListAssessmentRuns	Grants permission to list the assessment runs that correspond to the assessment templates that are specified by the ARNs of the assessment templates	List
ListAssessmentTargets	Grants permission to list the ARNs of the assessment targets within this AWS account	List
ListAssessmentTemplates	Grants permission to list the assessment templates that correspond to the assessment targets that are specified by the ARNs of the assessment targets	List
ListEventSubscriptions	Grants permission to list all the event subscriptions for the assessment template that is specified by the ARN of the assessment template	List
ListExclusions	Grants permission to list exclusions that are generated by the assessment run	List
ListFindings	Grants permission to list findings that are generated by the assessment runs that are specified by the ARNs of the assessment runs	List
ListRulesPackages	Grants permission to list all available Amazon Inspector rules packages	List
ListTagsForResource	Grants permission to list all tags associated with an assessment template	Read
PreviewAgents	Grants permission to preview the agents installed on the EC2 instances that are part of the specified assessment target	Read
RegisterCrossAccountAccessRole	Grants permission to register the IAM role that Amazon Inspector uses to list your EC2 instances at the start of the assessment run or when you call the PreviewAgents action	Write
RemoveAttributesFromFindings	Grants permission to remove entire attributes (key and value pairs) from the findings that are specified by the ARNs of the findings where an attribute with the specified key exists	Write
SetTagsForResource	Grants permission to set tags (key and value pairs) to the assessment template that is specified by the ARN of the assessment template	Tagging, Write
StartAssessmentRun	Grants permission to start the assessment run specified by the ARN of the assessment template	Write
StopAssessmentRun	Grants permission to stop the assessment run that is specified by the ARN of the assessment run	Write
SubscribeToEvent	Grants permission to enable the process of sending Amazon Simple Notification Service (SNS) notifications about a specified event to a specified SNS topic	Write
UnsubscribeFromEvent	Grants permission to disable the process of sending Amazon Simple Notification Service (SNS) notifications about a specified event to a specified SNS topic	Write
UpdateAssessmentTarget	Grants permission to update the assessment target that is specified by the ARN of the assessment target	Write

Resource types defined by Amazon Inspector

Amazon Inspector does not support specifying a resource ARN in the Resource element of an IAM policy statement.

Condition keys for Amazon Inspector

Amazon Inspector has no service-specific condition keys that can be used in the Condition element of policy statements.

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Honeycode (honeycode)

Amazon Inspector2 (inspector2)