Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Kendra

Amazon Kendra (service prefix: kendra) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by Amazon Kendra

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateEntitiesToExperience	kendra:AssociateEntitiesToExperience			Write
AssociatePersonasToEntities	kendra:AssociatePersonasToEntities			Write
BatchDeleteDocument	kendra:BatchDeleteDocument			Write
BatchDeleteFeaturedResultsSet	kendra:BatchDeleteFeaturedResultsSet			Write
BatchGetDocumentStatus	kendra:BatchGetDocumentStatus			Read
BatchPutDocument	kendra:BatchPutDocument			Write
BatchPutDocument	iam:PassRole	iam:PassedToService	kendra.amazonaws.com	Write
ClearQuerySuggestions	kendra:ClearQuerySuggestions			Write
CreateAccessControlConfiguration	kendra:CreateAccessControlConfiguration			Write
CreateDataSource	kendra:CreateDataSource			Write
	kendra:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	kendra.amazonaws.com	Write
CreateExperience	kendra:CreateExperience			Write
CreateExperience	iam:PassRole	iam:PassedToService	kendra.amazonaws.com	Write
CreateFaq	kendra:CreateFaq			Write
	kendra:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	kendra.amazonaws.com	Write
CreateFeaturedResultsSet	kendra:CreateFeaturedResultsSet			Write
CreateFeaturedResultsSet	kendra:TagResource			Tagging, Write
CreateIndex	kendra:CreateIndex			Write
	kendra:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	kendra.amazonaws.com	Write
CreateQuerySuggestionsBlockList	kendra:CreateQuerySuggestionsBlockList			Write
	kendra:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	kendra.amazonaws.com	Write
CreateThesaurus	kendra:CreateThesaurus			Write
	kendra:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	kendra.amazonaws.com	Write
DeleteAccessControlConfiguration	kendra:DeleteAccessControlConfiguration			Write
DeleteDataSource	kendra:DeleteDataSource			Write
DeleteExperience	kendra:DeleteExperience			Write
DeleteFaq	kendra:DeleteFaq			Write
DeleteIndex	kendra:DeleteIndex			Write
DeletePrincipalMapping	kendra:DeletePrincipalMapping			Write
DeleteQuerySuggestionsBlockList	kendra:DeleteQuerySuggestionsBlockList			Write
DeleteThesaurus	kendra:DeleteThesaurus			Write
DescribeAccessControlConfiguration	kendra:DescribeAccessControlConfiguration			Read
DescribeDataSource	kendra:DescribeDataSource			Read
DescribeExperience	kendra:DescribeExperience			Read
DescribeFaq	kendra:DescribeFaq			Read
DescribeFeaturedResultsSet	kendra:DescribeFeaturedResultsSet			Read
DescribeIndex	kendra:DescribeIndex			Read
DescribePrincipalMapping	kendra:DescribePrincipalMapping			Read
DescribeQuerySuggestionsBlockList	kendra:DescribeQuerySuggestionsBlockList			Read
DescribeQuerySuggestionsConfig	kendra:DescribeQuerySuggestionsConfig			Read
DescribeThesaurus	kendra:DescribeThesaurus			Read
DisassociateEntitiesFromExperience	kendra:DisassociateEntitiesFromExperience			Write
DisassociatePersonasFromEntities	kendra:DisassociatePersonasFromEntities			Write
GetQuerySuggestions	kendra:GetQuerySuggestions			Read
GetSnapshots	kendra:GetSnapshots			Read
ListAccessControlConfigurations	kendra:ListAccessControlConfigurations			List
ListDataSourceSyncJobs	kendra:ListDataSourceSyncJobs			List
ListDataSources	kendra:ListDataSources			List
ListEntityPersonas	kendra:ListEntityPersonas			List
ListExperienceEntities	kendra:ListExperienceEntities			List
ListExperiences	kendra:ListExperiences			List
ListFaqs	kendra:ListFaqs			List
ListFeaturedResultsSets	kendra:ListFeaturedResultsSets			List
ListGroupsOlderThanOrderingId	kendra:ListGroupsOlderThanOrderingId			List
ListIndices	kendra:ListIndices			List
ListQuerySuggestionsBlockLists	kendra:ListQuerySuggestionsBlockLists			List
ListTagsForResource	kendra:ListTagsForResource			Read
ListThesauri	kendra:ListThesauri			List
PutPrincipalMapping	kendra:PutPrincipalMapping			Write
PutPrincipalMapping	iam:PassRole	iam:PassedToService	kendra.amazonaws.com	Write
Query	kendra:Query			Read
Retrieve	kendra:Retrieve			Read
StartDataSourceSyncJob	kendra:StartDataSourceSyncJob			Write
StopDataSourceSyncJob	kendra:StopDataSourceSyncJob			Write
SubmitFeedback	kendra:SubmitFeedback			Write
TagResource	kendra:TagResource			Tagging, Write
UntagResource	kendra:UntagResource			Tagging, Write
UpdateAccessControlConfiguration	kendra:UpdateAccessControlConfiguration			Write
UpdateDataSource	kendra:UpdateDataSource			Write
UpdateDataSource	iam:PassRole	iam:PassedToService	kendra.amazonaws.com	Write
UpdateExperience	kendra:UpdateExperience			Write
UpdateExperience	iam:PassRole	iam:PassedToService	kendra.amazonaws.com	Write
UpdateFeaturedResultsSet	kendra:UpdateFeaturedResultsSet			Write
UpdateIndex	kendra:UpdateIndex			Write
UpdateIndex	iam:PassRole	iam:PassedToService	kendra.amazonaws.com	Write
UpdateQuerySuggestionsBlockList	kendra:UpdateQuerySuggestionsBlockList			Write
UpdateQuerySuggestionsBlockList	iam:PassRole	iam:PassedToService	kendra.amazonaws.com	Write
UpdateQuerySuggestionsConfig	kendra:UpdateQuerySuggestionsConfig			Write
UpdateThesaurus	kendra:UpdateThesaurus			Write
UpdateThesaurus	iam:PassRole	iam:PassedToService	kendra.amazonaws.com	Write

Actions defined by Amazon Kendra

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateEntitiesToExperience	Grants permission to put principal mapping in index	experience*		Write
AssociateEntitiesToExperience	Grants permission to put principal mapping in index	index*	aws:ResourceTag/${TagKey}	Write
AssociatePersonasToEntities	Defines the specific permissions of users or groups in your AWS SSO identity source with access to your Amazon Kendra experience	experience*		Write
AssociatePersonasToEntities		index*	aws:ResourceTag/${TagKey}	Write
BatchDeleteDocument	Grants permission to batch delete document	index*	aws:ResourceTag/${TagKey}	Write
BatchDeleteFeaturedResultsSet	Grants permission to delete a featured results set	featured-results-set*	aws:ResourceTag/${TagKey}	Write
BatchDeleteFeaturedResultsSet	Grants permission to delete a featured results set	index*	aws:ResourceTag/${TagKey}	Write
BatchGetDocumentStatus	Grants permission to do batch get document status	index*	aws:ResourceTag/${TagKey}	Read
BatchPutDocument	Grants permission to batch put document	index*	aws:ResourceTag/${TagKey}	Write
ClearQuerySuggestions	Grants permission to clear out the suggestions for a given index, generated so far	index*	aws:ResourceTag/${TagKey}	Write
CreateAccessControlConfiguration	Grants permission to create an access control configuration	index*	aws:ResourceTag/${TagKey}	Write
CreateDataSource	Grants permission to create a data source	index*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateExperience	Creates an Amazon Kendra experience such as a search application	index*	aws:ResourceTag/${TagKey}	Write
CreateFaq	Grants permission to create an Faq	index*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFeaturedResultsSet	Grants permission to create a featured results set	index*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateIndex	Grants permission to create an Index		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateQuerySuggestionsBlockList	Grants permission to create a QuerySuggestions BlockList	index*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateThesaurus	Grants permission to create a Thesaurus	index*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAccessControlConfiguration	Grants permission to delete an access control configuration	access-control-configuration*		Write
DeleteAccessControlConfiguration	Grants permission to delete an access control configuration	index*	aws:ResourceTag/${TagKey}	Write
DeleteDataSource	Grants permission to delete a data source	data-source*	aws:ResourceTag/${TagKey}	Write
DeleteDataSource	Grants permission to delete a data source	index*	aws:ResourceTag/${TagKey}	Write
DeleteExperience	Deletes your Amazon Kendra experience such as a search application	experience*		Write
DeleteExperience		index*	aws:ResourceTag/${TagKey}	Write
DeleteFaq	Grants permission to delete an Faq	faq*	aws:ResourceTag/${TagKey}	Write
DeleteFaq	Grants permission to delete an Faq	index*	aws:ResourceTag/${TagKey}	Write
DeleteIndex	Grants permission to delete an Index	index*	aws:ResourceTag/${TagKey}	Write
DeletePrincipalMapping	Grants permission to delete principal mapping from index	data-source	aws:ResourceTag/${TagKey}	Write
DeletePrincipalMapping	Grants permission to delete principal mapping from index	index*	aws:ResourceTag/${TagKey}	Write
DeleteQuerySuggestionsBlockList	Grants permission to delete a QuerySuggestions BlockList	index*	aws:ResourceTag/${TagKey}	Write
DeleteQuerySuggestionsBlockList	Grants permission to delete a QuerySuggestions BlockList	query-suggestions-block-list*	aws:ResourceTag/${TagKey}	Write
DeleteThesaurus	Grants permission to delete a Thesaurus	index*	aws:ResourceTag/${TagKey}	Write
DeleteThesaurus	Grants permission to delete a Thesaurus	thesaurus*	aws:ResourceTag/${TagKey}	Write
DescribeAccessControlConfiguration	Grants permission to describe an access control configuration	access-control-configuration*		Read
DescribeAccessControlConfiguration		index*	aws:ResourceTag/${TagKey}	Read
DescribeDataSource	Grants permission to describe a data source	data-source*	aws:ResourceTag/${TagKey}	Read
DescribeDataSource	Grants permission to describe a data source	index*	aws:ResourceTag/${TagKey}	Read
DescribeExperience	Gets information about your Amazon Kendra experience such as a search application	experience*		Read
DescribeExperience		index*	aws:ResourceTag/${TagKey}	Read
DescribeFaq	Grants permission to describe an Faq	faq*	aws:ResourceTag/${TagKey}	Read
DescribeFaq	Grants permission to describe an Faq	index*	aws:ResourceTag/${TagKey}	Read
DescribeFeaturedResultsSet	Grants permission to describe a featured results set	featured-results-set*	aws:ResourceTag/${TagKey}	Read
DescribeFeaturedResultsSet	Grants permission to describe a featured results set	index*	aws:ResourceTag/${TagKey}	Read
DescribeIndex	Grants permission to describe an Index	index*	aws:ResourceTag/${TagKey}	Read
DescribePrincipalMapping	Grants permission to describe principal mapping from index	data-source	aws:ResourceTag/${TagKey}	Read
DescribePrincipalMapping	Grants permission to describe principal mapping from index	index*	aws:ResourceTag/${TagKey}	Read
DescribeQuerySuggestionsBlockList	Grants permission to describe a QuerySuggestions BlockList	index*	aws:ResourceTag/${TagKey}	Read
DescribeQuerySuggestionsBlockList	Grants permission to describe a QuerySuggestions BlockList	query-suggestions-block-list*	aws:ResourceTag/${TagKey}	Read
DescribeQuerySuggestionsConfig	Grants permission to describe the query suggestions configuration for an index	index*	aws:ResourceTag/${TagKey}	Read
DescribeThesaurus	Grants permission to describe a Thesaurus	index*	aws:ResourceTag/${TagKey}	Read
DescribeThesaurus	Grants permission to describe a Thesaurus	thesaurus*	aws:ResourceTag/${TagKey}	Read
DisassociateEntitiesFromExperience	Prevents users or groups in your AWS SSO identity source from accessing your Amazon Kendra experience	experience*		Write
DisassociateEntitiesFromExperience		index*	aws:ResourceTag/${TagKey}	Write
DisassociatePersonasFromEntities	Removes the specific permissions of users or groups in your AWS SSO identity source with access to your Amazon Kendra experience	experience*		Write
DisassociatePersonasFromEntities		index*	aws:ResourceTag/${TagKey}	Write
GetQuerySuggestions	Grants permission to get suggestions for a query prefix	index*	aws:ResourceTag/${TagKey}	Read
GetSnapshots	Retrieves search metrics data	index*	aws:ResourceTag/${TagKey}	Read
ListAccessControlConfigurations	Grants permission to list the access control configurations	index*	aws:ResourceTag/${TagKey}	List
ListDataSourceSyncJobs	Grants permission to get Data Source sync job history	data-source*	aws:ResourceTag/${TagKey}	List
ListDataSourceSyncJobs	Grants permission to get Data Source sync job history	index*	aws:ResourceTag/${TagKey}	List
ListDataSources	Grants permission to list the data sources	index*	aws:ResourceTag/${TagKey}	List
ListEntityPersonas	Lists specific permissions of users and groups with access to your Amazon Kendra experience	experience*		List
ListEntityPersonas		index*	aws:ResourceTag/${TagKey}	List
ListExperienceEntities	Lists users or groups in your AWS SSO identity source that are granted access to your Amazon Kendra experience	experience*		List
ListExperienceEntities		index*	aws:ResourceTag/${TagKey}	List
ListExperiences	Lists one or more Amazon Kendra experiences. You can create an Amazon Kendra experience such as a search application	index*	aws:ResourceTag/${TagKey}	List
ListFaqs	Grants permission to list the Faqs	index*	aws:ResourceTag/${TagKey}	List
ListFeaturedResultsSets	Grants permission to list the featured results sets	index*	aws:ResourceTag/${TagKey}	List
ListGroupsOlderThanOrderingId	Grants permission to list groups that are older than an ordering id	data-source	aws:ResourceTag/${TagKey}	List
ListGroupsOlderThanOrderingId		index*	aws:ResourceTag/${TagKey}	List
ListIndices	Grants permission to list the indexes			List
ListQuerySuggestionsBlockLists	Grants permission to list the QuerySuggestions BlockLists	index*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags for a resource	data-source	aws:ResourceTag/${TagKey}	Read
		faq	aws:ResourceTag/${TagKey}
		featured-results-set	aws:ResourceTag/${TagKey}
		index	aws:ResourceTag/${TagKey}
		query-suggestions-block-list	aws:ResourceTag/${TagKey}
		thesaurus	aws:ResourceTag/${TagKey}
ListThesauri	Grants permission to list the Thesauri	index*	aws:ResourceTag/${TagKey}	List
PutPrincipalMapping	Grants permission to put principal mapping in index	data-source	aws:ResourceTag/${TagKey}	Write
PutPrincipalMapping	Grants permission to put principal mapping in index	index*	aws:ResourceTag/${TagKey}	Write
Query	Grants permission to query documents and faqs	index*	aws:ResourceTag/${TagKey}	Read
Retrieve	Grants permission to retrieve relevant content from an index	index*	aws:ResourceTag/${TagKey}	Read
StartDataSourceSyncJob	Grants permission to start Data Source sync job	data-source*	aws:ResourceTag/${TagKey}	Write
StartDataSourceSyncJob	Grants permission to start Data Source sync job	index*	aws:ResourceTag/${TagKey}	Write
StopDataSourceSyncJob	Grants permission to stop Data Source sync job	data-source*	aws:ResourceTag/${TagKey}	Write
StopDataSourceSyncJob	Grants permission to stop Data Source sync job	index*	aws:ResourceTag/${TagKey}	Write
SubmitFeedback	Grants permission to send feedback about a query results	index*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag a resource with given key value pairs	data-source	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		faq	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		featured-results-set	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		index	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		query-suggestions-block-list	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		thesaurus	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove the tag with the given key from a resource	data-source	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		faq	aws:ResourceTag/${TagKey} aws:TagKeys
		featured-results-set	aws:ResourceTag/${TagKey} aws:TagKeys
		index	aws:ResourceTag/${TagKey} aws:TagKeys
		query-suggestions-block-list	aws:ResourceTag/${TagKey} aws:TagKeys
		thesaurus	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAccessControlConfiguration	Grants permission to update an access control configuration	access-control-configuration*		Write
UpdateAccessControlConfiguration	Grants permission to update an access control configuration	index*	aws:ResourceTag/${TagKey}	Write
UpdateDataSource	Grants permission to update a data source	data-source*	aws:ResourceTag/${TagKey}	Write
UpdateDataSource	Grants permission to update a data source	index*	aws:ResourceTag/${TagKey}	Write
UpdateExperience	Updates your Amazon Kendra experience such as a search application	index*	aws:ResourceTag/${TagKey}	Write
UpdateFeaturedResultsSet	Grants permission to update a featured results set	featured-results-set*	aws:ResourceTag/${TagKey}	Write
UpdateFeaturedResultsSet	Grants permission to update a featured results set	index*	aws:ResourceTag/${TagKey}	Write
UpdateIndex	Grants permission to update an Index	index*	aws:ResourceTag/${TagKey}	Write
UpdateQuerySuggestionsBlockList	Grants permission to update a QuerySuggestions BlockList	index*	aws:ResourceTag/${TagKey}	Write
UpdateQuerySuggestionsBlockList	Grants permission to update a QuerySuggestions BlockList	query-suggestions-block-list*	aws:ResourceTag/${TagKey}	Write
UpdateQuerySuggestionsConfig	Grants permission to update the query suggestions configuration for an index	index*	aws:ResourceTag/${TagKey}	Write
UpdateThesaurus	Grants permission to update a thesaurus	index*	aws:ResourceTag/${TagKey}	Write
UpdateThesaurus	Grants permission to update a thesaurus	thesaurus*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Kendra

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
access-control-configuration	arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/access-control-configuration/${AccessControlConfigurationId}
data-source	arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/data-source/${DataSourceId}	aws:ResourceTag/${TagKey}
experience	arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/experience/${ExperienceId}
faq	arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/faq/${FaqId}	aws:ResourceTag/${TagKey}
featured-results-set	arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/featured-results-set/${FeaturedResultsSetId}	aws:ResourceTag/${TagKey}
index	arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}	aws:ResourceTag/${TagKey}
query-suggestions-block-list	arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/query-suggestions-block-list/${QuerySuggestionsBlockListId}	aws:ResourceTag/${TagKey}
thesaurus	arn:${Partition}:kendra:${Region}:${Account}:index/${IndexId}/thesaurus/${ThesaurusId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Kendra

Amazon Kendra defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Interactive Video Service Chat (ivschat)

Amazon Kendra Intelligent Ranking (kendra-ranking)