Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon WorkDocs

Amazon WorkDocs (service prefix: workdocs) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon WorkDocs
Actions defined by Amazon WorkDocs
Permission-only actions for Amazon WorkDocs
Resource types defined by Amazon WorkDocs
Condition keys for Amazon WorkDocs

API operations defined by Amazon WorkDocs

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AbortDocumentVersionUpload	workdocs:AbortDocumentVersionUpload	Write
ActivateUser	workdocs:ActivateUser	Write
AddResourcePermissions	workdocs:AddResourcePermissions	Write
CreateComment	workdocs:CreateComment	Write
CreateCustomMetadata	workdocs:CreateCustomMetadata	Write
CreateFolder	workdocs:CreateFolder	Write
CreateLabels	workdocs:CreateLabels	Write
CreateNotificationSubscription	workdocs:CreateNotificationSubscription	Write
CreateUser	workdocs:CreateUser	Write
DeactivateUser	workdocs:DeactivateUser	Write
DeleteCustomMetadata	workdocs:DeleteCustomMetadata	Write
DeleteDocument	workdocs:DeleteDocument	Write
DeleteDocumentVersion	workdocs:DeleteDocumentVersion	Write
DeleteFolder	workdocs:DeleteFolder	Write
DeleteFolderContents	workdocs:DeleteFolderContents	Write
DeleteLabels	workdocs:DeleteLabels	Write
DeleteNotificationSubscription	workdocs:DeleteNotificationSubscription	Write
DeleteUser	workdocs:DeleteUser	Write
DescribeActivities	workdocs:DescribeActivities	List
DescribeComments	workdocs:DescribeComments	List
DescribeDocumentVersions	workdocs:DescribeDocumentVersions	List
DescribeFolderContents	workdocs:DescribeFolderContents	List
DescribeGroups	workdocs:DescribeGroups	List
DescribeNotificationSubscriptions	workdocs:DescribeNotificationSubscriptions	List
DescribeResourcePermissions	workdocs:DescribeResourcePermissions	List
DescribeUsers	workdocs:DescribeUsers	List
GetDocument	workdocs:GetDocument	Read
GetDocumentPath	workdocs:GetDocumentPath	Read
GetDocumentVersion	workdocs:DownloadDocumentVersion	Read
GetDocumentVersion	workdocs:GetDocumentVersion	Read
GetFolder	workdocs:GetFolder	Read
GetFolderPath	workdocs:GetFolderPath	Read
GetResources	workdocs:GetResources	Read
InitiateDocumentVersionUpload	workdocs:InitiateDocumentVersionUpload	Write
RemoveAllResourcePermissions	workdocs:RemoveAllResourcePermissions	Write
RemoveResourcePermission	workdocs:RemoveResourcePermission	Write
RestoreDocumentVersions	workdocs:RestoreDocumentVersions	Write
SearchResources	workdocs:SearchResources	List
UpdateDocument	workdocs:DeleteDocument	Write
	workdocs:InitiateDocumentVersionUpload	Write
	workdocs:UpdateDocument	Write
UpdateDocumentVersion	workdocs:UpdateDocumentVersion	Write
UpdateFolder	workdocs:CreateFolder	Write
UpdateFolder	workdocs:UpdateFolder	Write
UpdateUser	workdocs:UpdateUser	Write
UpdateUser	workdocs:UpdateUserAdministrativeSettings	Write

Actions defined by Amazon WorkDocs

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Access level
AbortDocumentVersionUpload	Grants permission to abort the upload of the specified document version that was previously initiated by InitiateDocumentVersionUpload	Write
ActivateUser	Grants permission to activate the specified user. Only active users can access Amazon WorkDocs	Write
AddResourcePermissions	Grants permission to create a set of permissions for the specified folder or document	Write
CreateComment	Grants permission to add a new comment to the specified document version	Write
CreateCustomMetadata	Grants permission to add one or more custom properties to the specified resource	Write
CreateFolder	Grants permission to create a folder with the specified name and parent folder	Write
CreateLabels	Grants permission to add labels to the given resource	Write
CreateNotificationSubscription	Grants permission to configure WorkDocs to use Amazon SNS notifications	Write
CreateUser	Grants permission to create a user in a Simple AD or Microsoft AD directory	Write
DeactivateUser	Grants permission to deactivate the specified user, which revokes the user's access to Amazon WorkDocs	Write
DeleteComment	Grants permission to delete the specified comment from the document version	Write
DeleteCustomMetadata	Grants permission to delete custom metadata from the specified resource	Write
DeleteDocument	Grants permission to permanently delete the specified document and its associated metadata	Write
DeleteDocumentVersion	Grants permission to delete versions of a specified document	Write
DeleteFolder	Grants permission to permanently delete the specified folder and its contents	Write
DeleteFolderContents	Grants permission to delete the contents of the specified folder	Write
DeleteLabels	Grants permission to delete one or more labels from a resource	Write
DeleteNotificationSubscription	Grants permission to delete the specified subscription from the specified organization	Write
DeleteUser	Grants permission to delete the specified user from a Simple AD or Microsoft AD directory	Write
DescribeActivities	Grants permission to fetch user activities in a specified time period	List
DescribeComments	Grants permission to list all the comments for the specified document version	List
DescribeDocumentVersions	Grants permission to retrieve the document versions for the specified document	List
DescribeFolderContents	Grants permission to describe the contents of the specified folder, including its documents and sub-folders	List
DescribeGroups	Grants permission to describe the user groups	List
DescribeNotificationSubscriptions	Grants permission to list the specified notification subscriptions	List
DescribeResourcePermissions	Grants permission to view a description of a specified resource's permissions	List
DescribeRootFolders	Grants permission to describe the root folders	List
DescribeUsers	Grants permission to view a description of the specified users. You can describe all users or filter the results (for example, by status or organization)	List
GetCurrentUser	Grants permission to retrieve the details of the current user	Read
GetDocument	Grants permission to retrieve the specified document object	Read
GetDocumentPath	Grants permission to retrieve the path information (the hierarchy from the root folder) for the requested document	Read
GetDocumentVersion	Grants permission to retrieve version metadata for the specified document	Read
GetFolder	Grants permission to retrieve the metadata of the specified folder	Read
GetFolderPath	Grants permission to retrieve the path information (the hierarchy from the root folder) for the specified folder	Read
GetResources	Grants permission to get a collection of resources	Read
InitiateDocumentVersionUpload	Grants permission to create a new document object and version object	Write
RemoveAllResourcePermissions	Grants permission to remove all the permissions from the specified resource	Write
RemoveResourcePermission	Grants permission to remove the permission for the specified principal from the specified resource	Write
RestoreDocumentVersions	Grants permission to restore versions of a specified document	Write
SearchResources	Grants permission to search metadata and the content of resources	List
UpdateDocument	Grants permission to update the specified attributes of the specified document	Write
UpdateDocumentVersion	Grants permission to change the status of the document version to ACTIVE	Write
UpdateFolder	Grants permission to update the specified attributes of the specified folder	Write
UpdateUser	Grants permission to update the specified attributes of the specified user, and grants or revokes administrative privileges to the Amazon WorkDocs site	Write

Permission-only actions for Amazon WorkDocs

The following actions are defined by Amazon WorkDocs but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Access level
AddNotificationPermissions	Grants permission to add principals that are allowed to call notification subscription APIs for a given WorkDocs site		Write
AddUserToGroup	Grants permission to add a user to a group		Write
CheckAlias	Grants permission to check an alias		Read
CreateInstance	Grants permission to create an instance		Write
DeleteInstance	Grants permission to delete an instance		Write
DeleteNotificationPermissions	Grants permission to delete principals that are allowed to call notification subscription APIs for a given WorkDocs site		Write
DeregisterDirectory	Grants permission to deregister a directory		Write
DescribeAvailableDirectories	Grants permission to describe available directories		List
DescribeInstanceExports	Grants permission to describe the export history for an instance		List
DescribeInstances	Grants permission to describe instances		List
DescribeNotificationPermissions	Grants permission to describe principals that are allowed to call notification subscription APIs for a given WorkDocs site		List
DownloadDocumentVersion	Grants permission to download a specified document version		Read
GetGroup	Grants permission to retrieve details for the specified group		Read
RegisterDirectory	Grants permission to register a directory		Write
StartInstanceExport	Grants permission to start an export for an instance	organization*	Write
UpdateInstanceAlias	Grants permission to update an instance alias		Write
UpdateUserAdministrativeSettings	Grants permission to update the administrative settings for a user		Write

Resource types defined by Amazon WorkDocs

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
organization	arn:${Partition}:workdocs:${Region}:${Account}:organization/${ResourceId}

Condition keys for Amazon WorkDocs

Amazon WorkDocs has no service-specific condition keys that can be used in the Condition element of policy statements.

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon VPC Lattice Services (vpc-lattice-svcs)

Amazon WorkLink (worklink)