Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS User Notifications

AWS User Notifications (service prefix: notifications) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS User Notifications
Actions defined by AWS User Notifications
Permission-only actions for AWS User Notifications
Resource types defined by AWS User Notifications
Condition keys for AWS User Notifications

API operations defined by AWS User Notifications

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AssociateChannel	notifications:AssociateChannel	Write
AssociateManagedNotificationAccountContact	notifications:AssociateManagedNotificationAccountContact	Write
AssociateManagedNotificationAdditionalChannel	notifications:AssociateManagedNotificationAdditionalChannel	Write
AssociateOrganizationalUnit	notifications:AssociateOrganizationalUnit	Write
CreateEventRule	notifications:CreateEventRule	Write
CreateNotificationConfiguration	notifications:CreateNotificationConfiguration	Write
CreateNotificationConfiguration	notifications:TagResource	Tagging, Write
DeleteEventRule	notifications:DeleteEventRule	Write
DeleteNotificationConfiguration	notifications:DeleteNotificationConfiguration	Write
DeregisterNotificationHub	notifications:DeregisterNotificationHub	Write
DisableNotificationsAccessForOrganization	notifications:DisableNotificationsAccessForOrganization	Permissions management, Write
DisassociateChannel	notifications:DisassociateChannel	Write
DisassociateManagedNotificationAccountContact	notifications:DisassociateManagedNotificationAccountContact	Write
DisassociateManagedNotificationAdditionalChannel	notifications:DisassociateManagedNotificationAdditionalChannel	Write
DisassociateOrganizationalUnit	notifications:DisassociateOrganizationalUnit	Write
EnableNotificationsAccessForOrganization	notifications:EnableNotificationsAccessForOrganization	Permissions management, Write
GetEventRule	notifications:GetEventRule	Read
GetManagedNotificationChildEvent	notifications:GetManagedNotificationChildEvent	Read
GetManagedNotificationConfiguration	notifications:GetManagedNotificationConfiguration	Read
GetManagedNotificationEvent	notifications:GetManagedNotificationEvent	Read
GetNotificationConfiguration	notifications:GetNotificationConfiguration	Read
GetNotificationEvent	notifications:GetNotificationEvent	Read
GetNotificationsAccessForOrganization	notifications:GetNotificationsAccessForOrganization	Read
ListChannels	notifications:ListChannels	List
ListEventRules	notifications:ListEventRules	List
ListManagedNotificationChannelAssociations	notifications:ListManagedNotificationChannelAssociations	List
ListManagedNotificationChildEvents	notifications:ListManagedNotificationChildEvents	List
ListManagedNotificationConfigurations	notifications:ListManagedNotificationConfigurations	List
ListManagedNotificationEvents	notifications:ListManagedNotificationEvents	List
ListMemberAccounts	notifications:ListMemberAccounts	List
ListNotificationConfigurations	notifications:ListNotificationConfigurations	List
ListNotificationEvents	notifications:ListNotificationEvents	List
ListNotificationHubs	notifications:ListNotificationHubs	List
ListOrganizationalUnits	notifications:ListOrganizationalUnits	List
ListTagsForResource	notifications:ListTagsForResource	List
RegisterNotificationHub	notifications:RegisterNotificationHub	Write
TagResource	notifications:TagResource	Tagging, Write
UntagResource	notifications:UntagResource	Tagging, Write
UpdateEventRule	notifications:UpdateEventRule	Write
UpdateNotificationConfiguration	notifications:UpdateNotificationConfiguration	Write

Actions defined by AWS User Notifications

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateChannel	Grants permission to associate a new Channel with a particular NotificationConfiguration	NotificationConfiguration*	aws:ResourceTag/${TagKey}	Write
AssociateManagedNotificationAccountContact	Grants permission to associate an Account contact to a particular Managed Notification Configuration	ManagedNotificationConfiguration*		Write
AssociateManagedNotificationAdditionalChannel	Grants permission to associate a Channel to a particular Managed Notification Configuration	ManagedNotificationConfiguration*		Write
AssociateOrganizationalUnit	Grants permission to associate an Organizational Unit to a particular Notification Configuration	NotificationConfiguration*	aws:ResourceTag/${TagKey}	Write
CreateEventRule	Grants permission to create a new EventRule, associating it with a NotificationConfiguration			Write
CreateNotificationConfiguration	Grants permission to create a NotificationConfiguration		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteEventRule	Grants permission to delete an EventRule	EventRule*		Write
DeleteNotificationConfiguration	Grants permission to delete a NotificationConfiguration	NotificationConfiguration*	aws:ResourceTag/${TagKey}	Write
DeregisterNotificationHub	Grants permission to deregister a NotificationHub			Write
DisableNotificationsAccessForOrganization	Grants permission to disable Service Trust for AWS User Notifications			Permissions management, Write
DisassociateChannel	Grants permission to remove a Channel from a NotificationConfiguration	NotificationConfiguration*	aws:ResourceTag/${TagKey}	Write
DisassociateManagedNotificationAccountContact	Grants permission to remove an Account contact from a Managed Notification Configuration	ManagedNotificationConfiguration*		Write
DisassociateManagedNotificationAdditionalChannel	Grants permission to remove a Channel from a Managed Notification Configuration	ManagedNotificationConfiguration*		Write
DisassociateOrganizationalUnit	Grants permission to disassociate an Organizational Unit to a particular Notification Configuration	NotificationConfiguration*	aws:ResourceTag/${TagKey}	Write
EnableNotificationsAccessForOrganization	Grants permission to enable Service Trust for AWS User Notifications			Permissions management, Write
GetEventRule	Grants permission to get an EventRule	EventRule*		Read
GetManagedNotificationChildEvent	Grants permission to get a Managed Notification Child Event	ManagedNotificationChildEvent*		Read
GetManagedNotificationConfiguration	Grants permission to get a Managed Notification Configuration	ManagedNotificationConfiguration*		Read
GetManagedNotificationEvent	Grants permission to get a Managed NotificationEvent	ManagedNotificationEvent*		Read
GetNotificationConfiguration	Grants permission to get a NotificationConfiguration	NotificationConfiguration*	aws:ResourceTag/${TagKey}	Read
GetNotificationEvent	Grants permission to get a NotificationEvent	NotificationEvent*		Read
GetNotificationsAccessForOrganization	Grants permission to read Service Trust for AWS User Notifications			Read
ListChannels	Grants permission to list Channels by NotificationConfiguration	NotificationConfiguration*	aws:ResourceTag/${TagKey}	List
ListEventRules	Grants permission to list EventRules			List
ListManagedNotificationChannelAssociations	Grants permission to list Account contacts and Channels associated with a Managed Notification Configuration	ManagedNotificationConfiguration*		List
ListManagedNotificationChildEvents	Grants permission to list Managed Notification Child Events			List
ListManagedNotificationConfigurations	Grants permission to list Managed Notification Configurations			List
ListManagedNotificationEvents	Grants permission to list Managed Notification Events			List
ListMemberAccounts	Grants permission to list Member Accounts for a Notification Configuration	NotificationConfiguration*	aws:ResourceTag/${TagKey}	List
ListNotificationConfigurations	Grants permission to list NotificationConfigurations			List
ListNotificationEvents	Grants permission to list NotificationEvents			List
ListNotificationHubs	Grants permission to list NotificationHubs			List
ListOrganizationalUnits	Grants permission to list Organizational Units for a Notification Configuration	NotificationConfiguration*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to get tags for a resource			List
RegisterNotificationHub	Grants permission to register a NotificationHub			Write
TagResource	Grants permission to tag a resource	NotificationConfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from a resource	NotificationConfiguration*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateEventRule	Grants permission to update an EventRule	EventRule*		Write
UpdateNotificationConfiguration	Grants permission to update a NotificationConfiguration	NotificationConfiguration*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for AWS User Notifications

The following actions are defined by AWS User Notifications but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
GetFeatureOptInStatus	Grants permission to read the opt-in status of an AWS User Notification Service feature			Read
PutFeatureOptInStatus	Grants permission to update the opt-in status of an AWS User Notification Service feature			Write

Resource types defined by AWS User Notifications

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
EventRule	arn:${Partition}:notifications::${Account}:configuration/${NotificationConfigurationId}/rule/${EventRuleId}
ManagedNotificationChildEvent	arn:${Partition}:notifications::${Account}:managed-notification-configuration/category/${Category}/sub-category/${Subcategory}/event/${NotificationEventId}/child-event/${NotificationChildEventId}
ManagedNotificationConfiguration	arn:${Partition}:notifications::${Account}:managed-notification-configuration/category/${Category}/sub-category/${Subcategory}
ManagedNotificationEvent	arn:${Partition}:notifications::${Account}:managed-notification-configuration/category/${Category}/sub-category/${Subcategory}/event/${NotificationEventId}
NotificationConfiguration	arn:${Partition}:notifications::${Account}:configuration/${NotificationConfigurationId}	aws:ResourceTag/${TagKey}
NotificationEvent	arn:${Partition}:notifications:${Region}:${Account}:configuration/${NotificationConfigurationId}/event/${NotificationEventId}

Condition keys for AWS User Notifications

AWS User Notifications defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS User Experience Customization (uxc)

AWS User Notifications Contacts (notifications-contacts)