Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Keyspaces (for Apache Cassandra)

Amazon Keyspaces (for Apache Cassandra) (service prefix: cassandra) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Keyspaces (for Apache Cassandra)
Actions defined by Amazon Keyspaces (for Apache Cassandra)
Resource types defined by Amazon Keyspaces (for Apache Cassandra)
Condition keys for Amazon Keyspaces (for Apache Cassandra)

API operations defined by Amazon Keyspaces (for Apache Cassandra)

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Access level
CreateKeyspace	keyspaces	cassandra:Create	Write
		cassandra:CreateMultiRegionResource	Write
		cassandra:TagResource	Tagging, Write
CreateTable	keyspaces	cassandra:Create	Write
		cassandra:CreateMultiRegionResource	Write
		cassandra:TagResource	Tagging, Write
CreateType	keyspaces	cassandra:Create	Write
CreateType	keyspaces	cassandra:CreateMultiRegionResource	Write
DeleteKeyspace	keyspaces	cassandra:Drop	Write
DeleteKeyspace	keyspaces	cassandra:DropMultiRegionResource	Write
DeleteTable	keyspaces	cassandra:Drop	Write
DeleteTable	keyspaces	cassandra:DropMultiRegionResource	Write
DeleteType	keyspaces	cassandra:Drop	Write
DeleteType	keyspaces	cassandra:DropMultiRegionResource	Write
GetKeyspace	keyspaces	cassandra:Select	Read
GetTable	keyspaces	cassandra:Select	Read
GetTableAutoScalingSettings	keyspaces	cassandra:Select	Read
		cassandra:SelectMultiRegionResource	Read
		application-autoscaling:DescribeScalableTargets	Read
		application-autoscaling:DescribeScalingPolicies	Read
GetType	keyspaces	cassandra:Select	Read
ListKeyspaces	keyspaces	cassandra:Select	Read
ListTables	keyspaces	cassandra:Select	Read
ListTypes	keyspaces	cassandra:Select	Read
RestoreTable	keyspaces	cassandra:Restore	Write
		cassandra:RestoreMultiRegionTable	Write
		cassandra:Select	Read
TagResource	keyspaces	cassandra:Alter	Write
		cassandra:AlterMultiRegionResource	Write
		cassandra:TagMultiRegionResource	Tagging, Write
		cassandra:TagResource	Tagging, Write
UntagResource	keyspaces	cassandra:Alter	Write
		cassandra:AlterMultiRegionResource	Write
		cassandra:UnTagMultiRegionResource	Tagging, Write
		cassandra:UntagResource	Tagging, Write
UpdateKeyspace	keyspaces	cassandra:Alter	Write
		cassandra:AlterMultiRegionResource	Write
		cassandra:Create	Write
		cassandra:CreateMultiRegionResource	Write
		cassandra:Modify	Write
		cassandra:ModifyMultiRegionResource	Write
		cassandra:Select	Read
		cassandra:SelectMultiRegionResource	Read
		cassandra:TagMultiRegionResource	Tagging, Write
		cassandra:TagResource	Tagging, Write
		application-autoscaling:DescribeScalableTargets	Read
		application-autoscaling:DescribeScalableTargets	Read
		application-autoscaling:DescribeScalingPolicies	Read
		application-autoscaling:PutScalingPolicy	Write
		application-autoscaling:RegisterScalableTarget	Write
UpdateTable	keyspaces	cassandra:Alter	Write
UpdateTable	keyspaces	cassandra:AlterMultiRegionResource	Write
GetRecords	keyspacesstreams	cassandra:GetRecords	Read
GetShardIterator	keyspacesstreams	cassandra:GetShardIterator	Read
GetStream	keyspacesstreams	cassandra:GetStream	Read
ListStreams	keyspacesstreams	cassandra:ListStreams	List

Actions defined by Amazon Keyspaces (for Apache Cassandra)

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
Alter	Grants permission to alter a keyspace or table	keyspace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
Alter	Grants permission to alter a keyspace or table	table	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
AlterMultiRegionResource	Grants permission to alter a multiregion keyspace or table	keyspace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
AlterMultiRegionResource	Grants permission to alter a multiregion keyspace or table	table	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
Create	Grants permission to create a keyspace or table	keyspace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
Create	Grants permission to create a keyspace or table	table	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateMultiRegionResource	Grants permission to create a multiregion keyspace or table	keyspace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateMultiRegionResource	Grants permission to create a multiregion keyspace or table	table	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
Drop	Grants permission to drop a keyspace or table	keyspace	aws:ResourceTag/${TagKey}	Write
Drop	Grants permission to drop a keyspace or table	table	aws:ResourceTag/${TagKey}	Write
DropMultiRegionResource	Grants permission to drop a multiregion keyspace or table	keyspace	aws:ResourceTag/${TagKey}	Write
DropMultiRegionResource	Grants permission to drop a multiregion keyspace or table	table	aws:ResourceTag/${TagKey}	Write
GetRecords	Grants permission to retrieve the CDC stream records from a given shard	stream*	aws:ResourceTag/${TagKey}	Read
GetShardIterator	Grants permission to return a shard iterator	stream*	aws:ResourceTag/${TagKey}	Read
GetStream	Grants permission to return information about a CDC stream, including the composition of its shards	stream*	aws:ResourceTag/${TagKey}	Read
ListStreams	Grants permission to return an array of CDC stream ARNs associated with the current account and endpoint			List
Modify	Grants permission to INSERT, UPDATE or DELETE data in a table	table*	aws:ResourceTag/${TagKey}	Write
ModifyMultiRegionResource	Grants permission to INSERT, UPDATE or DELETE data in a multiregion table	table*	aws:ResourceTag/${TagKey}	Write
Restore	Grants permission to restore table from a backup	table*	aws:ResourceTag/${TagKey}	Write
RestoreMultiRegionTable	Grants permission to restore multiregion table from a backup	table*	aws:ResourceTag/${TagKey}	Write
Select	Grants permission to SELECT data from a table	table*	aws:ResourceTag/${TagKey}	Read
SelectMultiRegionResource	Grants permission to SELECT data from a multiregion table	table*	aws:ResourceTag/${TagKey}	Read
TagMultiRegionResource	Grants permission to tag a multiregion keyspace or table	keyspace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagMultiRegionResource	Grants permission to tag a multiregion keyspace or table	table	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource	Grants permission to tag a keyspace, table, or stream	keyspace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		stream	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		table	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UnTagMultiRegionResource	Grants permission to untag a multiregion keyspace or table	keyspace	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UnTagMultiRegionResource	Grants permission to untag a multiregion keyspace or table	table	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to untag a keyspace, table or stream	keyspace	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		stream	aws:ResourceTag/${TagKey} aws:TagKeys
		table	aws:ResourceTag/${TagKey} aws:TagKeys
UpdatePartitioner	Grants permission to UPDATE the partitioner in a system table	table*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Keyspaces (for Apache Cassandra)

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
keyspace	arn:${Partition}:cassandra:${Region}:${Account}:/keyspace/${KeyspaceName}/	aws:ResourceTag/${TagKey}
stream	arn:${Partition}:cassandra:${Region}:${Account}:/keyspace/${KeyspaceName}/table/${TableName}/stream/${StreamLabel}	aws:ResourceTag/${TagKey}
table	arn:${Partition}:cassandra:${Region}:${Account}:/keyspace/${KeyspaceName}/table/${TableName}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Keyspaces (for Apache Cassandra)

Amazon Keyspaces (for Apache Cassandra) defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters actions based on the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters actions based on tag key-value pairs attached to the resource	String
aws:TagKeys	Filters actions based on the presence of tag keys in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Kendra Intelligent Ranking (kendra-ranking)

Amazon Kinesis Analytics (kinesisanalytics)