Actions, resources, and condition keys for AWS CloudShell
AWS CloudShell (service prefix: cloudshell) provides the following
service-specific operations, resources, actions, and condition keys for use in IAM permission
policies.
References:
-
Learn how to configure this service.
-
View a list of the API operations available for this service.
-
Learn how to secure this service and its resources by using IAM permission policies.
-
View the programmatic service authorization reference
for this service.
Topics
Actions defined by AWS CloudShell
AWS CloudShell has no API operations that can be used in the
Actions element of an IAM policy statement.
Permission-only actions for AWS CloudShell
The following actions are defined by AWS CloudShell but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.
| Actions | Description | Resource types (*required) | Condition keys | Access level |
|---|---|---|---|---|
Grants permission to approve a command sent by another AWS service |
Read |
|||
Grants permissions to create a CloudShell environment |
Write |
|||
Grants permissions to connect to a CloudShell environment from the AWS Management Console |
Write |
|||
Grants permission to delete a CloudShell environment |
Write |
|||
Grants permission to return descriptions of existing user's environments |
List |
|||
Grants permission to read a CloudShell environment status |
Read |
|||
Grants permissions to download files from a CloudShell environment |
Write |
|||
Grants permissions to upload files to a CloudShell environment |
Write |
|||
Grants permissions to forward console credentials to the environment |
Write |
|||
Grants permission to start a stopped CloudShell environment |
Write |
|||
Grants permission to stop a running CloudShell environment |
Write |
Resource types defined by AWS CloudShell
The following resource types are defined by this service and can be used in the
Resource element of IAM permission policy statements.
| Resource types | ARN | Condition keys |
|---|---|---|
arn:${Partition}:cloudshell:${Region}:${Account}:environment/${EnvironmentId} |
Condition keys for AWS CloudShell
AWS CloudShell defines the following condition keys that can be used in the
Condition element of an IAM policy.
| Condition keys | Description | Type |
|---|---|---|
Filters access by security group ids. Available during CreateEnvironment operation |
ArrayOfString |
|
Filters access by subnet ids. Available during CreateEnvironment operation |
ArrayOfString |
|
Filters access by vpc ids. Available during CreateEnvironment operation |
ArrayOfString |
