Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS License Manager User Subscriptions

AWS License Manager User Subscriptions (service prefix: license-manager-user-subscriptions) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS License Manager User Subscriptions
Actions defined by AWS License Manager User Subscriptions
Resource types defined by AWS License Manager User Subscriptions
Condition keys for AWS License Manager User Subscriptions

API operations defined by AWS License Manager User Subscriptions

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AssociateUser	license-manager-user-subscriptions:AssociateUser	Write
CreateLicenseServerEndpoint	license-manager-user-subscriptions:CreateLicenseServerEndpoint	Write
CreateLicenseServerEndpoint	license-manager-user-subscriptions:TagResource	Tagging, Write
DeleteLicenseServerEndpoint	license-manager-user-subscriptions:DeleteLicenseServerEndpoint	Write
DeregisterIdentityProvider	license-manager-user-subscriptions:DeregisterIdentityProvider	Write
DisassociateUser	license-manager-user-subscriptions:DisassociateUser	Write
ListIdentityProviders	license-manager-user-subscriptions:ListIdentityProviders	List
ListInstances	license-manager-user-subscriptions:ListInstances	List
ListLicenseServerEndpoints	license-manager-user-subscriptions:ListLicenseServerEndpoints	List
ListProductSubscriptions	license-manager-user-subscriptions:ListProductSubscriptions	List
ListTagsForResource	license-manager-user-subscriptions:ListTagsForResource	Read
ListUserAssociations	license-manager-user-subscriptions:ListUserAssociations	List
RegisterIdentityProvider	license-manager-user-subscriptions:RegisterIdentityProvider	Write
RegisterIdentityProvider	license-manager-user-subscriptions:TagResource	Tagging, Write
StartProductSubscription	license-manager-user-subscriptions:StartProductSubscription	Write
StartProductSubscription	license-manager-user-subscriptions:TagResource	Tagging, Write
StopProductSubscription	license-manager-user-subscriptions:StopProductSubscription	Write
TagResource	license-manager-user-subscriptions:TagResource	Tagging, Write
UntagResource	license-manager-user-subscriptions:UntagResource	Tagging, Write
UpdateIdentityProviderSettings	license-manager-user-subscriptions:UpdateIdentityProviderSettings	Write

Actions defined by AWS License Manager User Subscriptions

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateUser	Grants permission to associate a subscribed user to an instance launched with license manager user subscriptions products	identity-provider*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateLicenseServerEndpoint	Grants permission to create a license server endpoint for a given server type for a given Identity Provider	identity-provider*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteLicenseServerEndpoint	Grants permission to delete a license server endpoint for a given server type for a given Identity Provider	identity-provider*	aws:ResourceTag/${TagKey}	Write
DeleteLicenseServerEndpoint		license-server-endpoint*	aws:ResourceTag/${TagKey}	Write
DeregisterIdentityProvider	Grants permission to deregister Microsoft Active Directory with license-manager-user-subscriptions for a product	identity-provider*	aws:ResourceTag/${TagKey}	Write
DisassociateUser	Grants permission to disassociate a subscribed user from an instance launched with license manager user subscriptions products	identity-provider*	aws:ResourceTag/${TagKey}	Write
DisassociateUser		instance-user*	aws:ResourceTag/${TagKey}	Write
ListIdentityProviders	Grants permission to list all the identity providers on license manager user subscriptions			List
ListInstances	Grants permission to list all the instances launched with license manager user subscription products			List
ListLicenseServerEndpoints	Grants permission to list license server endpoints			List
ListProductSubscriptions	Grants permission to lists all the product subscriptions for a product and identity provider	identity-provider*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags for a selected resource	identity-provider*	aws:ResourceTag/${TagKey}	Read
		instance-user*	aws:ResourceTag/${TagKey}
		license-server-endpoint*	aws:ResourceTag/${TagKey}
		product-subscription*	aws:ResourceTag/${TagKey}
ListUserAssociations	Grants permission to list all the users associated to an instance launched for a product	identity-provider*	aws:ResourceTag/${TagKey}	List
RegisterIdentityProvider	Grants permission to registers Microsoft Active Directory with license-manager-user-subscriptions for a product		aws:RequestTag/${TagKey} aws:TagKeys	Write
StartProductSubscription	Grants permission to start product subscription for a user on a registered active directory for a product	identity-provider*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
StopProductSubscription	Grants permission to stop product subscription for a user on a registered active directory for a product	identity-provider*	aws:ResourceTag/${TagKey}	Write
StopProductSubscription		product-subscription*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag a selected resource	identity-provider*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		instance-user*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		license-server-endpoint*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		product-subscription*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag a selected resource	identity-provider*	aws:ResourceTag/${TagKey}	Tagging, Write
		instance-user*	aws:ResourceTag/${TagKey}
		license-server-endpoint*	aws:ResourceTag/${TagKey}
		product-subscription*	aws:ResourceTag/${TagKey}
UpdateIdentityProviderSettings	Grants permission to update the identity provider configuration	identity-provider*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS License Manager User Subscriptions

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
identity-provider	arn:${Partition}:license-manager-user-subscriptions:${Region}:${Account}:identity-provider/${IdentityProviderId}	aws:ResourceTag/${TagKey}
instance-user	arn:${Partition}:license-manager-user-subscriptions:${Region}:${Account}:instance-user/${InstanceUserId}	aws:ResourceTag/${TagKey}
license-server-endpoint	arn:${Partition}:license-manager-user-subscriptions:${Region}:${Account}:license-server-endpoint/${LicenseServerEndpointId}	aws:ResourceTag/${TagKey}
product-subscription	arn:${Partition}:license-manager-user-subscriptions:${Region}:${Account}:product-subscription/${ProductSubscriptionId}	aws:ResourceTag/${TagKey}

Condition keys for AWS License Manager User Subscriptions

AWS License Manager User Subscriptions defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS License Manager Linux Subscriptions Manager (license-manager-linux-subscriptions)

AWS Mainframe Modernization Application Testing (apptest)