Actions, resources, and condition keys for AWS OpsWorks

AWS OpsWorks (service prefix: opsworks) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Actions defined by AWS OpsWorks

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Access level
AssignInstance	Grants permission to assign a registered instance to a layer	stack	Write
AssignVolume	Grants permission to assign one of the stack's registered Amazon EBS volumes to a specified instance	stack	Write
AssociateElasticIp	Grants permission to associate one of the stack's registered Elastic IP addresses with a specified instance	stack	Write
AttachElasticLoadBalancer	Grants permission to attach an Elastic Load Balancing load balancer to a specified layer	stack	Write
CloneStack	Grants permission to create a clone of a specified stack	stack	Write
CreateApp	Grants permission to create an app for a specified stack	stack	Write
CreateDeployment	Grants permission to run deployment or stack commands	stack	Write
CreateInstance	Grants permission to create an instance in a specified stack	stack	Write
CreateLayer	Grants permission to create a layer	stack	Write
CreateStack	Grants permission to create a new stack		Write
CreateUserProfile	Grants permission to create a new user profile		Write
DeleteApp	Grants permission to delete a specified app	stack	Write
DeleteInstance	Grants permission to delete a specified instance, which terminates the associated Amazon EC2 instance	stack	Write
DeleteLayer	Grants permission to delete a specified layer	stack	Write
DeleteStack	Grants permission to delete a specified stack	stack	Write
DeleteUserProfile	Grants permission to delete a user profile		Write
DeregisterEcsCluster	Grants permission to delete a user profile	stack	Write
DeregisterElasticIp	Grants permission to deregister a specified Elastic IP address	stack	Write
DeregisterInstance	Grants permission to deregister a registered Amazon EC2 or on-premises instance	stack	Write
DeregisterRdsDbInstance	Grants permission to deregister an Amazon RDS instance	stack	Write
DeregisterVolume	Grants permission to deregister an Amazon EBS volume	stack	Write
DescribeAgentVersions	Grants permission to describe the available AWS OpsWorks agent versions	stack	List
DescribeApps	Grants permission to request a description of a specified set of apps	stack	List
DescribeCommands	Grants permission to describe the results of specified commands	stack	List
DescribeDeployments	Grants permission to request a description of a specified set of deployments	stack	List
DescribeEcsClusters	Grants permission to describe Amazon ECS clusters that are registered with a stack	stack	List
DescribeElasticIps	Grants permission to describe Elastic IP addresses	stack	List
DescribeElasticLoadBalancers	Grants permission to describe a stack's Elastic Load Balancing instances	stack	List
DescribeInstances	Grants permission to request a description of a set of instances	stack	List
DescribeLayers	Grants permission to request a description of one or more layers in a specified stack	stack	List
DescribeLoadBasedAutoScaling	Grants permission to describe load-based auto scaling configurations for specified layers	stack	List
DescribeMyUserProfile	Grants permission to describe a user's SSH information		List
DescribeOperatingSystems	Grants permission to describe the operating systems that are supported by AWS OpsWorks Stacks		List
DescribePermissions	Grants permission to describe the permissions for a specified stack	stack	List
DescribeRaidArrays	Grants permission to describe an instance's RAID arrays	stack	List
DescribeRdsDbInstances	Grants permission to describe Amazon RDS instances	stack	List
DescribeServiceErrors	Grants permission to describe AWS OpsWorks service errors	stack	List
DescribeStackProvisioningParameters	Grants permission to request a description of a stack's provisioning parameters	stack	List
DescribeStackSummary	Grants permission to describe the number of layers and apps in a specified stack, and the number of instances in each state, such as running_setup or online	stack	List
DescribeStacks	Grants permission to request a description of one or more stacks	stack	List
DescribeTimeBasedAutoScaling	Grants permission to describe time-based auto scaling configurations for specified instances	stack	List
DescribeUserProfiles	Grants permission to describe specified users		List
DescribeVolumes	Grants permission to describe an instance's Amazon EBS volumes	stack	List
DetachElasticLoadBalancer	Grants permission to detache a specified Elastic Load Balancing instance from its layer	stack	Write
DisassociateElasticIp	Grants permission to disassociate an Elastic IP address from its instance	stack	Write
GetHostnameSuggestion	Grants permission to get a generated host name for the specified layer, based on the current host name theme	stack	Read
GrantAccess	Grants permission to grant RDP access to a Windows instance for a specified time period	stack	Write
ListTags	Grants permission to return a list of tags that are applied to the specified stack or layer	stack	List
RebootInstance	Grants permission to reboot a specified instance	stack	Write
RegisterEcsCluster	Grants permission to register a specified Amazon ECS cluster with a stack	stack	Write
RegisterElasticIp	Grants permission to register an Elastic IP address with a specified stack	stack	Write
RegisterInstance	Grants permission to register instances with a specified stack that were created outside of AWS OpsWorks	stack	Write
RegisterRdsDbInstance	Grants permission to register an Amazon RDS instance with a stack	stack	Write
RegisterVolume	Grants permission to register an Amazon EBS volume with a specified stack	stack	Write
SetLoadBasedAutoScaling	Grants permission to specify the load-based auto scaling configuration for a specified layer	stack	Write
SetPermission	Grants permission to specify a user's permissions	stack	Permissions management, Write
SetTimeBasedAutoScaling	Grants permission to specify the time-based auto scaling configuration for a specified instance	stack	Write
StartInstance	Grants permission to start a specified instance	stack	Write
StartStack	Grants permission to start a stack's instances	stack	Write
StopInstance	Grants permission to stop a specified instance	stack	Write
StopStack	Grants permission to stop a specified stack	stack	Write
TagResource	Grants permission to apply tags to a specified stack or layer	stack	Tagging, Write
UnassignInstance	Grants permission to unassign a registered instance from all of it's layers	stack	Write
UnassignVolume	Grants permission to unassign an assigned Amazon EBS volume	stack	Write
UntagResource	Grants permission to remove tags from a specified stack or layer	stack	Tagging, Write
UpdateApp	Grants permission to update a specified app	stack	Write
UpdateElasticIp	Grants permission to update a registered Elastic IP address's name	stack	Write
UpdateInstance	Grants permission to update a specified instance	stack	Write
UpdateLayer	Grants permission to update a specified layer	stack	Write
UpdateMyUserProfile	Grants permission to update a user's SSH public key		Write
UpdateRdsDbInstance	Grants permission to update an Amazon RDS instance	stack	Write
UpdateStack	Grants permission to update a specified stack	stack	Write
UpdateUserProfile	Grants permission to update a specified user profile		Permissions management, Write
UpdateVolume	Grants permission to update an Amazon EBS volume's name or mount point	stack	Write

Resource types defined by AWS OpsWorks

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
stack	arn:${Partition}:opsworks:${Region}:${Account}:stack/${StackId}/

Condition keys for AWS OpsWorks

AWS OpsWorks has no service-specific condition keys that can be used in the Condition element of policy statements.

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Network Manager Chat (networkmanager-chat)

AWS OpsWorks Configuration Management (opsworks-cm)