Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Well-Architected Tool

AWS Well-Architected Tool (service prefix: wellarchitected) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Well-Architected Tool
Actions defined by AWS Well-Architected Tool
Permission-only actions for AWS Well-Architected Tool
Resource types defined by AWS Well-Architected Tool
Condition keys for AWS Well-Architected Tool

API operations defined by AWS Well-Architected Tool

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AssociateLenses	wellarchitected:AssociateLenses	Write
AssociateProfiles	wellarchitected:AssociateProfiles	Write
CreateLensShare	wellarchitected:CreateLensShare	Write
CreateLensVersion	wellarchitected:CreateLensVersion	Write
CreateMilestone	wellarchitected:CreateMilestone	Write
CreateProfile	wellarchitected:CreateProfile	Write
CreateProfile	wellarchitected:TagResource	Tagging, Write
CreateProfileShare	wellarchitected:CreateProfileShare	Write
CreateReviewTemplate	wellarchitected:CreateReviewTemplate	Write
CreateReviewTemplate	wellarchitected:TagResource	Tagging, Write
CreateTemplateShare	wellarchitected:CreateTemplateShare	Write
CreateWorkload	wellarchitected:CreateWorkload	Write
	wellarchitected:GetReviewTemplate	Read
	wellarchitected:GetReviewTemplateAnswer	Read
	wellarchitected:GetReviewTemplateLensReview	Read
	wellarchitected:ListReviewTemplateAnswers	List
	wellarchitected:TagResource	Tagging, Write
CreateWorkloadShare	wellarchitected:CreateWorkloadShare	Write
DeleteLens	wellarchitected:DeleteLens	Write
DeleteLensShare	wellarchitected:DeleteLensShare	Write
DeleteProfile	wellarchitected:DeleteProfile	Write
DeleteProfileShare	wellarchitected:DeleteProfileShare	Write
DeleteReviewTemplate	wellarchitected:DeleteReviewTemplate	Write
DeleteTemplateShare	wellarchitected:DeleteTemplateShare	Write
DeleteWorkload	wellarchitected:DeleteWorkload	Write
DeleteWorkloadShare	wellarchitected:DeleteWorkloadShare	Write
DisassociateLenses	wellarchitected:DisassociateLenses	Write
DisassociateProfiles	wellarchitected:DisassociateProfiles	Write
ExportLens	wellarchitected:ExportLens	Read
GetAnswer	wellarchitected:GetAnswer	Read
GetConsolidatedReport	wellarchitected:GetConsolidatedReport	Read
GetGlobalSettings	wellarchitected:GetGlobalSettings	Read
GetLens	wellarchitected:GetLens	Read
GetLensReview	wellarchitected:GetLensReview	Read
GetLensReviewReport	wellarchitected:GetLensReviewReport	Read
GetLensVersionDifference	wellarchitected:GetLensVersionDifference	Read
GetMilestone	wellarchitected:GetMilestone	Read
GetProfile	wellarchitected:GetProfile	Read
GetProfileTemplate	wellarchitected:GetProfileTemplate	Read
GetReviewTemplate	wellarchitected:GetReviewTemplate	Read
GetReviewTemplateAnswer	wellarchitected:GetReviewTemplateAnswer	Read
GetReviewTemplateLensReview	wellarchitected:GetReviewTemplateLensReview	Read
GetWorkload	wellarchitected:GetWorkload	Read
ImportLens	wellarchitected:ImportLens	Write
ImportLens	wellarchitected:TagResource	Tagging, Write
ListAnswers	wellarchitected:ListAnswers	List
ListCheckDetails	wellarchitected:ListCheckDetails	List
ListCheckSummaries	wellarchitected:ListCheckSummaries	List
ListLensReviewImprovements	wellarchitected:ListLensReviewImprovements	List
ListLensReviews	wellarchitected:ListLensReviews	List
ListLensShares	wellarchitected:ListLensShares	List
ListLenses	wellarchitected:ListLenses	List
ListMilestones	wellarchitected:ListMilestones	List
ListNotifications	wellarchitected:ListNotifications	List
ListProfileNotifications	wellarchitected:ListProfileNotifications	List
ListProfileShares	wellarchitected:ListProfileShares	List
ListProfiles	wellarchitected:ListProfiles	List
ListReviewTemplateAnswers	wellarchitected:ListReviewTemplateAnswers	List
ListReviewTemplates	wellarchitected:ListReviewTemplates	List
ListShareInvitations	wellarchitected:ListShareInvitations	List
ListTagsForResource	wellarchitected:ListTagsForResource	Read
ListTemplateShares	wellarchitected:ListTemplateShares	List
ListWorkloadShares	wellarchitected:ListWorkloadShares	List
ListWorkloads	wellarchitected:ListWorkloads	List
TagResource	wellarchitected:TagResource	Tagging, Write
UntagResource	wellarchitected:UntagResource	Tagging, Write
UpdateAnswer	wellarchitected:UpdateAnswer	Write
UpdateGlobalSettings	wellarchitected:UpdateGlobalSettings	Write
UpdateIntegration	wellarchitected:UpdateIntegration	Write
UpdateLensReview	wellarchitected:UpdateLensReview	Write
UpdateProfile	wellarchitected:UpdateProfile	Write
UpdateReviewTemplate	wellarchitected:UpdateReviewTemplate	Write
UpdateReviewTemplateAnswer	wellarchitected:UpdateReviewTemplateAnswer	Write
UpdateReviewTemplateLensReview	wellarchitected:UpdateReviewTemplateLensReview	Write
UpdateShareInvitation	wellarchitected:UpdateShareInvitation	Write
UpdateWorkload	wellarchitected:UpdateWorkload	Write
UpdateWorkloadShare	wellarchitected:UpdateWorkloadShare	Write
UpgradeLensReview	wellarchitected:UpgradeLensReview	Write
UpgradeProfileVersion	wellarchitected:UpgradeProfileVersion	Write
UpgradeReviewTemplateLensReview	wellarchitected:UpgradeReviewTemplateLensReview	Write

Actions defined by AWS Well-Architected Tool

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateLenses	Grants permission to associate a lens to the specified workload	workload*	aws:ResourceTag/${TagKey}	Write
AssociateProfiles	Grants permission to associate a profile to the specified workload	workload*	aws:ResourceTag/${TagKey}	Write
CreateAgentContext	Grants permission to create a context associated with a profile	agent-profile*	aws:ResourceTag/${TagKey}	Write
CreateAgentGoal	Grants permission to create a goal associated with a profile	agent-profile*	aws:ResourceTag/${TagKey}	Write
CreateAgentProfile	Grants permission to create an agent profile		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLensShare	Grants permission to an owner of a lens to share with other AWS accounts and IAM users	lens*	aws:ResourceTag/${TagKey}	Write
CreateLensVersion	Grants permission to create a new lens version	lens*	aws:ResourceTag/${TagKey}	Write
CreateMilestone	Grants permission to create a new milestone for the specified workload	workload*	aws:ResourceTag/${TagKey}	Write
CreateProfile	Grants permission to create a new profile		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateProfileShare	Grants permission to an owner of a profile to share with other AWS accounts and IAM users	profile*	aws:ResourceTag/${TagKey}	Write
CreateReviewTemplate	Grants permission to create a new review template		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateTemplateShare	Grants permission to an owner of a review template to share with other AWS accounts and IAM users	review-template*	aws:ResourceTag/${TagKey}	Write
CreateWorkload	Grants permission to create a new workload		aws:RequestTag/${TagKey} aws:TagKeys wellarchitected:JiraProjectKey	Write
CreateWorkloadShare	Grants permission to share a workload with another account	workload*	aws:ResourceTag/${TagKey}	Write
DeleteAgentContext	Grants permission to delete a context associated with a profile	agent-profile*	aws:ResourceTag/${TagKey}	Write
DeleteAgentGoal	Grants permission to delete a goal associated with a profile	agent-profile*	aws:ResourceTag/${TagKey}	Write
DeleteAgentProfile	Grants permission to delete an agent profile	agent-profile*	aws:ResourceTag/${TagKey}	Write
DeleteLens	Grants permission to delete a lens	lens*	aws:ResourceTag/${TagKey}	Write
DeleteLensShare	Grants permission to delete an existing lens share	lens*	aws:ResourceTag/${TagKey}	Write
DeleteProfile	Grants permission to delete a profile	profile*	aws:ResourceTag/${TagKey}	Write
DeleteProfileShare	Grants permission to delete an existing profile share	profile*	aws:ResourceTag/${TagKey}	Write
DeleteReviewTemplate	Grants permission to delete an existing review template	review-template*	aws:ResourceTag/${TagKey}	Write
DeleteTemplateShare	Grants permission to delete an existing review template share	review-template*	aws:ResourceTag/${TagKey}	Write
DeleteWorkload	Grants permission to delete an existing workload	workload*	aws:ResourceTag/${TagKey}	Write
DeleteWorkloadShare	Grants permission to delete an existing workload share	workload*	aws:ResourceTag/${TagKey}	Write
DisassociateLenses	Grants permission to disassociate a lens from the specified workload	workload*	aws:ResourceTag/${TagKey}	Write
DisassociateProfiles	Grants permission to disassociate a profile from the specified workload	workload*	aws:ResourceTag/${TagKey}	Write
ExportLens	Grants permission to export an existing lens	lens*	aws:ResourceTag/${TagKey}	Read
GetAgentContext	Grants permission to get context associated with a profile	agent-profile*	aws:ResourceTag/${TagKey}	Read
GetAgentGoal	Grants permission to get goal associated with a profile	agent-profile*	aws:ResourceTag/${TagKey}	Read
GetAgentProfile	Grants permission to get agent profile by profile arn	agent-profile*	aws:ResourceTag/${TagKey}	Read
GetAgentRecommendation	Grants permission to get a recommendation by recommendation ARN	agent-recommendation*	aws:ResourceTag/${TagKey}	Read
GetAgentRecommendationGeneration	Grants permission to get a recommendation generation	agent-profile*	aws:ResourceTag/${TagKey}	Read
GetAnswer	Grants permission to retrieve the specified answer from the specified lens review	workload*	aws:ResourceTag/${TagKey}	Read
GetConsolidatedReport	Grants permission to get consolidated report metrics or to generate the consolidated report PDF in this account			Read
GetGlobalSettings	Grants permission to get all settings for the account			Read
GetLens	Grants permission to get an existing lens	lens*	aws:ResourceTag/${TagKey}	Read
GetLensReview	Grants permission to retrieve the specified lens review of the specified workload	workload*	aws:ResourceTag/${TagKey}	Read
GetLensReviewReport	Grants permission to retrieve the report for the specified lens review	workload*	aws:ResourceTag/${TagKey}	Read
GetLensVersionDifference	Grants permission to get the difference between the specified lens version and latest available lens version	lens*	aws:ResourceTag/${TagKey}	Read
GetMilestone	Grants permission to retrieve the specified milestone of the specified workload	workload*	aws:ResourceTag/${TagKey}	Read
GetProfile	Grants permission to retrieve the specified profile	profile*	aws:ResourceTag/${TagKey}	Read
GetProfileTemplate	Grants permission to retrieve the specified profile template			Read
GetReviewTemplate	Grants permission to retrieve the specified review template	review-template*	aws:ResourceTag/${TagKey}	Read
GetReviewTemplateAnswer	Grants permission to retrieve the specified answer from the specified review template lens review	review-template*	aws:ResourceTag/${TagKey}	Read
GetReviewTemplateLensReview	Grants permission to retrieve the specified lens review of the specified review template	review-template*	aws:ResourceTag/${TagKey}	Read
GetWorkload	Grants permission to retrieve the specified workload	workload*	aws:ResourceTag/${TagKey}	Read
ImportLens	Grants permission to import a new lens		aws:RequestTag/${TagKey} aws:TagKeys	Write
ListAgentContexts	Grants permission to list contexts associated with a profile by filters on the fields	agent-profile*	aws:ResourceTag/${TagKey}	Read
ListAgentGoals	Grants permission to list goals associated with a profile by filters on the fields	agent-profile*	aws:ResourceTag/${TagKey}	Read
ListAgentProfiles	Grants permission to list agent profiles			Read
ListAgentRecommendationGenerations	Grants permission to list recommendation generations	agent-profile*	aws:ResourceTag/${TagKey}	Read
ListAgentRecommendationItems	Grants permission to list recommendation items associated with a recommendation	agent-recommendation*	aws:ResourceTag/${TagKey}	Read
ListAgentRecommendations	Grants permission to list recommendations by profile ARN	agent-profile*	aws:ResourceTag/${TagKey}	Read
ListAnswers	Grants permission to list the answers from the specified lens review	workload*	aws:ResourceTag/${TagKey}	List
ListCheckDetails	Grants permission to list the check-details for the workload	workload*	aws:ResourceTag/${TagKey}	List
ListCheckSummaries	Grants permission to list the check-summaries for the workload	workload*	aws:ResourceTag/${TagKey}	List
ListLensReviewImprovements	Grants permission to list the improvements of the specified lens review	workload*	aws:ResourceTag/${TagKey}	List
ListLensReviews	Grants permission to list the lens reviews of the specified workload	workload*	aws:ResourceTag/${TagKey}	List
ListLensShares	Grants permission to list all shares created for a lens	lens*	aws:ResourceTag/${TagKey}	List
ListLenses	Grants permission to list the lenses available to this account			List
ListMilestones	Grants permission to list the milestones of the specified workload	workload*	aws:ResourceTag/${TagKey}	List
ListNotifications	Grants permission to list notifications related to the account or specified resource			List
ListProfileNotifications	Grants permission to list profile notifications related to specified resource			List
ListProfileShares	Grants permission to list all shares created for a profile	profile*	aws:ResourceTag/${TagKey}	List
ListProfiles	Grants permission to list the profiles available to this account			List
ListReviewTemplateAnswers	Grants permission to list the answers from the specified review template lens review	review-template*	aws:ResourceTag/${TagKey}	List
ListReviewTemplates	Grants permission to list the review templates available to this account			List
ListShareInvitations	Grants permission to list the workload share invitations of the specified account or user			List
ListTagsForResource	Grants permission to list tags for a Well-Architected resource	agent-profile	aws:ResourceTag/${TagKey}	Read
		agent-recommendation	aws:ResourceTag/${TagKey}
		lens	aws:ResourceTag/${TagKey}
		profile	aws:ResourceTag/${TagKey}
		review-template	aws:ResourceTag/${TagKey}
		workload	aws:ResourceTag/${TagKey}
ListTemplateShares	Grants permission to list all shares created for a review template	review-template*	aws:ResourceTag/${TagKey}	List
ListWorkloadShares	Grants permission to list the workload shares of the specified workload	workload*	aws:ResourceTag/${TagKey}	List
ListWorkloads	Grants permission to list the workloads in this account			List
PutAgentRecommendationFeedback	Grants permission to put feedback on a recommendation	agent-recommendation*	aws:ResourceTag/${TagKey}	Write
StartAgentRecommendationGeneration	Grants permission to start a recommendation generation process	agent-profile*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag a Well-Architected resource	agent-profile	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		agent-recommendation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		lens	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		profile	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		review-template	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workload	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag a Well-Architected resource	agent-profile	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		agent-recommendation	aws:ResourceTag/${TagKey} aws:TagKeys
		lens	aws:ResourceTag/${TagKey} aws:TagKeys
		profile	aws:ResourceTag/${TagKey} aws:TagKeys
		review-template	aws:ResourceTag/${TagKey} aws:TagKeys
		workload	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAgentContext	Grants permission to update a context associated with a profile	agent-profile*	aws:ResourceTag/${TagKey}	Write
UpdateAgentGoal	Grants permission to update a goal associated with a profile	agent-profile*	aws:ResourceTag/${TagKey}	Write
UpdateAgentProfile	Grants permission to update an agent profile	agent-profile*	aws:ResourceTag/${TagKey}	Write
UpdateAgentRecommendationStatus	Grants permission to update the status of a recommendation	agent-recommendation*	aws:ResourceTag/${TagKey}	Write
UpdateAnswer	Grants permission to update properties of the specified answer	workload*	aws:ResourceTag/${TagKey}	Write
UpdateGlobalSettings	Grants permission to manage all settings for the account		wellarchitected:JiraProjectKey	Write
UpdateIntegration	Grants permission to update properties of the integration	workload*	aws:ResourceTag/${TagKey}	Write
UpdateLensReview	Grants permission to update properties of the specified lens review	workload*	aws:ResourceTag/${TagKey}	Write
UpdateProfile	Grants permission to update properties of the specified profile	profile*	aws:ResourceTag/${TagKey}	Write
UpdateReviewTemplate	Grants permission to update properties of the specified review template	review-template*	aws:ResourceTag/${TagKey}	Write
UpdateReviewTemplateAnswer	Grants permission to update properties of the specified review template answer	review-template*	aws:ResourceTag/${TagKey}	Write
UpdateReviewTemplateLensReview	Grants permission to update properties of the specified review template lens review	review-template*	aws:ResourceTag/${TagKey}	Write
UpdateShareInvitation	Grants permission to update status of the specified workload share invitation			Write
UpdateWorkload	Grants permission to update properties of the specified workload	workload*	aws:ResourceTag/${TagKey} wellarchitected:JiraProjectKey	Write
UpdateWorkloadShare	Grants permission to update properties of the specified workload share	workload*	aws:ResourceTag/${TagKey}	Write
UpgradeLensReview	Grants permission to upgrade the specified lens review to use the latest version of the associated lens	workload*	aws:ResourceTag/${TagKey}	Write
UpgradeProfileVersion	Grants permission to upgrade the specified workload to use the latest version of the associated profile	profile*	aws:ResourceTag/${TagKey}	Write
UpgradeProfileVersion		workload*	aws:ResourceTag/${TagKey}	Write
UpgradeReviewTemplateLensReview	Grants permission to upgrade the specified lens review of the specified review template	review-template*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for AWS Well-Architected Tool

The following actions are defined by AWS Well-Architected Tool but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
ConfigureIntegration	Grants permission to configure the integration			Write

Resource types defined by AWS Well-Architected Tool

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
agent-profile	arn:${Partition}:wellarchitected:${Region}:${Account}:agent-profile/${ProfileName}	aws:ResourceTag/${TagKey}
agent-recommendation	arn:${Partition}:wellarchitected:${Region}:${Account}:agent-recommendation/${ResourceId}	aws:ResourceTag/${TagKey}
lens	arn:${Partition}:wellarchitected:${Region}:${Account}:lens/${ResourceId}	aws:ResourceTag/${TagKey}
profile	arn:${Partition}:wellarchitected:${Region}:${Account}:profile/${ResourceId}	aws:ResourceTag/${TagKey}
review-template	arn:${Partition}:wellarchitected:${Region}:${Account}:review-template/${ResourceId}	aws:ResourceTag/${TagKey}
workload	arn:${Partition}:wellarchitected:${Region}:${Account}:workload/${ResourceId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Well-Architected Tool

AWS Well-Architected Tool defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by tag keys in the request	ArrayOfString
wellarchitected:JiraProjectKey	Filters access by project key	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS WAF V2 (wafv2)

AWS Wickr (wickr)