Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS IoT FleetWise

AWS IoT FleetWise (service prefix: iotfleetwise) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS IoT FleetWise
Actions defined by AWS IoT FleetWise
Permission-only actions for AWS IoT FleetWise
Resource types defined by AWS IoT FleetWise
Condition keys for AWS IoT FleetWise

API operations defined by AWS IoT FleetWise

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateVehicleFleet	iotfleetwise:AssociateVehicleFleet			Write
BatchCreateVehicle	iotfleetwise:CreateVehicle			Write
BatchCreateVehicle	iotfleetwise:TagResource			Tagging, Write
CreateCampaign	iotfleetwise:CreateCampaign			Write
	iotfleetwise:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	iotfleetwise.amazonaws.com	Write
CreateDecoderManifest	iotfleetwise:CreateDecoderManifest			Write
CreateDecoderManifest	iotfleetwise:TagResource			Tagging, Write
CreateFleet	iotfleetwise:CreateFleet			Write
CreateFleet	iotfleetwise:TagResource			Tagging, Write
CreateModelManifest	iotfleetwise:CreateModelManifest			Write
CreateModelManifest	iotfleetwise:TagResource			Tagging, Write
CreateSignalCatalog	iotfleetwise:CreateSignalCatalog			Write
CreateSignalCatalog	iotfleetwise:TagResource			Tagging, Write
CreateStateTemplate	iotfleetwise:CreateStateTemplate			Write
CreateStateTemplate	iotfleetwise:TagResource			Tagging, Write
CreateVehicle	iotfleetwise:CreateVehicle			Write
CreateVehicle	iotfleetwise:TagResource			Tagging, Write
DeleteCampaign	iotfleetwise:DeleteCampaign			Write
DeleteDecoderManifest	iotfleetwise:DeleteDecoderManifest			Write
DeleteFleet	iotfleetwise:DeleteFleet			Write
DeleteModelManifest	iotfleetwise:DeleteModelManifest			Write
DeleteSignalCatalog	iotfleetwise:DeleteSignalCatalog			Write
DeleteStateTemplate	iotfleetwise:DeleteStateTemplate			Write
DeleteVehicle	iotfleetwise:DeleteVehicle			Write
DisassociateVehicleFleet	iotfleetwise:DisassociateVehicleFleet			Write
GetCampaign	iotfleetwise:GetCampaign			Read
GetDecoderManifest	iotfleetwise:GetDecoderManifest			Read
GetEncryptionConfiguration	iotfleetwise:GetEncryptionConfiguration			Read
GetFleet	iotfleetwise:GetFleet			Read
GetLoggingOptions	iotfleetwise:GetLoggingOptions			Read
GetModelManifest	iotfleetwise:GetModelManifest			Read
GetRegisterAccountStatus	iotfleetwise:GetRegisterAccountStatus			Read
GetSignalCatalog	iotfleetwise:GetSignalCatalog			Read
GetStateTemplate	iotfleetwise:GetStateTemplate			Read
GetVehicle	iotfleetwise:GetVehicle			Read
GetVehicleStatus	iotfleetwise:GetVehicleStatus			Read
ImportDecoderManifest	iotfleetwise:ImportDecoderManifest			Write
ImportSignalCatalog	iotfleetwise:ImportSignalCatalog			Write
ImportSignalCatalog	iotfleetwise:TagResource			Tagging, Write
ListCampaigns	iotfleetwise:ListCampaigns			Read
ListDecoderManifestNetworkInterfaces	iotfleetwise:ListDecoderManifestNetworkInterfaces			List
ListDecoderManifestSignals	iotfleetwise:ListDecoderManifestSignals			List
ListDecoderManifests	iotfleetwise:ListDecoderManifests			Read
ListFleets	iotfleetwise:ListFleets			Read
ListFleetsForVehicle	iotfleetwise:ListFleetsForVehicle			Read
ListModelManifestNodes	iotfleetwise:ListModelManifestNodes			List
ListModelManifests	iotfleetwise:ListModelManifests			Read
ListSignalCatalogNodes	iotfleetwise:ListSignalCatalogNodes			Read
ListSignalCatalogs	iotfleetwise:ListSignalCatalogs			Read
ListStateTemplates	iotfleetwise:ListStateTemplates			Read
ListTagsForResource	iotfleetwise:ListTagsForResource			Read
ListVehicles	iotfleetwise:ListVehicles			Read
ListVehiclesInFleet	iotfleetwise:ListVehiclesInFleet			Read
PutEncryptionConfiguration	iotfleetwise:PutEncryptionConfiguration			Write
PutLoggingOptions	iotfleetwise:PutLoggingOptions			Write
RegisterAccount	iotfleetwise:RegisterAccount			Write
TagResource	iotfleetwise:TagResource			Tagging, Write
UntagResource	iotfleetwise:UntagResource			Tagging, Write
UpdateCampaign	iotfleetwise:UpdateCampaign			Write
UpdateDecoderManifest	iotfleetwise:UpdateDecoderManifest			Write
UpdateFleet	iotfleetwise:UpdateFleet			Write
UpdateModelManifest	iotfleetwise:UpdateModelManifest			Write
UpdateSignalCatalog	iotfleetwise:UpdateSignalCatalog			Write
UpdateStateTemplate	iotfleetwise:UpdateStateTemplate			Write
UpdateVehicle	iotfleetwise:UpdateVehicle			Write

Actions defined by AWS IoT FleetWise

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateVehicleFleet	Grants permission to associate the given vehicle to a fleet	fleet*	aws:ResourceTag/${TagKey}	Write
AssociateVehicleFleet	Grants permission to associate the given vehicle to a fleet	vehicle*	aws:ResourceTag/${TagKey}	Write
CreateCampaign	Grants permission to create a campaign	campaign*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys iotfleetwise:DestinationArn	Write
		fleet*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys iotfleetwise:DestinationArn
		signalcatalog*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys iotfleetwise:DestinationArn
		vehicle*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys iotfleetwise:DestinationArn
CreateDecoderManifest	Grants permission to create a decoder manifest for an existing model	decodermanifest*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDecoderManifest		modelmanifest*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFleet	Grants permission to create a fleet	fleet*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFleet	Grants permission to create a fleet	signalcatalog*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateModelManifest	Grants permission to create a model manifest definition	modelmanifest*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateModelManifest	Grants permission to create a model manifest definition	signalcatalog*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSignalCatalog	Grants permission to create a signal catalog	signalcatalog*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateStateTemplate	Grants permission to create a state template	signalcatalog*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateStateTemplate	Grants permission to create a state template	statetemplate*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateVehicle	Grants permission to create a vehicle	decodermanifest*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		modelmanifest*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		vehicle*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
DeleteCampaign	Grants permission to delete a campaign	campaign*	aws:ResourceTag/${TagKey}	Write
DeleteDecoderManifest	Grants permission to delete the given decoder manifest	decodermanifest*	aws:ResourceTag/${TagKey}	Write
DeleteFleet	Grants permission to delete a fleet	fleet*	aws:ResourceTag/${TagKey}	Write
DeleteModelManifest	Grants permission to delete the given model manifest	modelmanifest*	aws:ResourceTag/${TagKey}	Write
DeleteSignalCatalog	Grants permission to delete a specific signal catalog	signalcatalog*	aws:ResourceTag/${TagKey}	Write
DeleteStateTemplate	Grants permission to delete a state template	statetemplate*	aws:ResourceTag/${TagKey}	Write
DeleteVehicle	Grants permission to delete a vehicle	vehicle*	aws:ResourceTag/${TagKey}	Write
DisassociateVehicleFleet	Grants permission to disassociate a vehicle from an existing fleet	fleet*	aws:ResourceTag/${TagKey}	Write
DisassociateVehicleFleet		vehicle*	aws:ResourceTag/${TagKey}	Write
GetCampaign	Grants permission to get summary information for a given campaign	campaign*	aws:ResourceTag/${TagKey}	Read
GetDecoderManifest	Grants permission to get summary information for a given decoder manifest definition	decodermanifest*	aws:ResourceTag/${TagKey}	Read
GetEncryptionConfiguration	Grants permission to get KMS-based encryption status for the AWS account			Read
GetFleet	Grants permission to get summary information for a fleet	fleet*	aws:ResourceTag/${TagKey}	Read
GetLoggingOptions	Grants permission to get the logging options for the AWS account			Read
GetModelManifest	Grants permission to get summary information for a given model manifest definition	modelmanifest*	aws:ResourceTag/${TagKey}	Read
GetRegisterAccountStatus	Grants permission to get the account registration status with IoT FleetWise			Read
GetSignalCatalog	Grants permission to get summary information for a specific signal catalog	signalcatalog*	aws:ResourceTag/${TagKey}	Read
GetStateTemplate	Grants permission to get summary information for a given state template	statetemplate*	aws:ResourceTag/${TagKey}	Read
GetVehicle	Grants permission to get summary information for a vehicle	vehicle*	aws:ResourceTag/${TagKey}	Read
GetVehicleStatus	Grants permission to get the status of the campaigns running on a specific vehicle	vehicle*	aws:ResourceTag/${TagKey}	Read
ImportDecoderManifest	Grants permission to import an existing decoder manifest	decodermanifest*	aws:ResourceTag/${TagKey}	Write
ImportSignalCatalog	Grants permission to create a signal catalog by importing existing definitions	signalcatalog*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
ListCampaigns	Grants permission to list campaigns			Read
ListDecoderManifestNetworkInterfaces	Grants permission to list network interfaces associated to the existing decoder manifest	decodermanifest*	aws:ResourceTag/${TagKey}	List
ListDecoderManifestSignals	Grants permission to list decoder manifest signals	decodermanifest*	aws:ResourceTag/${TagKey}	List
ListDecoderManifests	Grants permission to list all decoder manifests, with an optional filter on model manifest			Read
ListFleets	Grants permission to list all fleets			Read
ListFleetsForVehicle	Grants permission to list all the fleets that the given vehicle is associated with	vehicle*	aws:ResourceTag/${TagKey}	Read
ListModelManifestNodes	Grants permission to list all nodes for the given model manifest	modelmanifest*	aws:ResourceTag/${TagKey}	List
ListModelManifests	Grants permission to list all model manifests, with an optional filter on signal catalog			Read
ListSignalCatalogNodes	Grants permission to list all nodes for a given signal catalog	signalcatalog*	aws:ResourceTag/${TagKey}	Read
ListSignalCatalogs	Grants permission to list all signal catalogs			Read
ListStateTemplates	Grants permission to list state templates			Read
ListTagsForResource	Grants permission to list tags for a resource	campaign	aws:ResourceTag/${TagKey}	Read
		decodermanifest	aws:ResourceTag/${TagKey}
		fleet	aws:ResourceTag/${TagKey}
		modelmanifest	aws:ResourceTag/${TagKey}
		signalcatalog	aws:ResourceTag/${TagKey}
		statetemplate	aws:ResourceTag/${TagKey}
		vehicle	aws:ResourceTag/${TagKey}
ListVehicles	Grants permission to list all vehicles, with an optional filter on model manifest			Read
ListVehiclesInFleet	Grants permission to list vehicles in the given fleet	fleet*	aws:ResourceTag/${TagKey}	Read
PutEncryptionConfiguration	Grants permission to enable or disable KMS-based encryption for the AWS account			Write
PutLoggingOptions	Grants permission to put the logging options for the AWS account			Write
RegisterAccount	Grants permission to register an AWS account to IoT FleetWise			Write
TagResource	Grants permission to add tags to a resource	campaign	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		decodermanifest	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		fleet	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		modelmanifest	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		signalcatalog	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		statetemplate	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		vehicle	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from a resource	campaign	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		decodermanifest	aws:ResourceTag/${TagKey} aws:TagKeys
		fleet	aws:ResourceTag/${TagKey} aws:TagKeys
		modelmanifest	aws:ResourceTag/${TagKey} aws:TagKeys
		signalcatalog	aws:ResourceTag/${TagKey} aws:TagKeys
		statetemplate	aws:ResourceTag/${TagKey} aws:TagKeys
		vehicle	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateCampaign	Grants permission to update the given campaign	campaign*	aws:ResourceTag/${TagKey}	Write
UpdateDecoderManifest	Grants permission to update a decoder manifest defnition	decodermanifest*	aws:ResourceTag/${TagKey}	Write
UpdateFleet	Grants permission to update the fleet	fleet*	aws:ResourceTag/${TagKey}	Write
UpdateModelManifest	Grants permission to update the given model manifest definition	modelmanifest*	aws:ResourceTag/${TagKey}	Write
UpdateSignalCatalog	Grants permission to update a specific signal catalog definition	signalcatalog*	aws:ResourceTag/${TagKey}	Write
UpdateStateTemplate	Grants permission to update the given state template	statetemplate*	aws:ResourceTag/${TagKey}	Write
UpdateVehicle	Grants permission to update the vehicle	decodermanifest	aws:ResourceTag/${TagKey} iotfleetwise:UpdateToDecoderManifestArn iotfleetwise:UpdateToModelManifestArn	Write
		modelmanifest	aws:ResourceTag/${TagKey} iotfleetwise:UpdateToDecoderManifestArn iotfleetwise:UpdateToModelManifestArn
		vehicle*	aws:ResourceTag/${TagKey} iotfleetwise:UpdateToDecoderManifestArn iotfleetwise:UpdateToModelManifestArn

Permission-only actions for AWS IoT FleetWise

The following actions are defined by AWS IoT FleetWise but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
GenerateCommandPayload	Grants permission to generate the payload for running a command on a vehicle	statetemplate	aws:ResourceTag/${TagKey} iotfleetwise:Signals	Permissions management, Write
vehicle*	aws:ResourceTag/${TagKey} iotfleetwise:Signals

Actions

Description

Resource types (*required)

Condition keys

Access level

GenerateCommandPayload

Grants permission to generate the payload for running a command on a vehicle

statetemplate

aws:ResourceTag/${TagKey}

iotfleetwise:Signals

Permissions management, Write

vehicle*

aws:ResourceTag/${TagKey}

iotfleetwise:Signals

Resource types defined by AWS IoT FleetWise

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
campaign	arn:${Partition}:iotfleetwise:${Region}:${Account}:campaign/${CampaignName}	aws:ResourceTag/${TagKey}
decodermanifest	arn:${Partition}:iotfleetwise:${Region}:${Account}:decoder-manifest/${Name}	aws:ResourceTag/${TagKey}
fleet	arn:${Partition}:iotfleetwise:${Region}:${Account}:fleet/${FleetId}	aws:ResourceTag/${TagKey}
modelmanifest	arn:${Partition}:iotfleetwise:${Region}:${Account}:model-manifest/${Name}	aws:ResourceTag/${TagKey}
signalcatalog	arn:${Partition}:iotfleetwise:${Region}:${Account}:signal-catalog/${Name}	aws:ResourceTag/${TagKey}
statetemplate	arn:${Partition}:iotfleetwise:${Region}:${Account}:state-template/${StateTemplateId}	aws:ResourceTag/${TagKey}
vehicle	arn:${Partition}:iotfleetwise:${Region}:${Account}:vehicle/${VehicleId}	aws:ResourceTag/${TagKey}

Condition keys for AWS IoT FleetWise

AWS IoT FleetWise defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString
iotfleetwise:DestinationArn	Filters access by campaign destination ARN, eg. an S3 bucket ARN or a Timestream ARN	ARN
iotfleetwise:Signals	Filters access by fully qualified signal names	ArrayOfString
iotfleetwise:UpdateToDecoderManifestArn	Filters access by a list of IoT FleetWise Decoder Manifest ARNs	ARN
iotfleetwise:UpdateToModelManifestArn	Filters access by a list of IoT FleetWise Model Manifest ARNs	ARN

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS IoT Fleet Hub for Device Management (iotfleethub)

AWS IoT Greengrass (greengrass)