View a markdown version of this page

Actions, resources, and condition keys for Amazon Forecast - Service Authorization Reference

Actions, resources, and condition keys for Amazon Forecast

Amazon Forecast (service prefix: forecast) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

API operations defined by Amazon Forecast

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation SDK client IAM action Condition key Possible value(s) Access level

CreateAutoPredictor

forecast

forecast:CreateAutoPredictor

Write

forecast:TagResource

Tagging, Write

iam:PassRole

iam:PassedToService

forecast.amazonaws.com

Write

CreateDataset

forecast

forecast:CreateDataset

Write

forecast:TagResource

Tagging, Write

iam:PassRole

iam:PassedToService

forecast.amazonaws.com

Write

CreateDatasetGroup

forecast

forecast:CreateDatasetGroup

Write

forecast:TagResource

Tagging, Write

CreateDatasetImportJob

forecast

forecast:CreateDatasetImportJob

Write

forecast:TagResource

Tagging, Write

iam:PassRole

iam:PassedToService

forecast.amazonaws.com

Write

CreateExplainability

forecast

forecast:CreateExplainability

Write

forecast:TagResource

Tagging, Write

CreateExplainabilityExport

forecast

forecast:CreateExplainabilityExport

Write

forecast:TagResource

Tagging, Write

iam:PassRole

iam:PassedToService

forecast.amazonaws.com

Write

CreateForecast

forecast

forecast:CreateForecast

Write

forecast:TagResource

Tagging, Write

CreateForecastExportJob

forecast

forecast:CreateForecastExportJob

Write

forecast:TagResource

Tagging, Write

iam:PassRole

iam:PassedToService

forecast.amazonaws.com

Write

CreateMonitor

forecast

forecast:CreateMonitor

Write

forecast:TagResource

Tagging, Write

CreatePredictor

forecast

forecast:CreatePredictor

Write

forecast:TagResource

Tagging, Write

iam:PassRole

iam:PassedToService

forecast.amazonaws.com

Write

CreatePredictorBacktestExportJob

forecast

forecast:CreatePredictorBacktestExportJob

Write

forecast:TagResource

Tagging, Write

iam:PassRole

iam:PassedToService

forecast.amazonaws.com

Write

CreateWhatIfAnalysis

forecast

forecast:CreateWhatIfAnalysis

Write

forecast:TagResource

Tagging, Write

DeleteDataset

forecast

forecast:DeleteDataset

Write

DeleteDatasetGroup

forecast

forecast:DeleteDatasetGroup

Write

DeleteDatasetImportJob

forecast

forecast:DeleteDatasetImportJob

Write

DeleteExplainability

forecast

forecast:DeleteExplainability

Write

DeleteExplainabilityExport

forecast

forecast:DeleteExplainabilityExport

Write

DeleteForecast

forecast

forecast:DeleteForecast

Write

DeleteForecastExportJob

forecast

forecast:DeleteForecastExportJob

Write

DeleteMonitor

forecast

forecast:DeleteMonitor

Write

DeletePredictor

forecast

forecast:DeletePredictor

Write

DeletePredictorBacktestExportJob

forecast

forecast:DeletePredictorBacktestExportJob

Write

DeleteResourceTree

forecast

forecast:DeleteResourceTree

Write

DeleteWhatIfAnalysis

forecast

forecast:DeleteWhatIfAnalysis

Write

DescribeAutoPredictor

forecast

forecast:DescribeAutoPredictor

Read

DescribeDataset

forecast

forecast:DescribeDataset

Read

DescribeDatasetGroup

forecast

forecast:DescribeDatasetGroup

Read

DescribeDatasetImportJob

forecast

forecast:DescribeDatasetImportJob

Read

DescribeExplainability

forecast

forecast:DescribeExplainability

Read

DescribeExplainabilityExport

forecast

forecast:DescribeExplainabilityExport

Read

DescribeForecast

forecast

forecast:DescribeForecast

Read

DescribeForecastExportJob

forecast

forecast:DescribeForecastExportJob

Read

DescribeMonitor

forecast

forecast:DescribeMonitor

Read

DescribePredictor

forecast

forecast:DescribePredictor

Read

DescribePredictorBacktestExportJob

forecast

forecast:DescribePredictorBacktestExportJob

Read

DescribeWhatIfAnalysis

forecast

forecast:DescribeWhatIfAnalysis

Read

GetAccuracyMetrics

forecast

forecast:GetAccuracyMetrics

Read

ListDatasetGroups

forecast

forecast:ListDatasetGroups

Read

ListDatasetImportJobs

forecast

forecast:ListDatasetImportJobs

Read

ListDatasets

forecast

forecast:ListDatasets

Read

ListExplainabilities

forecast

forecast:ListExplainabilities

Read

ListExplainabilityExports

forecast

forecast:ListExplainabilityExports

Read

ListForecastExportJobs

forecast

forecast:ListForecastExportJobs

Read

ListForecasts

forecast

forecast:ListForecasts

Read

ListMonitorEvaluations

forecast

forecast:ListMonitorEvaluations

Read

ListMonitors

forecast

forecast:ListMonitors

Read

ListPredictorBacktestExportJobs

forecast

forecast:ListPredictorBacktestExportJobs

Read

ListPredictors

forecast

forecast:ListPredictors

Read

ListTagsForResource

forecast

forecast:ListTagsForResource

Read

ListWhatIfAnalyses

forecast

forecast:ListWhatIfAnalyses

Read

ListWhatIfForecastExports

forecast

forecast:ListWhatIfForecastExports

Read

ListWhatIfForecasts

forecast

forecast:ListWhatIfForecasts

Read

ResumeResource

forecast

forecast:ResumeResource

Write

StopResource

forecast

forecast:StopResource

Write

TagResource

forecast

forecast:TagResource

Tagging, Write

UntagResource

forecast

forecast:UntagResource

Tagging, Write

UpdateDatasetGroup

forecast

forecast:UpdateDatasetGroup

Write

QueryForecast

forecastquery

forecast:QueryForecast

Read

QueryWhatIfForecast

forecastquery

forecast:QueryWhatIfForecast

Read

Actions defined by Amazon Forecast

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions Description Resource types (*required) Condition keys Access level

CreateAutoPredictor

Grants permission to create an auto predictor

aws:RequestTag/${TagKey}

aws:TagKeys

Write

CreateDataset

Grants permission to create a dataset

dataset*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateDatasetGroup

Grants permission to create a dataset group

datasetGroup*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateDatasetImportJob

Grants permission to create a dataset import job

datasetImportJob*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateExplainability

Grants permission to create an explainability

forecast*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateExplainabilityExport

Grants permission to create an explainability export using an explainability resource

explainability*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateForecast

Grants permission to create a forecast

predictor*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateForecastExportJob

Grants permission to create a forecast export job using a forecast resource

forecast*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateMonitor

Grants permission to create an monitor using a Predictor resource

predictor*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreatePredictor

Grants permission to create a predictor

datasetGroup*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreatePredictorBacktestExportJob

Grants permission to create a predictor backtest export job using a predictor

predictor*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateWhatIfAnalysis

Grants permission to create a what-if analysis

forecast*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateWhatIfForecast

Grants permission to create a what-if forecast

whatIfAnalysis*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

CreateWhatIfForecastExport

Grants permission to create a what-if forecast export using what-if forecast resources

whatIfForecast*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

DeleteDataset

Grants permission to delete a dataset

dataset*

aws:ResourceTag/${TagKey}

Write

DeleteDatasetGroup

Grants permission to delete a dataset group

datasetGroup*

aws:ResourceTag/${TagKey}

Write

DeleteDatasetImportJob

Grants permission to delete a dataset import job

datasetImportJob*

aws:ResourceTag/${TagKey}

Write

DeleteExplainability

Grants permission to delete an explainability

explainability*

aws:ResourceTag/${TagKey}

Write

DeleteExplainabilityExport

Grants permission to delete an explainability export

explainabilityExport*

aws:ResourceTag/${TagKey}

Write

DeleteForecast

Grants permission to delete a forecast

forecast*

aws:ResourceTag/${TagKey}

Write

DeleteForecastExportJob

Grants permission to delete a forecast export job

forecastExport*

aws:ResourceTag/${TagKey}

Write

DeleteMonitor

Grants permission to delete a monitor resource

monitor*

aws:ResourceTag/${TagKey}

Write

DeletePredictor

Grants permission to delete a predictor

predictor*

aws:ResourceTag/${TagKey}

Write

DeletePredictorBacktestExportJob

Grants permission to delete a predictor backtest export job

predictorBacktestExportJob*

aws:ResourceTag/${TagKey}

Write

DeleteResourceTree

Grants permission to delete a resource and its child resources

dataset*

aws:ResourceTag/${TagKey}

Write

datasetGroup*

aws:ResourceTag/${TagKey}

datasetImportJob*

aws:ResourceTag/${TagKey}

endpoint*

aws:ResourceTag/${TagKey}

explainability*

aws:ResourceTag/${TagKey}

explainabilityExport*

aws:ResourceTag/${TagKey}

forecast*

aws:ResourceTag/${TagKey}

forecastExport*

aws:ResourceTag/${TagKey}

monitor*

aws:ResourceTag/${TagKey}

predictor*

aws:ResourceTag/${TagKey}

predictorBacktestExportJob*

aws:ResourceTag/${TagKey}

whatIfAnalysis*

aws:ResourceTag/${TagKey}

whatIfForecast*

aws:ResourceTag/${TagKey}

whatIfForecastExport*

aws:ResourceTag/${TagKey}

DeleteWhatIfAnalysis

Grants permission to delete a what-if analysis

whatIfAnalysis*

aws:ResourceTag/${TagKey}

Write

DeleteWhatIfForecast

Grants permission to delete a what-if forecast

whatIfForecast*

aws:ResourceTag/${TagKey}

Write

DeleteWhatIfForecastExport

Grants permission to delete a what-if forecast export

whatIfForecastExport*

aws:ResourceTag/${TagKey}

Write

DescribeAutoPredictor

Grants permission to describe an auto predictor

predictor*

aws:ResourceTag/${TagKey}

Read

DescribeDataset

Grants permission to describe a dataset

dataset*

aws:ResourceTag/${TagKey}

Read

DescribeDatasetGroup

Grants permission to describe a dataset group

datasetGroup*

aws:ResourceTag/${TagKey}

Read

DescribeDatasetImportJob

Grants permission to describe a dataset import job

datasetImportJob*

aws:ResourceTag/${TagKey}

Read

DescribeExplainability

Grants permission to describe an explainability

explainability*

aws:ResourceTag/${TagKey}

Read

DescribeExplainabilityExport

Grants permission to describe an explainability export

explainabilityExport*

aws:ResourceTag/${TagKey}

Read

DescribeForecast

Grants permission to describe a forecast

forecast*

aws:ResourceTag/${TagKey}

Read

DescribeForecastExportJob

Grants permission to describe a forecast export job

forecastExport*

aws:ResourceTag/${TagKey}

Read

DescribeMonitor

Grants permission to describe an monitor resource

monitor*

aws:ResourceTag/${TagKey}

Read

DescribePredictor

Grants permission to describe a predictor

predictor*

aws:ResourceTag/${TagKey}

Read

DescribePredictorBacktestExportJob

Grants permission to describe a predictor backtest export job

predictorBacktestExportJob*

aws:ResourceTag/${TagKey}

Read

DescribeWhatIfAnalysis

Grants permission to describe a what-if analysis

whatIfAnalysis*

aws:ResourceTag/${TagKey}

Read

DescribeWhatIfForecast

Grants permission to describe a what-if forecast

whatIfForecast*

aws:ResourceTag/${TagKey}

Read

DescribeWhatIfForecastExport

Grants permission to describe a what-if forecast export

whatIfForecastExport*

aws:ResourceTag/${TagKey}

Read

GetAccuracyMetrics

Grants permission to get the Accuracy Metrics for a predictor

predictor*

aws:ResourceTag/${TagKey}

Read

ListDatasetGroups

Grants permission to list all the dataset groups

Read

ListDatasetImportJobs

Grants permission to list all the dataset import jobs

Read

ListDatasets

Grants permission to list all the datasets

Read

ListExplainabilities

Grants permission to list all the explainabilities

Read

ListExplainabilityExports

Grants permission to list all the explainability exports

Read

ListForecastExportJobs

Grants permission to list all the forecast export jobs

Read

ListForecasts

Grants permission to list all the forecasts

Read

ListMonitorEvaluations

Grants permission to list all the monitor evaluation result for a monitor

monitor*

aws:ResourceTag/${TagKey}

Read

ListMonitors

Grants permission to list all the monitor resources

Read

ListPredictorBacktestExportJobs

Grants permission to list all the predictor backtest export jobs

Read

ListPredictors

Grants permission to list all the predictors

Read

ListTagsForResource

Grants permission to list the tags for an Amazon Forecast resource

dataset

aws:ResourceTag/${TagKey}

Read

datasetGroup

aws:ResourceTag/${TagKey}

datasetImportJob

aws:ResourceTag/${TagKey}

endpoint

aws:ResourceTag/${TagKey}

explainability

aws:ResourceTag/${TagKey}

explainabilityExport

aws:ResourceTag/${TagKey}

forecast

aws:ResourceTag/${TagKey}

forecastExport

aws:ResourceTag/${TagKey}

monitor

aws:ResourceTag/${TagKey}

predictor

aws:ResourceTag/${TagKey}

predictorBacktestExportJob

aws:ResourceTag/${TagKey}

whatIfAnalysis

aws:ResourceTag/${TagKey}

whatIfForecast

aws:ResourceTag/${TagKey}

whatIfForecastExport

aws:ResourceTag/${TagKey}

ListWhatIfAnalyses

Grants permission to list all the what-if analyses

Read

ListWhatIfForecastExports

Grants permission to list all the what-if forecast exports

Read

ListWhatIfForecasts

Grants permission to list all the what-if forecasts

Read

QueryForecast

Grants permission to retrieve a forecast for a single item

forecast*

aws:ResourceTag/${TagKey}

Read

QueryWhatIfForecast

Grants permission to retrieve a what-if forecast for a single item

whatIfForecast*

aws:ResourceTag/${TagKey}

Read

ResumeResource

Grants permission to resume Amazon Forecast resource jobs

monitor*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

StopResource

Grants permission to stop Amazon Forecast resource jobs

datasetImportJob*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

endpoint*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

explainability*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

explainabilityExport*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

forecast*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

forecastExport*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

monitor*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

predictor*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

predictorBacktestExportJob*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

whatIfAnalysis*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

whatIfForecast*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

whatIfForecastExport*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

TagResource

Grants permission to associate the specified tags to a resource

dataset

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Tagging, Write

datasetGroup

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

datasetImportJob

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

endpoint

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

explainability

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

explainabilityExport

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

forecast

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

forecastExport

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

monitor

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

predictor

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

predictorBacktestExportJob

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

whatIfAnalysis

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

whatIfForecast

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

whatIfForecastExport

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

UntagResource

Grants permission to delete the specified tags for a resource

dataset

aws:ResourceTag/${TagKey}

aws:TagKeys

Tagging, Write

datasetGroup

aws:ResourceTag/${TagKey}

aws:TagKeys

datasetImportJob

aws:ResourceTag/${TagKey}

aws:TagKeys

endpoint

aws:ResourceTag/${TagKey}

aws:TagKeys

explainability

aws:ResourceTag/${TagKey}

aws:TagKeys

explainabilityExport

aws:ResourceTag/${TagKey}

aws:TagKeys

forecast

aws:ResourceTag/${TagKey}

aws:TagKeys

forecastExport

aws:ResourceTag/${TagKey}

aws:TagKeys

monitor

aws:ResourceTag/${TagKey}

aws:TagKeys

predictor

aws:ResourceTag/${TagKey}

aws:TagKeys

predictorBacktestExportJob

aws:ResourceTag/${TagKey}

aws:TagKeys

whatIfAnalysis

aws:ResourceTag/${TagKey}

aws:TagKeys

whatIfForecast

aws:ResourceTag/${TagKey}

aws:TagKeys

whatIfForecastExport

aws:ResourceTag/${TagKey}

aws:TagKeys

UpdateDatasetGroup

Grants permission to update a dataset group

dataset*

aws:ResourceTag/${TagKey}

Write

datasetGroup*

aws:ResourceTag/${TagKey}

Permission-only actions for Amazon Forecast

The following actions are defined by Amazon Forecast but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions Description Resource types (*required) Condition keys Access level

CreateForecastEndpoint

Grants permission to create an endpoint using a Predictor resource

predictor*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Write

DeleteForecastEndpoint

Grants permission to delete an endpoint resource

endpoint*

aws:ResourceTag/${TagKey}

Write

DescribeForecastEndpoint

Grants permission to describe an endpoint resource

endpoint*

aws:ResourceTag/${TagKey}

Read

GetRecentForecastContext

Grants permission to get the forecast context of a timeseries for an endpoint

endpoint*

aws:ResourceTag/${TagKey}

Read

InvokeForecastEndpoint

Grants permission to invoke the endpoint to get forecast for a timeseries

endpoint*

aws:ResourceTag/${TagKey}

Read

Resource types defined by Amazon Forecast

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types ARN Condition keys

algorithm

arn:${Partition}:forecast:::algorithm/${ResourceId}

dataset

arn:${Partition}:forecast:${Region}:${Account}:dataset/${ResourceId}

aws:ResourceTag/${TagKey}

datasetGroup

arn:${Partition}:forecast:${Region}:${Account}:dataset-group/${ResourceId}

aws:ResourceTag/${TagKey}

datasetImportJob

arn:${Partition}:forecast:${Region}:${Account}:dataset-import-job/${ResourceId}

aws:ResourceTag/${TagKey}

endpoint

arn:${Partition}:forecast:${Region}:${Account}:forecast-endpoint/${ResourceId}

aws:ResourceTag/${TagKey}

explainability

arn:${Partition}:forecast:${Region}:${Account}:explainability/${ResourceId}

aws:ResourceTag/${TagKey}

explainabilityExport

arn:${Partition}:forecast:${Region}:${Account}:explainability-export/${ResourceId}

aws:ResourceTag/${TagKey}

forecast

arn:${Partition}:forecast:${Region}:${Account}:forecast/${ResourceId}

aws:ResourceTag/${TagKey}

forecastExport

arn:${Partition}:forecast:${Region}:${Account}:forecast-export-job/${ResourceId}

aws:ResourceTag/${TagKey}

monitor

arn:${Partition}:forecast:${Region}:${Account}:monitor/${ResourceId}

aws:ResourceTag/${TagKey}

predictor

arn:${Partition}:forecast:${Region}:${Account}:predictor/${ResourceId}

aws:ResourceTag/${TagKey}

predictorBacktestExportJob

arn:${Partition}:forecast:${Region}:${Account}:predictor-backtest-export-job/${ResourceId}

aws:ResourceTag/${TagKey}

whatIfAnalysis

arn:${Partition}:forecast:${Region}:${Account}:what-if-analysis/${ResourceId}

aws:ResourceTag/${TagKey}

whatIfForecast

arn:${Partition}:forecast:${Region}:${Account}:what-if-forecast/${ResourceId}

aws:ResourceTag/${TagKey}

whatIfForecastExport

arn:${Partition}:forecast:${Region}:${Account}:what-if-forecast-export/${ResourceId}

aws:ResourceTag/${TagKey}

Condition keys for Amazon Forecast

Amazon Forecast defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys Description Type

aws:RequestTag/${TagKey}

Filters access by the tags that are passed in the request

String

aws:ResourceTag/${TagKey}

Filters access by the tags associated with the resource

String

aws:TagKeys

Filters access by the tag keys that are passed in the request

ArrayOfString