Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Supply Chain

AWS Supply Chain (service prefix: scn) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Supply Chain
Actions defined by AWS Supply Chain
Resource types defined by AWS Supply Chain
Condition keys for AWS Supply Chain

API operations defined by AWS Supply Chain

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
CreateBillOfMaterialsImportJob	scn:CreateBillOfMaterialsImportJob	Write
CreateDataIntegrationFlow	scn:CreateDataIntegrationFlow	Write
CreateDataIntegrationFlow	scn:TagResource	Tagging, Write
CreateDataLakeDataset	scn:CreateDataLakeDataset	Write
CreateDataLakeDataset	scn:TagResource	Tagging, Write
CreateDataLakeNamespace	scn:CreateDataLakeNamespace	Write
CreateDataLakeNamespace	scn:TagResource	Tagging, Write
CreateInstance	scn:CreateInstance	Write
CreateInstance	scn:TagResource	Tagging, Write
DeleteDataIntegrationFlow	scn:DeleteDataIntegrationFlow	Write
DeleteDataLakeDataset	scn:DeleteDataLakeDataset	Write
DeleteDataLakeNamespace	scn:DeleteDataLakeNamespace	Write
DeleteInstance	scn:DeleteInstance	Write
GetBillOfMaterialsImportJob	scn:GetBillOfMaterialsImportJob	Read
GetDataIntegrationEvent	scn:GetDataIntegrationEvent	Read
GetDataIntegrationFlow	scn:GetDataIntegrationFlow	Read
GetDataIntegrationFlowExecution	scn:GetDataIntegrationFlowExecution	Read
GetDataLakeDataset	scn:GetDataLakeDataset	Read
GetDataLakeNamespace	scn:GetDataLakeNamespace	Read
GetInstance	scn:GetInstance	Read
ListDataIntegrationEvents	scn:ListDataIntegrationEvents	List
ListDataIntegrationFlowExecutions	scn:ListDataIntegrationFlowExecutions	List
ListDataIntegrationFlows	scn:ListDataIntegrationFlows	List
ListDataLakeDatasets	scn:ListDataLakeDatasets	List
ListDataLakeNamespaces	scn:ListDataLakeNamespaces	List
ListInstances	scn:ListInstances	List
ListTagsForResource	scn:ListTagsForResource	List
SendDataIntegrationEvent	scn:SendDataIntegrationEvent	Write
TagResource	scn:TagResource	Tagging, Write
UntagResource	scn:UntagResource	Tagging, Write
UpdateDataIntegrationFlow	scn:UpdateDataIntegrationFlow	Write
UpdateDataLakeDataset	scn:UpdateDataLakeDataset	Write
UpdateDataLakeNamespace	scn:UpdateDataLakeNamespace	Write
UpdateInstance	scn:UpdateInstance	Write

Actions defined by AWS Supply Chain

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssignAdminPermissionsToUser	Grants permission to add AWS Supply Chain administrator permission to federated user	instance*	aws:ResourceTag/${TagKey}	Write
CreateBillOfMaterialsImportJob	Grants permission to create a BillOfMaterialsImportJob which will import a CSV file of BillOfMaterials records	instance*	aws:ResourceTag/${TagKey}	Write
CreateDataIntegrationFlow	Grants permission to create DataIntegrationFlow that can transform from multiple sources to one target	instance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDataLakeDataset	Grants permission to create the data lake dataset	instance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDataLakeNamespace	Grants permission to create the data lake namespace	instance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateInstance	Grants permission to create a new AWS Supply Chain instance	instance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSSOApplication	Grants permission to create IAM Identity Center application for a AWS Supply Chain instance	instance*	aws:ResourceTag/${TagKey}	Write
DeleteDataIntegrationFlow	Grants permission to delete the DataIntegrationFlow	data-integration-flow*	aws:ResourceTag/${TagKey}	Write
DeleteDataLakeDataset	Grants permission to delete the data lake dataset	dataset*	aws:ResourceTag/${TagKey}	Write
DeleteDataLakeNamespace	Grants permission to delete the data lake namespace	namespace*	aws:ResourceTag/${TagKey}	Write
DeleteInstance	Grants permission to delete an AWS Supply Chain instance	instance*	aws:ResourceTag/${TagKey}	Write
DeleteSSOApplication	Grants permission to delete IAM Identity Center application of the AWS Supply Chain instance	instance*	aws:ResourceTag/${TagKey}	Write
DescribeInstance	Grants permission to view details of an AWS Supply Chain instance	instance*	aws:ResourceTag/${TagKey}	Read
GetBillOfMaterialsImportJob	Grants permission to view status and details of a BillOfMaterialsImportJob	bill-of-materials-import-job*		Read
GetDataIntegrationEvent	Grants permission to get a DataIntegrationEvent	instance*	aws:ResourceTag/${TagKey}	Read
GetDataIntegrationFlow	Grants permission to get the DataIntegrationFlow details	data-integration-flow*	aws:ResourceTag/${TagKey}	Read
GetDataIntegrationFlowExecution	Grants permission to get a particular execution of one specified DataIntegrationFlow	data-integration-flow*	aws:ResourceTag/${TagKey}	Read
GetDataLakeDataset	Grants permission to get the dataset details	dataset*	aws:ResourceTag/${TagKey}	Read
GetDataLakeNamespace	Grants permission to get the namespace details	namespace*	aws:ResourceTag/${TagKey}	Read
GetInstance	Grants permission to view details of an AWS Supply Chain instance	instance*	aws:ResourceTag/${TagKey}	Read
ListAdminUsers	Grants permission to list AWS Supply Chain administrators of an instance	instance*	aws:ResourceTag/${TagKey}	List
ListDataIntegrationEvents	Grants permission to list all DataIntegrationEvents under an instance	instance*	aws:ResourceTag/${TagKey}	List
ListDataIntegrationFlowExecutions	Grants permission to list all executions of one specified DataIntegrationFlow	data-integration-flow*	aws:ResourceTag/${TagKey}	List
ListDataIntegrationFlows	Grants permission to list all the DataIntegrationFlows in a paginated way	instance*	aws:ResourceTag/${TagKey}	List
ListDataLakeDatasets	Grants permission to list the data lake datasets under specific instance or namespace	instance*	aws:ResourceTag/${TagKey}	List
ListDataLakeNamespaces	Grants permission to list the data lake namespaces under specific instance	instance*	aws:ResourceTag/${TagKey}	List
ListInstances	Grants permission to view the AWS Supply Chain instances associated with an AWS account	instance*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags for an AWS Supply Chain resource	instance*	aws:ResourceTag/${TagKey}	List
RemoveAdminPermissionsForUser	Grants permission to remove AWS Supply Chain administrator permission from federated user	instance*	aws:ResourceTag/${TagKey}	Write
SendDataIntegrationEvent	Grants permission to create a DataIntegrationEvent which will ingest data in real-time	instance*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag an AWS Supply Chain resource	instance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tag from an AWS Supply Chain resource	instance*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateDataIntegrationFlow	Grants permission to update the DataIntegrationFlow	data-integration-flow*	aws:ResourceTag/${TagKey}	Write
UpdateDataLakeDataset	Grants permission to update the data lake dataset	dataset*	aws:ResourceTag/${TagKey}	Write
UpdateDataLakeNamespace	Grants permission to update the data lake namespace	namespace*	aws:ResourceTag/${TagKey}	Write
UpdateInstance	Grants permission to update an AWS Supply Chain instance	instance*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS Supply Chain

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
bill-of-materials-import-job	arn:${Partition}:scn:${Region}:${Account}:instance/${InstanceId}/bill-of-materials-import-job/${JobId}
data-integration-flow	arn:${Partition}:scn:${Region}:${Account}:instance/${InstanceId}/data-integration-flows/${FlowName}	aws:ResourceTag/${TagKey}
dataset	arn:${Partition}:scn:${Region}:${Account}:instance/${InstanceId}/namespaces/${Namespace}/datasets/${DatasetName}	aws:ResourceTag/${TagKey}
instance	arn:${Partition}:scn:${Region}:${Account}:instance/${InstanceId}	aws:ResourceTag/${TagKey}
namespace	arn:${Partition}:scn:${Region}:${Account}:instance/${InstanceId}/namespaces/${Namespace}	aws:ResourceTag/${TagKey}

Condition keys for AWS Supply Chain

AWS Supply Chain defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by using tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by using tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by using tag keys in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Storage Gateway (storagegateway)

AWS Sustainability (sustainability)