Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Ground Station

AWS Ground Station (service prefix: groundstation) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Ground Station
Actions defined by AWS Ground Station
Resource types defined by AWS Ground Station
Condition keys for AWS Ground Station

API operations defined by AWS Ground Station

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CancelContact	groundstation:CancelContact			Write
CreateConfig	groundstation:CreateConfig			Write
	groundstation:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	groundstation.amazonaws.com	Write
CreateDataflowEndpointGroup	groundstation:CreateDataflowEndpointGroup			Write
	groundstation:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	groundstation.amazonaws.com	Write
CreateDataflowEndpointGroupV2	groundstation:CreateDataflowEndpointGroupV2			Write
CreateDataflowEndpointGroupV2	groundstation:TagResource			Tagging, Write
CreateEphemeris	groundstation:CreateEphemeris			Write
CreateEphemeris	groundstation:TagResource			Tagging, Write
CreateMissionProfile	groundstation:CreateMissionProfile			Write
	groundstation:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	groundstation.amazonaws.com	Write
DeleteConfig	groundstation:DeleteConfig			Write
DeleteDataflowEndpointGroup	groundstation:DeleteDataflowEndpointGroup			Write
DeleteEphemeris	groundstation:DeleteEphemeris			Write
DeleteMissionProfile	groundstation:DeleteMissionProfile			Write
DescribeContact	groundstation:DescribeContact			Read
DescribeContactVersion	groundstation:DescribeContactVersion			Read
DescribeEphemeris	groundstation:DescribeEphemeris			Read
GetAgentConfiguration	groundstation:GetAgentConfiguration			Read
GetAgentTaskResponseUrl	groundstation:GetAgentTaskResponseUrl			Read
GetConfig	groundstation:GetConfig			Read
GetDataflowEndpointGroup	groundstation:GetDataflowEndpointGroup			Read
GetMinuteUsage	groundstation:GetMinuteUsage			Read
GetMissionProfile	groundstation:GetMissionProfile			Read
GetSatellite	groundstation:GetSatellite			Read
ListAntennas	groundstation:ListAntennas			List
ListConfigs	groundstation:ListConfigs			List
ListContactVersions	groundstation:ListContactVersions			List
ListContacts	groundstation:ListContacts			List
ListDataflowEndpointGroups	groundstation:ListDataflowEndpointGroups			List
ListEphemerides	groundstation:ListEphemerides			List
ListGroundStationReservations	groundstation:ListGroundStationReservations			List
ListGroundStations	groundstation:ListGroundStations			List
ListMissionProfiles	groundstation:ListMissionProfiles			List
ListSatellites	groundstation:ListSatellites			List
ListTagsForResource	groundstation:ListTagsForResource			Read
RegisterAgent	groundstation:RegisterAgent			Write
ReserveContact	groundstation:ReserveContact			Write
ReserveContact	groundstation:TagResource			Tagging, Write
TagResource	groundstation:TagResource			Tagging, Write
UntagResource	groundstation:UntagResource			Tagging, Write
UpdateAgentStatus	groundstation:UpdateAgentStatus			Write
UpdateConfig	groundstation:UpdateConfig			Write
UpdateConfig	iam:PassRole	iam:PassedToService	groundstation.amazonaws.com	Write
UpdateContact	groundstation:UpdateContact			Write
UpdateEphemeris	groundstation:UpdateEphemeris			Write
UpdateMissionProfile	groundstation:UpdateMissionProfile			Write
UpdateMissionProfile	iam:PassRole	iam:PassedToService	groundstation.amazonaws.com	Write

Actions defined by AWS Ground Station

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CancelContact	Grants permission to cancel a contact	Contact*	aws:ResourceTag/${TagKey} groundstation:ContactId	Write
CreateConfig	Grants permission to create a configuration		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDataflowEndpointGroup	Grants permission to create a data flow endpoint group		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDataflowEndpointGroupV2	Grants permission to create a data flow endpoint group using the V2 operation		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateEphemeris	Grants permission to create an ephemeris item		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateMissionProfile	Grants permission to create a mission profile		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteConfig	Grants permission to delete a config	Config*	aws:ResourceTag/${TagKey} groundstation:ConfigId groundstation:ConfigType	Write
DeleteDataflowEndpointGroup	Grants permission to delete a data flow endpoint group	DataflowEndpointGroup*	aws:ResourceTag/${TagKey} groundstation:DataflowEndpointGroupId	Write
DeleteEphemeris	Grants permission to delete an ephemeris item	EphemerisItem*	aws:ResourceTag/${TagKey} groundstation:EphemerisId	Write
DeleteMissionProfile	Grants permission to delete a mission profile	MissionProfile*	aws:ResourceTag/${TagKey} groundstation:MissionProfileId	Write
DescribeContact	Grants permission to describe a contact	Contact*	aws:ResourceTag/${TagKey} groundstation:ContactId	Read
DescribeContactVersion	Grants permission to describe a specific version of a contact	Contact*	aws:ResourceTag/${TagKey} groundstation:ContactId	Read
DescribeEphemeris	Grants permission to describe an ephemeris item	EphemerisItem*	aws:ResourceTag/${TagKey} groundstation:EphemerisId	Read
GetAgentConfiguration	Grants permission to get the configuration of an agent	Agent*	groundstation:AgentId	Read
GetAgentTaskResponseUrl	Grants permission to retrieve presigned S3 logging URLs	Agent*	groundstation:AgentId	Read
GetConfig	Grants permission to return a configuration	Config*	aws:ResourceTag/${TagKey} groundstation:ConfigId groundstation:ConfigType	Read
GetDataflowEndpointGroup	Grants permission to return a data flow endpoint group	DataflowEndpointGroup*	aws:ResourceTag/${TagKey} groundstation:DataflowEndpointGroupId	Read
GetMinuteUsage	Grants permission to return minutes usage			Read
GetMissionProfile	Grants permission to retrieve a mission profile	MissionProfile*	aws:ResourceTag/${TagKey} groundstation:MissionProfileId	Read
GetSatellite	Grants permission to return information about a satellite	Satellite*	groundstation:SatelliteId	Read
ListAntennas	Grants permission to list antennas for a ground station	GroundStationResource*	groundstation:GroundStationId	List
ListConfigs	Grants permission to return a list of past configurations			List
ListContactVersions	Grants permission to list versions of a contact	Contact*	aws:ResourceTag/${TagKey} groundstation:ContactId	List
ListContacts	Grants permission to return a list of contacts			List
ListDataflowEndpointGroups	Grants permission to list data flow endpoint groups			List
ListEphemerides	Grants permission to list ephemerides			List
ListGroundStationReservations	Grants permission to list reservations for a ground station	GroundStationResource*	groundstation:GroundStationId	List
ListGroundStations	Grants permission to list ground stations			List
ListMissionProfiles	Grants permission to return a list of mission profiles			List
ListSatellites	Grants permission to list satellites			List
ListTagsForResource	Grants permission to list tags for a resource	Config	aws:ResourceTag/${TagKey} groundstation:ConfigId groundstation:ConfigType	Read
		Contact	aws:ResourceTag/${TagKey} groundstation:ContactId
		DataflowEndpointGroup	aws:ResourceTag/${TagKey} groundstation:DataflowEndpointGroupId
		MissionProfile	aws:ResourceTag/${TagKey} groundstation:MissionProfileId
RegisterAgent	Grants permission to register an agent			Write
ReserveContact	Grants permission to reserve a contact		aws:RequestTag/${TagKey} aws:TagKeys	Write
TagResource	Grants permission to assign a resource tag	Config	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys groundstation:ConfigId groundstation:ConfigType	Tagging, Write
		Contact	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys groundstation:ContactId
		DataflowEndpointGroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys groundstation:DataflowEndpointGroupId
		EphemerisItem	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys groundstation:EphemerisId
		MissionProfile	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys groundstation:MissionProfileId
UntagResource	Grants permission to unassign a resource tag	Config	aws:ResourceTag/${TagKey} aws:TagKeys groundstation:ConfigId groundstation:ConfigType	Tagging, Write
		Contact	aws:ResourceTag/${TagKey} aws:TagKeys groundstation:ContactId
		DataflowEndpointGroup	aws:ResourceTag/${TagKey} aws:TagKeys groundstation:DataflowEndpointGroupId
		EphemerisItem	aws:ResourceTag/${TagKey} aws:TagKeys groundstation:EphemerisId
		MissionProfile	aws:ResourceTag/${TagKey} aws:TagKeys groundstation:MissionProfileId
UpdateAgentStatus	Grants permission to update the status of an agent	Agent*	groundstation:AgentId	Write
UpdateConfig	Grants permission to update a configuration	Config*	aws:ResourceTag/${TagKey} groundstation:ConfigId groundstation:ConfigType	Write
UpdateContact	Grants permission to update a contact	Contact*	aws:ResourceTag/${TagKey} groundstation:ContactId	Write
UpdateEphemeris	Grants permission to update an ephemeris item	EphemerisItem*	aws:ResourceTag/${TagKey} groundstation:EphemerisId	Write
UpdateMissionProfile	Grants permission to update a mission profile	MissionProfile*	aws:ResourceTag/${TagKey} groundstation:MissionProfileId	Write

Resource types defined by AWS Ground Station

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
Agent	arn:${Partition}:groundstation:${Region}:${Account}:agent/${AgentId}	groundstation:AgentId
Config	arn:${Partition}:groundstation:${Region}:${Account}:config/${ConfigType}/${ConfigId}	aws:ResourceTag/${TagKey} groundstation:ConfigId groundstation:ConfigType
Contact	arn:${Partition}:groundstation:${Region}:${Account}:contact/${ContactId}	aws:ResourceTag/${TagKey} groundstation:ContactId
DataflowEndpointGroup	arn:${Partition}:groundstation:${Region}:${Account}:dataflow-endpoint-group/${DataflowEndpointGroupId}	aws:ResourceTag/${TagKey} groundstation:DataflowEndpointGroupId
EphemerisItem	arn:${Partition}:groundstation:${Region}:${Account}:ephemeris/${EphemerisId}	aws:ResourceTag/${TagKey} groundstation:EphemerisId
GroundStationResource	arn:${Partition}:groundstation:${Region}:${Account}:groundstation:${GroundStationId}	groundstation:GroundStationId
MissionProfile	arn:${Partition}:groundstation:${Region}:${Account}:mission-profile/${MissionProfileId}	aws:ResourceTag/${TagKey} groundstation:MissionProfileId
Satellite	arn:${Partition}:groundstation:${Region}:${Account}:satellite/${SatelliteId}	groundstation:SatelliteId

Condition keys for AWS Ground Station

AWS Ground Station defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
groundstation:AgentId	Filters access by the ID of an agent	String
groundstation:ConfigId	Filters access by the ID of a config	String
groundstation:ConfigType	Filters access by the type of a config	String
groundstation:ContactId	Filters access by the ID of a contact	String
groundstation:DataflowEndpointGroupId	Filters access by the ID of a dataflow endpoint group	String
groundstation:EphemerisId	Filters access by the ID of an ephemeris	String
groundstation:GroundStationId	Filters access by the ID of a ground station	String
groundstation:MissionProfileId	Filters access by the ID of a mission profile	String
groundstation:SatelliteId	Filters access by the ID of a satellite	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Glue DataBrew (databrew)

AWS Health APIs and Notifications (health)