Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Route53 Global Resolver

AWS Route53 Global Resolver (service prefix: route53globalresolver) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Route53 Global Resolver
Actions defined by AWS Route53 Global Resolver
Permission-only actions for AWS Route53 Global Resolver
Resource types defined by AWS Route53 Global Resolver
Condition keys for AWS Route53 Global Resolver

API operations defined by AWS Route53 Global Resolver

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AssociateHostedZone	route53globalresolver:AssociateHostedZone	Write
BatchCreateFirewallRule	route53globalresolver:BatchCreateFirewallRule	Write
BatchDeleteFirewallRule	route53globalresolver:BatchDeleteFirewallRule	Write
BatchUpdateFirewallRule	route53globalresolver:BatchUpdateFirewallRule	Write
CreateAccessSource	route53globalresolver:CreateAccessSource	Write
CreateAccessSource	route53globalresolver:TagResource	Tagging, Write
CreateAccessToken	route53globalresolver:CreateAccessToken	Write
CreateAccessToken	route53globalresolver:TagResource	Tagging, Write
CreateDNSView	route53globalresolver:CreateDNSView	Write
CreateDNSView	route53globalresolver:TagResource	Tagging, Write
CreateFirewallDomainList	route53globalresolver:CreateFirewallDomainList	Write
CreateFirewallDomainList	route53globalresolver:TagResource	Tagging, Write
CreateFirewallRule	route53globalresolver:CreateFirewallRule	Write
CreateGlobalResolver	route53globalresolver:CreateGlobalResolver	Write
CreateGlobalResolver	route53globalresolver:TagResource	Tagging, Write
DeleteAccessSource	route53globalresolver:DeleteAccessSource	Write
DeleteAccessToken	route53globalresolver:DeleteAccessToken	Write
DeleteDNSView	route53globalresolver:DeleteDNSView	Write
DeleteFirewallDomainList	route53globalresolver:DeleteFirewallDomainList	Write
DeleteFirewallRule	route53globalresolver:DeleteFirewallRule	Write
DeleteGlobalResolver	route53globalresolver:DeleteGlobalResolver	Write
DisableDNSView	route53globalresolver:DisableDNSView	Write
DisassociateHostedZone	route53globalresolver:DisassociateHostedZone	Write
EnableDNSView	route53globalresolver:EnableDNSView	Write
GetAccessSource	route53globalresolver:GetAccessSource	Read
GetAccessToken	route53globalresolver:GetAccessToken	Read
GetDNSView	route53globalresolver:GetDNSView	Read
GetFirewallDomainList	route53globalresolver:GetFirewallDomainList	Read
GetFirewallRule	route53globalresolver:GetFirewallRule	Read
GetGlobalResolver	route53globalresolver:GetGlobalResolver	Read
GetHostedZoneAssociation	route53globalresolver:GetHostedZoneAssociation	Read
GetManagedFirewallDomainList	route53globalresolver:GetManagedFirewallDomainList	Read
ImportFirewallDomains	route53globalresolver:ImportFirewallDomains	Write
ListAccessSources	route53globalresolver:ListAccessSources	List
ListAccessTokens	route53globalresolver:ListAccessTokens	List
ListDNSViews	route53globalresolver:ListDNSViews	List
ListFirewallDomainLists	route53globalresolver:ListFirewallDomainLists	List
ListFirewallDomains	route53globalresolver:ListFirewallDomains	Read
ListFirewallRules	route53globalresolver:ListFirewallRules	List
ListGlobalResolvers	route53globalresolver:ListGlobalResolvers	List
ListHostedZoneAssociations	route53globalresolver:ListHostedZoneAssociations	List
ListManagedFirewallDomainLists	route53globalresolver:ListManagedFirewallDomainLists	List
ListTagsForResource	route53globalresolver:ListTagsForResource	Write
TagResource	route53globalresolver:TagResource	Tagging, Write
UntagResource	route53globalresolver:UntagResource	Tagging, Write
UpdateAccessSource	route53globalresolver:UpdateAccessSource	Write
UpdateAccessToken	route53globalresolver:UpdateAccessToken	Write
UpdateDNSView	route53globalresolver:UpdateDNSView	Write
UpdateFirewallDomains	route53globalresolver:UpdateFirewallDomains	Write
UpdateFirewallRule	route53globalresolver:UpdateFirewallRule	Write
UpdateGlobalResolver	route53globalresolver:UpdateGlobalResolver	Write
UpdateHostedZoneAssociation	route53globalresolver:UpdateHostedZoneAssociation	Write

Actions defined by AWS Route53 Global Resolver

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateHostedZone	Grants permission to associate a resource to a hosted zone			Write
BatchCreateFirewallRule	Grants permission to create multiple firewall rules			Write
BatchDeleteFirewallRule	Grants permission to delete multiple firewall rules			Write
BatchUpdateFirewallRule	Grants permission to update multiple firewall rules			Write
CreateAccessSource	Grants permission to create an access source	dns-view*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAccessToken	Grants permission to create an access token	access-token*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDNSView	Grants permission to create a dns view	dns-view*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFirewallDomainList	Grants permission to create a firewall domain list	firewall-domain-list*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFirewallRule	Grants permission to create a firewall rule	dns-view*	aws:ResourceTag/${TagKey}	Write
CreateFirewallRule	Grants permission to create a firewall rule	firewall-domain-list	aws:ResourceTag/${TagKey}	Write
CreateGlobalResolver	Grants permission to create a global resolver	global-resolver*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAccessSource	Grants permission to delete an access source	access-source*	aws:ResourceTag/${TagKey}	Write
DeleteAccessToken	Grants permission to delete an access token	access-token*	aws:ResourceTag/${TagKey}	Write
DeleteDNSView	Grants permission to delete a dns view	dns-view*	aws:ResourceTag/${TagKey}	Write
DeleteFirewallDomainList	Grants permission to delete a firewall domain list	firewall-domain-list*	aws:ResourceTag/${TagKey}	Write
DeleteFirewallRule	Grants permission to delete a firewall rule			Write
DeleteGlobalResolver	Grants permission to delete a global resolver	global-resolver*	aws:ResourceTag/${TagKey}	Write
DisableDNSView	Grants permission to disable a dns view	dns-view*	aws:ResourceTag/${TagKey}	Write
DisassociateHostedZone	Grants permission to disassociate a hosted zone from a resource			Write
EnableDNSView	Grants permission to enable a dns view	dns-view*	aws:ResourceTag/${TagKey}	Write
GetAccessSource	Grants permission to get an access source	access-source*	aws:ResourceTag/${TagKey}	Read
GetAccessToken	Grants permission to get an access token	access-token*	aws:ResourceTag/${TagKey}	Read
GetDNSView	Grants permission to get a dns view	dns-view*	aws:ResourceTag/${TagKey}	Read
GetFirewallDomainList	Grants permission to get a firewall domain list	firewall-domain-list*	aws:ResourceTag/${TagKey}	Read
GetFirewallRule	Grants permission to get a firewall rule			Read
GetGlobalResolver	Grants permission to get a global resolver	global-resolver*	aws:ResourceTag/${TagKey}	Read
GetHostedZoneAssociation	Grants permission to get a hosted zone association			Read
GetManagedFirewallDomainList	Grants permission to get a managed firewall domain list			Read
ImportFirewallDomains	Grants permission to import firewall domains from an S3 bucket	firewall-domain-list*	aws:ResourceTag/${TagKey}	Write
ListAccessSources	Grants permission to list access sources			List
ListAccessTokens	Grants permission to list access tokens			List
ListDNSViews	Grants permission to list dns views			List
ListFirewallDomainLists	Grants permission to list firewall domain lists			List
ListFirewallDomains	Grants permission to list firewall domains	firewall-domain-list*	aws:ResourceTag/${TagKey}	Read
ListFirewallRules	Grants permission to list firewall rules	dns-view*	aws:ResourceTag/${TagKey}	List
ListGlobalResolvers	Grants permission to list global resolvers			List
ListHostedZoneAssociations	Grants permission to list hosted zone associations			List
ListManagedFirewallDomainLists	Grants permission to list managed firewall domain lists			List
ListTagsForResource	Grants permission to list tags for a resource	access-source	aws:ResourceTag/${TagKey}	Write
		access-token	aws:ResourceTag/${TagKey}
		dns-view	aws:ResourceTag/${TagKey}
		firewall-domain-list	aws:ResourceTag/${TagKey}
		global-resolver	aws:ResourceTag/${TagKey}
TagResource	Grants permission to tag a resource	access-source	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		access-token	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		dns-view	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		firewall-domain-list	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		global-resolver	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag a resource	access-source	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		access-token	aws:ResourceTag/${TagKey} aws:TagKeys
		dns-view	aws:ResourceTag/${TagKey} aws:TagKeys
		firewall-domain-list	aws:ResourceTag/${TagKey} aws:TagKeys
		global-resolver	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAccessSource	Grants permission to update an access source	access-source*	aws:ResourceTag/${TagKey}	Write
UpdateAccessToken	Grants permission to update an access token	access-token*	aws:ResourceTag/${TagKey}	Write
UpdateDNSView	Grants permission to update a dns view	dns-view*	aws:ResourceTag/${TagKey}	Write
UpdateFirewallDomains	Grants permission to update firewall domains	firewall-domain-list*	aws:ResourceTag/${TagKey}	Write
UpdateFirewallRule	Grants permission to update an firewall rule			Write
UpdateGlobalResolver	Grants permission to update a global resolver	global-resolver*	aws:ResourceTag/${TagKey}	Write
UpdateHostedZoneAssociation	Grants permission to update a hosted zone association			Write

Permission-only actions for AWS Route53 Global Resolver

The following actions are defined by AWS Route53 Global Resolver but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AllowVendedLogDeliveryForResource	Grants permission to deliver logs for a global resolver	global-resolver*	aws:ResourceTag/${TagKey}	Permissions management, Write

Resource types defined by AWS Route53 Global Resolver

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
access-source	arn:${Partition}:route53globalresolver::${Account}:access-source/${Id}	aws:ResourceTag/${TagKey}
access-token	arn:${Partition}:route53globalresolver::${Account}:access-token/${Id}	aws:ResourceTag/${TagKey}
dns-view	arn:${Partition}:route53globalresolver::${Account}:dns-view/${Id}	aws:ResourceTag/${TagKey}
firewall-domain-list	arn:${Partition}:route53globalresolver::${Account}:firewall-domain-list/${Id}	aws:ResourceTag/${TagKey}
global-resolver	arn:${Partition}:route53globalresolver::${Account}:global-resolver/${Id}	aws:ResourceTag/${TagKey}

Condition keys for AWS Route53 Global Resolver

AWS Route53 Global Resolver defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a tag key and value pair that is allowed in the request	String
aws:ResourceTag/${TagKey}	Filters access by a tag key and value pair of a resource	String
aws:TagKeys	Filters access by a list of tag keys that are allowed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS RoboMaker (robomaker)

AWS RTB Fabric (rtbfabric)