Actions, resources, and condition keys for AWS Elastic Disaster Recovery
AWS Elastic Disaster Recovery (service prefix: drs) provides the following
service-specific operations, resources, actions, and condition keys for use in IAM permission
policies.
References:
-
Learn how to configure this service.
-
View a list of the API operations available for this service.
-
Learn how to secure this service and its resources by using IAM permission policies.
-
View the programmatic service authorization reference
for this service.
Topics
API operations defined by AWS Elastic Disaster Recovery
The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.
| Operation | IAM action | Condition key | Possible value(s) | Access level |
|---|---|---|---|---|
|
AssociateSourceNetworkStack |
Write |
|||
|
CreateExtendedSourceServer |
Write |
|||
Tagging, Write |
||||
|
CreateLaunchConfigurationTemplate |
Write |
|||
Tagging, Write |
||||
|
CreateReplicationConfigurationTemplate |
Write |
|||
Tagging, Write |
||||
|
CreateSourceNetwork |
Write |
|||
Tagging, Write |
||||
|
DeleteJob |
Write |
|||
|
DeleteLaunchAction |
Write |
|||
|
DeleteLaunchConfigurationTemplate |
Write |
|||
|
DeleteRecoveryInstance |
Write |
|||
|
DeleteReplicationConfigurationTemplate |
Write |
|||
|
DeleteSourceNetwork |
Write |
|||
|
DeleteSourceServer |
Write |
|||
|
DescribeJobLogItems |
Read |
|||
|
DescribeJobs |
Read |
|||
|
DescribeLaunchConfigurationTemplates |
Read |
|||
|
DescribeRecoveryInstances |
Read |
|||
|
DescribeRecoverySnapshots |
Read |
|||
|
DescribeReplicationConfigurationTemplates |
Read |
|||
|
DescribeSourceNetworks |
Read |
|||
|
DescribeSourceServers |
Read |
|||
|
DisconnectRecoveryInstance |
Write |
|||
|
DisconnectSourceServer |
Write |
|||
|
ExportSourceNetworkCfnTemplate |
Write |
|||
|
GetFailbackReplicationConfiguration |
Read |
|||
|
GetLaunchConfiguration |
Read |
|||
|
GetReplicationConfiguration |
Read |
|||
|
InitializeService |
Write |
|||
|
ListExtensibleSourceServers |
Read |
|||
|
ListLaunchActions |
Read |
|||
|
ListStagingAccounts |
Read |
|||
|
ListTagsForResource |
Read |
|||
|
PutLaunchAction |
Write |
|||
|
RetryDataReplication |
Write |
|||
|
ReverseReplication |
Write |
|||
|
StartRecovery |
Write |
|||
Tagging, Write |
||||
|
StartReplication |
Write |
|||
|
StartSourceNetworkReplication |
Write |
|||
|
StopFailback |
Write |
|||
|
StopReplication |
Write |
|||
|
StopSourceNetworkReplication |
Write |
|||
|
TagResource |
Tagging, Write |
|||
|
TerminateRecoveryInstances |
Write |
|||
|
UntagResource |
Tagging, Write |
|||
|
UpdateFailbackReplicationConfiguration |
Write |
|||
|
UpdateLaunchConfiguration |
Write |
|||
|
UpdateLaunchConfigurationTemplate |
Write |
|||
|
UpdateReplicationConfiguration |
Write |
|||
|
UpdateReplicationConfigurationTemplate |
Write |
Actions defined by AWS Elastic Disaster Recovery
You can specify the following actions in the Action element of an IAM
policy statement. Use policies to grant permissions to perform an operation in AWS. When
you use an action in a policy, you usually allow or deny access to the API operation or CLI
command with the same name. However, in some cases, a single action controls access to more
than one operation. Alternatively, some operations require several different actions.
| Actions | Description | Resource types (*required) | Condition keys | Access level |
|---|---|---|---|---|
Grants permission to associate CloudFormation stack with source network |
Write |
|||
Grants permission to extend a source server |
Write |
|||
Grants permission to create launch configuration template |
Write |
|||
Grants permission to create replication configuration template |
Write |
|||
Grants permission to create a source network |
Write |
|||
Grants permission to delete a job |
Write |
|||
Grants permission to delete a launch action |
Write |
|||
Grants permission to delete launch configuration template |
Write |
|||
Grants permission to delete recovery instance |
Write |
|||
Grants permission to delete replication configuration template |
Write |
|||
Grants permission to delete source network |
Write |
|||
Grants permission to delete source server |
Write |
|||
Grants permission to describe job log items |
Read |
|||
Grants permission to describe jobs |
Read |
|||
Grants permission to describe launch configuration template |
Read |
|||
Grants permission to describe recovery instances |
Read |
|||
Grants permission to describe recovery snapshots |
Read |
|||
Grants permission to describe replication configuration template |
Read |
|||
Grants permission to describe source networks |
Read |
|||
Grants permission to describe source servers |
Read |
|||
Grants permission to disconnect recovery instance |
Write |
|||
Grants permission to disconnect source server |
Write |
|||
Grants permission to export CloudFormation template which contains source network resources |
Write |
|||
Grants permission to get failback replication configuration |
Read |
|||
Grants permission to get launch configuration |
Read |
|||
Grants permission to get replication configuration |
Read |
|||
Grants permission to initialize service |
Write |
|||
Grants permission to list extensible source servers |
Read |
|||
Grants permission to list launch actions |
Read |
|||
Grants permission to list staging accounts |
Read |
|||
Grants permission to list tags for a resource |
Read |
|||
Grants permission to put a launch action |
Write |
|||
Grants permission to retry data replication |
Write |
|||
Grants permission to reverse replication |
Write |
|||
Grants permission to start failback launch |
Write |
|||
Grants permission to start recovery |
Write |
|||
Grants permission to start replication |
Write |
|||
Grants permission to start network recovery |
Write |
|||
Grants permission to start network replication |
Write |
|||
Grants permission to stop failback |
Write |
|||
Grants permission to stop replication |
Write |
|||
Grants permission to stop network replication |
Write |
|||
Grants permission to assign a resource tag |
Tagging, Write |
|||
Grants permission to terminate recovery instances |
Write |
|||
Grants permission to untag a resource |
Tagging, Write |
|||
Grants permission to update failback replication configuration |
Write |
|||
Grants permission to update launch configuration |
Write |
|||
Grants permission to update launch configuration |
Write |
|||
Grants permission to update replication configuration |
Write |
|||
Grants permission to update replication configuration template |
Write |
Permission-only actions for AWS Elastic Disaster Recovery
The following actions are defined by AWS Elastic Disaster Recovery but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.
| Actions | Description | Resource types (*required) | Condition keys | Access level |
|---|---|---|---|---|
Grants permission to get associate failback client to recovery instance |
Write |
|||
Grants permission to batch create volume snapshot group |
Write |
|||
Grants permission to batch delete snapshot request |
Write |
|||
Grants permission to create converted snapshot |
Write |
|||
Grants permission to create recovery instance |
Write |
|||
Grants permission to create a source server |
Write |
|||
Grants permission to describe replication server associations |
Read |
|||
Grants permission to describe snapshot requests |
Read |
|||
Grants permission to get agent command |
Read |
|||
Grants permission to get agent confirmed resume info |
Read |
|||
Grants permission to get agent installation assets |
Read |
|||
Grants permission to get agent replication info |
Read |
|||
Grants permission to get agent runtime configuration |
Read |
|||
Grants permission to get agent snapshot credits |
Read |
|||
Grants permission to get channel commands |
Read |
|||
Grants permission to get failback command |
Read |
|||
Grants permission to get failback launch requested |
Read |
|||
Grants permission to get suggested failback client device mapping |
Read |
|||
Grants permission to issue an agent certificate |
Write |
|||
Grants permission to notify agent authentication |
Write |
|||
Grants permission to notify agent is connected |
Write |
|||
Grants permission to notify agent is disconnected |
Write |
|||
Grants permission to notify agent replication progress |
Write |
|||
Grants permission to notify consistency attained |
Write |
|||
Grants permission to notify replication server authentication |
Write |
|||
Grants permission to notify replicator volume events |
Write |
|||
Grants permission to send agent logs |
Write |
|||
Grants permission to send agent metrics |
Write |
|||
Grants permission to send channel command result |
Write |
|||
Grants permission to send client logs |
Write |
|||
Grants permission to send client metrics |
Write |
|||
Grants permission to send volume throughput statistics |
Write |
|||
Grants permission to update agent backlog |
Write |
|||
Grants permission to update agent conversion info |
Write |
|||
Grants permission to update agent replication info |
Write |
|||
Grants permission to update agent replication process state |
Write |
|||
Grants permission to update agent source properties |
Write |
|||
Grants permission to update failback client device mapping |
Write |
|||
Grants permission to update failback client last seen |
Write |
|||
Grants permission to update a replication certificate |
Write |
Resource types defined by AWS Elastic Disaster Recovery
The following resource types are defined by this service and can be used in the
Resource element of IAM permission policy statements.
| Resource types | ARN | Condition keys |
|---|---|---|
arn:${Partition}:drs:${Region}:${Account}:job/${JobID} |
||
arn:${Partition}:drs:${Region}:${Account}:launch-configuration-template/${LaunchConfigurationTemplateID} |
||
arn:${Partition}:drs:${Region}:${Account}:recovery-instance/${RecoveryInstanceID} |
||
arn:${Partition}:drs:${Region}:${Account}:replication-configuration-template/${ReplicationConfigurationTemplateID} |
||
arn:${Partition}:drs:${Region}:${Account}:source-network/${SourceNetworkID} |
||
arn:${Partition}:drs:${Region}:${Account}:source-server/${SourceServerID} |
Condition keys for AWS Elastic Disaster Recovery
AWS Elastic Disaster Recovery defines the following condition keys that can be used in the
Condition element of an IAM policy.
| Condition keys | Description | Type |
|---|---|---|
Filters access by the presence of tag key-value pairs in the request |
String |
|
Filters access by tag key-value pairs attached to the resource |
String |
|
Filters access by the presence of tag keys in the request |
ArrayOfString |
|
Filters access by the name of a resource-creating API action |
String |
|
Filters access by the EC2 instance the request originated from |
ARN |