Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Location

Amazon Location (service prefix: geo) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Location
Actions defined by Amazon Location
Resource types defined by Amazon Location
Condition keys for Amazon Location

API operations defined by Amazon Location

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateTrackerConsumer	geo:AssociateTrackerConsumer			Write
BatchDeleteDevicePositionHistory	geo:BatchDeleteDevicePositionHistory			Write
BatchDeleteGeofence	geo:BatchDeleteGeofence			Write
BatchEvaluateGeofences	geo:BatchEvaluateGeofences			Write
BatchGetDevicePosition	geo:BatchGetDevicePosition			Read
BatchPutGeofence	geo:BatchPutGeofence			Write
BatchUpdateDevicePosition	geo:BatchUpdateDevicePosition			Write
CalculateRoute	geo:CalculateRoute			Read
CalculateRouteMatrix	geo:CalculateRouteMatrix			Read
CancelJob	geo:CancelJob			Write
CreateGeofenceCollection	geo:CreateGeofenceCollection			Write
CreateGeofenceCollection	geo:TagResource			Tagging, Write
CreateKey	geo:CalculateRoute			Read
	geo:CalculateRouteMatrix			Read
	geo:CreateKey			Write
	geo:GetMapGlyphs			Read
	geo:GetMapSprites			Read
	geo:GetMapStyleDescriptor			Read
	geo:GetMapTile			Read
	geo:GetPlace			Read
	geo:SearchPlaceIndexForPosition			Read
	geo:SearchPlaceIndexForSuggestions			Read
	geo:SearchPlaceIndexForText			Read
	geo:TagResource			Tagging, Write
	geo-maps:GetStaticMap			Read
	geo-maps:GetTile			Read
	geo-places:Autocomplete			Read
	geo-places:Geocode			Read
	geo-places:GetPlace			Read
	geo-places:ReverseGeocode			Read
	geo-places:SearchNearby			Read
	geo-places:SearchText			Read
	geo-places:Suggest			Read
	geo-routes:CalculateIsolines			Read
	geo-routes:CalculateRouteMatrix			Read
	geo-routes:CalculateRoutes			Read
	geo-routes:OptimizeWaypoints			Read
	geo-routes:SnapToRoads			Read
CreateMap	geo:CreateMap			Write
CreateMap	geo:TagResource			Tagging, Write
CreatePlaceIndex	geo:CreatePlaceIndex			Write
CreatePlaceIndex	geo:TagResource			Tagging, Write
CreateRouteCalculator	geo:CreateRouteCalculator			Write
CreateRouteCalculator	geo:TagResource			Tagging, Write
CreateTracker	geo:CreateTracker			Write
CreateTracker	geo:TagResource			Tagging, Write
DeleteGeofenceCollection	geo:DeleteGeofenceCollection			Write
DeleteKey	geo:DeleteKey			Write
DeleteMap	geo:DeleteMap			Write
DeletePlaceIndex	geo:DeletePlaceIndex			Write
DeleteRouteCalculator	geo:DeleteRouteCalculator			Write
DeleteTracker	geo:DeleteTracker			Write
DescribeGeofenceCollection	geo:DescribeGeofenceCollection			Read
DescribeKey	geo:DescribeKey			Read
DescribeMap	geo:DescribeMap			Read
DescribePlaceIndex	geo:DescribePlaceIndex			Read
DescribeRouteCalculator	geo:DescribeRouteCalculator			Read
DescribeTracker	geo:DescribeTracker			Read
DisassociateTrackerConsumer	geo:DisassociateTrackerConsumer			Write
ForecastGeofenceEvents	geo:ForecastGeofenceEvents			Read
GetDevicePosition	geo:GetDevicePosition			Read
GetDevicePositionHistory	geo:GetDevicePositionHistory			Read
GetGeofence	geo:GetGeofence			Read
GetJob	geo:GetJob			Read
GetMapGlyphs	geo:GetMapGlyphs			Read
GetMapSprites	geo:GetMapSprites			Read
GetMapStyleDescriptor	geo:GetMapStyleDescriptor			Read
GetMapTile	geo:GetMapTile			Read
GetPlace	geo:GetPlace			Read
ListDevicePositions	geo:ListDevicePositions			Read
ListGeofenceCollections	geo:ListGeofenceCollections			List
ListGeofences	geo:ListGeofences			Read
ListJobs	geo:ListJobs			List
ListKeys	geo:ListKeys			List
ListMaps	geo:ListMaps			List
ListPlaceIndexes	geo:ListPlaceIndexes			List
ListRouteCalculators	geo:ListRouteCalculators			List
ListTagsForResource	geo:ListTagsForResource			Read
ListTrackerConsumers	geo:ListTrackerConsumers			Read
ListTrackers	geo:ListTrackers			List
PutGeofence	geo:PutGeofence			Write
SearchPlaceIndexForPosition	geo:SearchPlaceIndexForPosition			Read
SearchPlaceIndexForSuggestions	geo:SearchPlaceIndexForSuggestions			Read
SearchPlaceIndexForText	geo:SearchPlaceIndexForText			Read
StartJob	geo:StartJob			Write
	geo:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	geo.amazonaws.com	Write
TagResource	geo:TagResource			Tagging, Write
UntagResource	geo:UntagResource			Tagging, Write
UpdateGeofenceCollection	geo:UpdateGeofenceCollection			Write
UpdateKey	geo:CalculateRoute			Read
	geo:CalculateRouteMatrix			Read
	geo:GetMapGlyphs			Read
	geo:GetMapSprites			Read
	geo:GetMapStyleDescriptor			Read
	geo:GetMapTile			Read
	geo:GetPlace			Read
	geo:SearchPlaceIndexForPosition			Read
	geo:SearchPlaceIndexForSuggestions			Read
	geo:SearchPlaceIndexForText			Read
	geo:UpdateKey			Write
	geo-maps:GetStaticMap			Read
	geo-maps:GetTile			Read
	geo-places:Autocomplete			Read
	geo-places:Geocode			Read
	geo-places:GetPlace			Read
	geo-places:ReverseGeocode			Read
	geo-places:SearchNearby			Read
	geo-places:SearchText			Read
	geo-places:Suggest			Read
	geo-routes:CalculateIsolines			Read
	geo-routes:CalculateRouteMatrix			Read
	geo-routes:CalculateRoutes			Read
	geo-routes:OptimizeWaypoints			Read
	geo-routes:SnapToRoads			Read
UpdateMap	geo:UpdateMap			Write
UpdatePlaceIndex	geo:UpdatePlaceIndex			Write
UpdateRouteCalculator	geo:UpdateRouteCalculator			Write
UpdateTracker	geo:UpdateTracker			Write
VerifyDevicePosition	geo:VerifyDevicePosition			Read

Actions defined by Amazon Location

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateTrackerConsumer	Grants permission to create an association between a geofence-collection and a tracker resource	tracker*	aws:ResourceTag/${TagKey} geo:DeviceIds	Write
BatchDeleteDevicePositionHistory	Grants permission to delete a batch of device position histories from a tracker resource	tracker*	aws:ResourceTag/${TagKey} geo:DeviceIds	Write
BatchDeleteGeofence	Grants permission to delete a batch of geofences from a geofence collection	geofence-collection*	aws:ResourceTag/${TagKey} geo:GeofenceIds	Write
BatchEvaluateGeofences	Grants permission to evaluate device positions against the position of geofences in a given geofence collection	geofence-collection*	aws:ResourceTag/${TagKey} geo:GeofenceIds	Write
BatchGetDevicePosition	Grants permission to send a batch request to retrieve device positions	tracker*	aws:ResourceTag/${TagKey} geo:DeviceIds	Read
BatchPutGeofence	Grants permission to send a batch request for adding geofences into a given geofence collection	geofence-collection*	aws:ResourceTag/${TagKey} geo:GeofenceIds	Write
BatchUpdateDevicePosition	Grants permission to upload a position update for one or more devices to a tracker resource	tracker*	aws:ResourceTag/${TagKey} geo:DeviceIds	Write
CalculateRoute	Grants permission to calculate routes using a given route calculator resource	route-calculator*	aws:ResourceTag/${TagKey}	Read
CalculateRouteMatrix	Grants permission to calculate a route matrix using a given route calculator resource	route-calculator*	aws:ResourceTag/${TagKey}	Read
CancelJob	Grants permission to cancel a job	job*	aws:ResourceTag/${TagKey}	Write
CreateGeofenceCollection	Grants permission to create a geofence-collection	geofence-collection*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys geo:GeofenceIds	Write
CreateKey	Grants permission to create an API key resource	api-key*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateMap	Grants permission to create a map resource	map*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePlaceIndex	Grants permission to create a place index resource	place-index*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRouteCalculator	Grants permission to create a route calculator resource	route-calculator*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTracker	Grants permission to create a tracker resource	tracker*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys geo:DeviceIds	Write
DeleteGeofenceCollection	Grants permission to delete a geofence-collection	geofence-collection*	aws:ResourceTag/${TagKey} geo:GeofenceIds	Write
DeleteKey	Grants permission to delete an API key resource	api-key*	aws:ResourceTag/${TagKey}	Write
DeleteMap	Grants permission to delete a map resource	map*	aws:ResourceTag/${TagKey}	Write
DeletePlaceIndex	Grants permission to delete a place index resource	place-index*	aws:ResourceTag/${TagKey}	Write
DeleteRouteCalculator	Grants permission to delete a route calculator resource	route-calculator*	aws:ResourceTag/${TagKey}	Write
DeleteTracker	Grants permission to delete a tracker resource	tracker*	aws:ResourceTag/${TagKey} geo:DeviceIds	Write
DescribeGeofenceCollection	Grants permission to retrieve geofence collection details	geofence-collection*	aws:ResourceTag/${TagKey} geo:GeofenceIds	Read
DescribeKey	Grants permission to retrieve API key resource details and secret	api-key*	aws:ResourceTag/${TagKey}	Read
DescribeMap	Grants permission to retrieve map resource details	map*	aws:ResourceTag/${TagKey}	Read
DescribePlaceIndex	Grants permission to retrieve place-index resource details	place-index*	aws:ResourceTag/${TagKey}	Read
DescribeRouteCalculator	Grants permission to retrieve route calculator resource details	route-calculator*	aws:ResourceTag/${TagKey}	Read
DescribeTracker	Grants permission to retrieve a tracker resource details	tracker*	aws:ResourceTag/${TagKey} geo:DeviceIds	Read
DisassociateTrackerConsumer	Grants permission to remove the association between a tracker resource and a geofence-collection	tracker*	aws:ResourceTag/${TagKey} geo:DeviceIds	Write
ForecastGeofenceEvents	Grants permission to forecast events for geofences stored in a given geofence collection	geofence-collection*	aws:ResourceTag/${TagKey} geo:GeofenceIds	Read
GetDevicePosition	Grants permission to retrieve the latest device position	tracker*	aws:ResourceTag/${TagKey} geo:DeviceIds	Read
GetDevicePositionHistory	Grants permission to retrieve the device position history	tracker*	aws:ResourceTag/${TagKey} geo:DeviceIds	Read
GetGeofence	Grants permission to retrieve the geofence details from a geofence-collection	geofence-collection*	aws:ResourceTag/${TagKey} geo:GeofenceIds	Read
GetJob	Grants permission to retrieve job details	job*	aws:ResourceTag/${TagKey}	Read
GetMapGlyphs	Grants permission to retrieve the glyph file for a map resource	map*	aws:ResourceTag/${TagKey}	Read
GetMapSprites	Grants permission to retrieve the sprite file for a map resource	map*	aws:ResourceTag/${TagKey}	Read
GetMapStyleDescriptor	Grants permission to retrieve the map style descriptor from a map resource	map*	aws:ResourceTag/${TagKey}	Read
GetMapTile	Grants permission to retrieve the map tile from the map resource	map*	aws:ResourceTag/${TagKey}	Read
GetPlace	Grants permission to find a place by its unique ID	place-index*	aws:ResourceTag/${TagKey}	Read
ListDevicePositions	Grants permission to retrieve a list of devices and their latest positions from the given tracker resource	tracker*	aws:ResourceTag/${TagKey} geo:DeviceIds	Read
ListGeofenceCollections	Grants permission to lists geofence-collections	geofence-collection*	aws:ResourceTag/${TagKey} geo:GeofenceIds	List
ListGeofences	Grants permission to list geofences stored in a given geofence collection	geofence-collection*	aws:ResourceTag/${TagKey} geo:GeofenceIds	Read
ListJobs	Grants permission to list jobs	job*	aws:ResourceTag/${TagKey}	List
ListKeys	Grants permission to list API key resources	api-key*	aws:ResourceTag/${TagKey}	List
ListMaps	Grants permission to list map resources	map*	aws:ResourceTag/${TagKey}	List
ListPlaceIndexes	Grants permission to return a list of place index resources	place-index*	aws:ResourceTag/${TagKey}	List
ListRouteCalculators	Grants permission to return a list of route calculator resources	route-calculator*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list the tags (metadata) which you have assigned to the resource	api-key	aws:ResourceTag/${TagKey}	Read
		geofence-collection	aws:ResourceTag/${TagKey} geo:GeofenceIds
		job	aws:ResourceTag/${TagKey}
		map	aws:ResourceTag/${TagKey}
		place-index	aws:ResourceTag/${TagKey}
		route-calculator	aws:ResourceTag/${TagKey}
		tracker	aws:ResourceTag/${TagKey} geo:DeviceIds
ListTrackerConsumers	Grants permission to retrieve a list of geofence collections currently associated to the given tracker resource	tracker*	aws:ResourceTag/${TagKey} geo:DeviceIds	Read
ListTrackers	Grants permission to return a list of tracker resources	tracker*	aws:ResourceTag/${TagKey} geo:DeviceIds	List
PutGeofence	Grants permission to add a new geofence or update an existing geofence to a given geofence-collection	geofence-collection*	aws:ResourceTag/${TagKey} geo:GeofenceIds	Write
SearchPlaceIndexForPosition	Grants permission to reverse geocodes a given coordinate	place-index*	aws:ResourceTag/${TagKey}	Read
SearchPlaceIndexForSuggestions	Grants permission to generate suggestions for addresses and points of interest based on partial or misspelled free-form text	place-index*	aws:ResourceTag/${TagKey}	Read
SearchPlaceIndexForText	Grants permission to geocode free-form text, such as an address, name, city or region	place-index*	aws:ResourceTag/${TagKey}	Read
StartJob	Grants permission to start a job	job*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
TagResource	Grants permission to adds to or modifies the tags of the given resource. Tags are metadata which can be used to manage a resource	api-key	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		geofence-collection	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys geo:GeofenceIds
		job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		map	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		place-index	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		route-calculator	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		tracker	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys geo:DeviceIds
UntagResource	Grants permission to remove the given tags (metadata) from the resource	api-key	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		geofence-collection	aws:ResourceTag/${TagKey} aws:TagKeys geo:GeofenceIds
		job	aws:ResourceTag/${TagKey} aws:TagKeys
		map	aws:ResourceTag/${TagKey} aws:TagKeys
		place-index	aws:ResourceTag/${TagKey} aws:TagKeys
		route-calculator	aws:ResourceTag/${TagKey} aws:TagKeys
		tracker	aws:ResourceTag/${TagKey} aws:TagKeys geo:DeviceIds
UpdateGeofenceCollection	Grants permission to update a geofence collection	geofence-collection*	aws:ResourceTag/${TagKey} geo:GeofenceIds	Write
UpdateKey	Grants permission to update an API key resource	api-key*	aws:ResourceTag/${TagKey}	Write
UpdateMap	Grants permission to update a map resource	map*	aws:ResourceTag/${TagKey}	Write
UpdatePlaceIndex	Grants permission to update a place index resource	place-index*	aws:ResourceTag/${TagKey}	Write
UpdateRouteCalculator	Grants permission to update a route calculator resource	route-calculator*	aws:ResourceTag/${TagKey}	Write
UpdateTracker	Grants permission to update a tracker resource	tracker*	aws:ResourceTag/${TagKey} geo:DeviceIds	Write
VerifyDevicePosition	Grants permission to verify a device position	tracker*	aws:ResourceTag/${TagKey} geo:DeviceIds	Read

Resource types defined by Amazon Location

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
api-key	arn:${Partition}:geo:${Region}:${Account}:api-key/${KeyName}	aws:ResourceTag/${TagKey}
geofence-collection	arn:${Partition}:geo:${Region}:${Account}:geofence-collection/${GeofenceCollectionName}	aws:ResourceTag/${TagKey} geo:GeofenceIds
job	arn:${Partition}:geo:${Region}:${Account}:job/${JobId}	aws:ResourceTag/${TagKey}
map	arn:${Partition}:geo:${Region}:${Account}:map/${MapName}	aws:ResourceTag/${TagKey}
place-index	arn:${Partition}:geo:${Region}:${Account}:place-index/${IndexName}	aws:ResourceTag/${TagKey}
route-calculator	arn:${Partition}:geo:${Region}:${Account}:route-calculator/${CalculatorName}	aws:ResourceTag/${TagKey}
tracker	arn:${Partition}:geo:${Region}:${Account}:tracker/${TrackerName}	aws:ResourceTag/${TagKey} geo:DeviceIds

Condition keys for Amazon Location

Amazon Location defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a tag's key and value in a request	String
aws:ResourceTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:TagKeys	Filters access by the tag keys in a request	ArrayOfString
geo:DeviceIds	Filters access by the presence of device ids in the request	ArrayOfString
geo:GeofenceIds	Filters access by the presence of geofence ids in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Lightsail (lightsail)

Amazon Location Service Maps (geo-maps)