Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Resource Explorer

AWS Resource Explorer (service prefix: resource-explorer-2) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Resource Explorer
Actions defined by AWS Resource Explorer
Permission-only actions for AWS Resource Explorer
Resource types defined by AWS Resource Explorer
Condition keys for AWS Resource Explorer

API operations defined by AWS Resource Explorer

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AssociateDefaultView	resource-explorer-2:AssociateDefaultView	Write
BatchGetView	resource-explorer-2:BatchGetView	Read
BatchGetView	resource-explorer-2:GetView	Read
CreateIndex	resource-explorer-2:CreateIndex	Write
CreateIndex	resource-explorer-2:TagResource	Tagging, Write
CreateResourceExplorerSetup	resource-explorer-2:CreateResourceExplorerSetup	Write
CreateView	resource-explorer-2:CreateView	Write
CreateView	resource-explorer-2:TagResource	Tagging, Write
DeleteIndex	resource-explorer-2:DeleteIndex	Write
DeleteResourceExplorerSetup	resource-explorer-2:DeleteResourceExplorerSetup	Write
DeleteView	resource-explorer-2:DeleteView	Write
DisassociateDefaultView	resource-explorer-2:DisassociateDefaultView	Write
GetAccountLevelServiceConfiguration	resource-explorer-2:GetAccountLevelServiceConfiguration	Read
GetDefaultView	resource-explorer-2:GetDefaultView	Read
GetIndex	resource-explorer-2:GetIndex	Read
GetManagedView	resource-explorer-2:GetManagedView	Read
GetResourceExplorerSetup	resource-explorer-2:GetResourceExplorerSetup	Read
GetServiceIndex	resource-explorer-2:GetServiceIndex	Read
GetServiceView	resource-explorer-2:GetServiceView	Read
GetView	resource-explorer-2:GetView	Read
ListIndexes	resource-explorer-2:ListIndexes	List
ListIndexesForMembers	resource-explorer-2:ListIndexesForMembers	List
ListManagedViews	resource-explorer-2:ListManagedViews	List
ListResources	resource-explorer-2:Search	Read
ListServiceIndexes	resource-explorer-2:ListServiceIndexes	List
ListServiceViews	resource-explorer-2:ListServiceViews	List
ListStreamingAccessForServices	resource-explorer-2:ListStreamingAccessForServices	List
ListSupportedResourceTypes	resource-explorer-2:ListSupportedResourceTypes	List
ListTagsForResource	resource-explorer-2:ListTagsForResource	Read
ListViews	resource-explorer-2:ListViews	List
Search	resource-explorer-2:Search	Read
TagResource	resource-explorer-2:TagResource	Tagging, Write
UntagResource	resource-explorer-2:UntagResource	Tagging, Write
UpdateIndexType	resource-explorer-2:UpdateIndexType	Write
UpdateView	resource-explorer-2:UpdateView	Write

Actions defined by AWS Resource Explorer

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateDefaultView	Grants permission to set the specified view as the default for this AWS Region in this AWS account			Write
BatchGetView	Grants permission to retrieve details about views that you specify by a list of ARNs			Read
CreateIndex	Grants permission to turn on Resource Explorer in the AWS Region in which you called this operation by creating an index		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateResourceExplorerSetup	Grants permission to create resource explorer setup			Write
CreateView	Grants permission to create a view that users can query		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteIndex	Grants permission to turn off Resource Explorer in the specified AWS Region by deleting the index	index*	aws:ResourceTag/${TagKey}	Write
DeleteResourceExplorerSetup	Grants permission to delete resource explorer setup			Write
DeleteView	Grants permission to delete a view	view*	aws:ResourceTag/${TagKey}	Write
DisassociateDefaultView	Grants permission to remove the default view for the AWS Region in which you call this operation			Write
GetAccountLevelServiceConfiguration	Grants permission to Resource Explorer to access account level data within your AWS Organization			Read
GetDefaultView	Grants permission to retrieve the Amazon resource name (ARN) of the view that is the default for the AWS Region in which you call this operation			Read
GetIndex	Grants permission to retrieve information about the index in the AWS Region in which you call this operation			Read
GetManagedView	Grants permission to get managed view	managed-view*		Read
GetResourceExplorerSetup	Grants permission to get resource explorer setup			Read
GetServiceIndex	Grants permission to get service index			Read
GetServiceView	Grants permission to get service view			Read
GetView	Grants permission to retrieve information about the specified view	view*	aws:ResourceTag/${TagKey}	Read
ListIndexes	Grants permission to list the indexes in all AWS Regions			List
ListIndexesForMembers	Grants permission to list the organization member account's indexes in all AWS Regions			List
ListManagedViews	Grants permission to list managed views			List
ListServiceIndexes	Grants permission to list service indexes in all AWS Regions			List
ListServiceViews	Grants permission to list service views in all AWS Regions			List
ListStreamingAccessForServices	Grants permission to list streaming access for services			List
ListSupportedResourceTypes	Grants permission to retrieve a list of all resource types currently supported by Resource Explorer			List
ListTagsForResource	Grants permission to list the tags that are attached to the specified resource	index	aws:ResourceTag/${TagKey}	Read
ListTagsForResource		view	aws:ResourceTag/${TagKey}	Read
ListViews	Grants permission to list the Amazon resource names (ARNs) of all of the views available in the AWS Region in which you call this operation			List
Search	Grants permission to search for resources and display details about all resources that match the specified criteria	view*	aws:ResourceTag/${TagKey} resource-explorer-2:Operation	Read
TagResource	Grants permission to add one or more tag key and value pairs to the specified resource	index	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource		view	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove one or more tag key and value pairs from the specified resource	index	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource		view	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateIndexType	Grants permission to change the type of the index from LOCAL to AGGREGATOR or back	index*	aws:ResourceTag/${TagKey}	Write
UpdateView	Grants permission to modify some of the details of a view	view*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for AWS Resource Explorer

The following actions are defined by AWS Resource Explorer but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateManagedView	Grants permission to create managed view			Write
CreateStreamingAccessForService	Grants permission to create resource explorer streaming access			Write
DeleteResourcePolicy	Grants permission to delete the specified view's resource policy	view*	aws:ResourceTag/${TagKey}	Permissions management, Write
DeleteStreamingAccessForService	Grants permission to delete resource explorer streaming access			Write
GetResourcePolicy	Grants permission to retrieve information about the specified view's resource policy	view*	aws:ResourceTag/${TagKey}	Read
PutResourcePolicy	Grants permission to update the specified view's resource policy	view*	aws:ResourceTag/${TagKey}	Permissions management, Write

Resource types defined by AWS Resource Explorer

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
index	arn:${Partition}:resource-explorer-2:${Region}:${Account}:index/${IndexUuid}	aws:ResourceTag/${TagKey}
managed-view	arn:${Partition}:resource-explorer-2:${Region}:${Account}:managed-view/${ManagedViewName}/${ManagedViewUuid}
view	arn:${Partition}:resource-explorer-2:${Region}:${Account}:view/${ViewName}/${ViewUuid}	aws:ResourceTag/${TagKey}

Condition keys for AWS Resource Explorer

AWS Resource Explorer defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tag keys that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tag keyss attached to the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
resource-explorer-2:Operation	Filters access by the actual operation that is being invoked, available values: Search, ListResources	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Resource Access Manager (RAM) (ram)

AWS Resource Groups (resource-groups)