Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS License Manager

AWS License Manager (service prefix: license-manager) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS License Manager
Actions defined by AWS License Manager
Resource types defined by AWS License Manager
Condition keys for AWS License Manager

API operations defined by AWS License Manager

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AcceptGrant	license-manager:AcceptGrant	Write
CheckInLicense	license-manager:CheckInLicense	Write
CheckoutBorrowLicense	license-manager:CheckoutBorrowLicense	Write
CheckoutLicense	license-manager:CheckoutLicense	Write
CreateGrant	license-manager:CreateGrant	Write
CreateGrant	license-manager:TagResource	Tagging, Write
CreateGrantVersion	license-manager:CreateGrantVersion	Write
CreateLicense	license-manager:CreateLicense	Write
CreateLicense	license-manager:TagResource	Tagging, Write
CreateLicenseAssetGroup	license-manager:CreateLicenseAssetGroup	Write
CreateLicenseAssetGroup	license-manager:TagResource	Tagging, Write
CreateLicenseAssetRuleset	license-manager:CreateLicenseAssetRuleset	Write
CreateLicenseAssetRuleset	license-manager:TagResource	Tagging, Write
CreateLicenseConfiguration	license-manager:CreateLicenseConfiguration	Write
CreateLicenseConfiguration	license-manager:TagResource	Tagging, Write
CreateLicenseConversionTaskForResource	license-manager:CreateLicenseConversionTaskForResource	Write
CreateLicenseManagerReportGenerator	license-manager:CreateLicenseManagerReportGenerator	Write
CreateLicenseManagerReportGenerator	license-manager:TagResource	Tagging, Write
CreateLicenseVersion	license-manager:CreateLicenseVersion	Write
CreateToken	license-manager:CreateToken	Write
DeleteGrant	license-manager:DeleteGrant	Write
DeleteLicense	license-manager:DeleteLicense	Write
DeleteLicenseAssetGroup	license-manager:DeleteLicenseAssetGroup	Write
DeleteLicenseAssetRuleset	license-manager:DeleteLicenseAssetRuleset	Write
DeleteLicenseConfiguration	license-manager:DeleteLicenseConfiguration	Write
DeleteLicenseManagerReportGenerator	license-manager:DeleteLicenseManagerReportGenerator	Write
DeleteToken	license-manager:DeleteToken	Write
ExtendLicenseConsumption	license-manager:ExtendLicenseConsumption	Write
GetAccessToken	license-manager:GetAccessToken	Read
GetGrant	license-manager:GetGrant	Read
GetLicense	license-manager:GetLicense	Read
GetLicenseAssetGroup	license-manager:GetLicenseAssetGroup	Read
GetLicenseAssetRuleset	license-manager:GetLicenseAssetRuleset	Read
GetLicenseConfiguration	license-manager:GetLicenseConfiguration	Read
GetLicenseConversionTask	license-manager:GetLicenseConversionTask	Read
GetLicenseManagerReportGenerator	license-manager:GetLicenseManagerReportGenerator	Read
GetLicenseUsage	license-manager:GetLicenseUsage	Read
GetServiceSettings	license-manager:GetServiceSettings	List
ListAssetsForLicenseAssetGroup	license-manager:ListAssetsForLicenseAssetGroup	List
ListAssociationsForLicenseConfiguration	license-manager:ListAssociationsForLicenseConfiguration	List
ListDistributedGrants	license-manager:ListDistributedGrants	List
ListFailuresForLicenseConfigurationOperations	license-manager:ListFailuresForLicenseConfigurationOperations	List
ListLicenseAssetGroups	license-manager:ListLicenseAssetGroups	List
ListLicenseAssetRulesets	license-manager:ListLicenseAssetRulesets	List
ListLicenseConfigurations	license-manager:ListLicenseConfigurations	List
ListLicenseConfigurationsForOrganization	license-manager:ListLicenseConfigurationsForOrganization	List
ListLicenseConversionTasks	license-manager:ListLicenseConversionTasks	List
ListLicenseManagerReportGenerators	license-manager:ListLicenseManagerReportGenerators	List
ListLicenseSpecificationsForResource	license-manager:ListLicenseSpecificationsForResource	List
ListLicenseVersions	license-manager:ListLicenseVersions	List
ListLicenses	license-manager:ListLicenses	Read
ListReceivedGrants	license-manager:ListReceivedGrants	List
ListReceivedGrantsForOrganization	license-manager:ListReceivedGrantsForOrganization	List
ListReceivedLicenses	license-manager:ListReceivedLicenses	List
ListReceivedLicensesForOrganization	license-manager:ListReceivedLicensesForOrganization	List
ListResourceInventory	license-manager:ListResourceInventory	List
ListTagsForResource	license-manager:ListTagsForResource	Read
ListTokens	license-manager:ListTokens	List
ListUsageForLicenseConfiguration	license-manager:ListUsageForLicenseConfiguration	List
RejectGrant	license-manager:RejectGrant	Write
TagResource	license-manager:TagResource	Tagging, Write
UntagResource	license-manager:UntagResource	Tagging, Write
UpdateLicenseAssetGroup	license-manager:UpdateLicenseAssetGroup	Write
UpdateLicenseAssetRuleset	license-manager:UpdateLicenseAssetRuleset	Write
UpdateLicenseConfiguration	license-manager:UpdateLicenseConfiguration	Write
UpdateLicenseManagerReportGenerator	license-manager:UpdateLicenseManagerReportGenerator	Write
UpdateLicenseSpecificationsForResource	license-manager:UpdateLicenseSpecificationsForResource	Write
UpdateServiceSettings	license-manager:UpdateServiceSettings	Permissions management, Write

Actions defined by AWS License Manager

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptGrant	Grants permission to accept a grant	grant*	aws:ResourceTag/${TagKey}	Write
CheckInLicense	Grants permission to check in license entitlements back to pool			Write
CheckoutBorrowLicense	Grants permission to check out license entitlements for borrow use case	license*	aws:ResourceTag/${TagKey}	Write
CheckoutLicense	Grants permission to check out license entitlements			Write
CreateGrant	Grants permission to create a new grant for license	license*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateGrantVersion	Grants permission to create new version of grant	grant*	aws:ResourceTag/${TagKey}	Write
CreateLicense	Grants permission to create a new license		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLicenseAssetGroup	Grants permission to create a license asset group	license-asset-ruleset*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateLicenseAssetRuleset	Grants permission to create a license asset ruleset		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLicenseConfiguration	Grants permission to create a new license configuration		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLicenseConversionTaskForResource	Grants permission to create a license conversion task for a resource			Write
CreateLicenseManagerReportGenerator	Grants permission to create a report generator for supported license manager resources		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLicenseVersion	Grants permission to create new version of license	license*	aws:ResourceTag/${TagKey}	Write
CreateToken	Grants permission to create a new token for license	license*	aws:ResourceTag/${TagKey}	Write
DeleteGrant	Grants permission to delete a grant	grant*	aws:ResourceTag/${TagKey}	Write
DeleteLicense	Grants permission to delete a license	license*	aws:ResourceTag/${TagKey}	Write
DeleteLicenseAssetGroup	Grants permission to delete a license asset group	license-asset-group*	aws:ResourceTag/${TagKey}	Write
DeleteLicenseAssetRuleset	Grants permission to delete a license asset ruleset	license-asset-ruleset*	aws:ResourceTag/${TagKey}	Write
DeleteLicenseConfiguration	Grants permission to permanently delete a license configuration	license-configuration*	aws:ResourceTag/${TagKey} license-manager:ResourceTag/${TagKey}	Write
DeleteLicenseManagerReportGenerator	Grants permission to delete a report generator	report-generator*	aws:ResourceTag/${TagKey} license-manager:ResourceTag/${TagKey}	Write
DeleteToken	Grants permission to delete token			Write
ExtendLicenseConsumption	Grants permission to extend consumption period of already checkout license entitlements			Write
GetAccessToken	Grants permission to get access token			Read
GetGrant	Grants permission to get a grant	grant*	aws:ResourceTag/${TagKey}	Read
GetLicense	Grants permission to get a license	license*	aws:ResourceTag/${TagKey}	Read
GetLicenseAssetGroup	Grants permission to get a license asset group	license-asset-group*	aws:ResourceTag/${TagKey}	Read
GetLicenseAssetRuleset	Grants permission to get a license asset ruleset	license-asset-ruleset*	aws:ResourceTag/${TagKey}	Read
GetLicenseConfiguration	Grants permission to get a license configuration	license-configuration*	aws:ResourceTag/${TagKey} license-manager:ResourceTag/${TagKey}	Read
GetLicenseConversionTask	Grants permission to retrieve a license conversion task			Read
GetLicenseManagerReportGenerator	Grants permission to get a report generator	report-generator*	aws:ResourceTag/${TagKey} license-manager:ResourceTag/${TagKey}	Read
GetLicenseUsage	Grants permission to get a license usage	license*	aws:ResourceTag/${TagKey}	Read
GetServiceSettings	Grants permission to get service settings			List
ListAssetsForLicenseAssetGroup	Grants permission to list assets for a license asset group	license-asset-group*	aws:ResourceTag/${TagKey}	List
ListAssociationsForLicenseConfiguration	Grants permission to list associations for a selected license configuration	license-configuration*	aws:ResourceTag/${TagKey} license-manager:ResourceTag/${TagKey}	List
ListDistributedGrants	Grants permission to list distributed grants			List
ListFailuresForLicenseConfigurationOperations	Grants permission to list the license configuration operations that failed	license-configuration*	aws:ResourceTag/${TagKey} license-manager:ResourceTag/${TagKey}	List
ListLicenseAssetGroups	Grants permission to list license asset groups	license-asset-group	aws:ResourceTag/${TagKey}	List
ListLicenseAssetRulesets	Grants permission to list license asset rulesets	license-asset-ruleset	aws:ResourceTag/${TagKey}	List
ListLicenseConfigurations	Grants permission to list license configurations			List
ListLicenseConfigurationsForOrganization	Grants permission to list license configurations for organization			List
ListLicenseConversionTasks	Grants permission to list license conversion tasks			List
ListLicenseManagerReportGenerators	Grants permission to list report generators	license-configuration	aws:ResourceTag/${TagKey} license-manager:ResourceTag/${TagKey}	List
ListLicenseSpecificationsForResource	Grants permission to list license specifications associated with a selected resource			List
ListLicenseVersions	Grants permission to list license versions	license*	aws:ResourceTag/${TagKey}	List
ListLicenses	Grants permission to list licenses			Read
ListReceivedGrants	Grants permission to list received grants			List
ListReceivedGrantsForOrganization	Grants permission to list received grants for organization			List
ListReceivedLicenses	Grants permission to list received licenses			List
ListReceivedLicensesForOrganization	Grants permission to list received licenses for organization			List
ListResourceInventory	Grants permission to list resource inventory			List
ListTagsForResource	Grants permission to list tags for a selected resource	grant	aws:ResourceTag/${TagKey}	Read
		license	aws:ResourceTag/${TagKey}
		license-asset-group	aws:ResourceTag/${TagKey}
		license-asset-ruleset	aws:ResourceTag/${TagKey}
		license-configuration	aws:ResourceTag/${TagKey} license-manager:ResourceTag/${TagKey}
		report-generator	aws:ResourceTag/${TagKey} license-manager:ResourceTag/${TagKey}
ListTokens	Grants permission to list tokens			List
ListUsageForLicenseConfiguration	Grants permission to list usage records for selected license configuration	license-configuration*	aws:ResourceTag/${TagKey} license-manager:ResourceTag/${TagKey}	List
RejectGrant	Grants permission to reject a grant	grant*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag a selected resource	grant	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		license	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		license-asset-group	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		license-asset-ruleset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		license-configuration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys license-manager:ResourceTag/${TagKey}
		report-generator	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys license-manager:ResourceTag/${TagKey}
UntagResource	Grants permission to untag a selected resource	grant	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		license	aws:ResourceTag/${TagKey} aws:TagKeys
		license-asset-group	aws:ResourceTag/${TagKey} aws:TagKeys
		license-asset-ruleset	aws:ResourceTag/${TagKey} aws:TagKeys
		license-configuration	aws:ResourceTag/${TagKey} aws:TagKeys license-manager:ResourceTag/${TagKey}
		report-generator	aws:ResourceTag/${TagKey} aws:TagKeys license-manager:ResourceTag/${TagKey}
UpdateLicenseAssetGroup	Grants permission to update a license asset group	license-asset-group*	aws:ResourceTag/${TagKey}	Write
UpdateLicenseAssetGroup	Grants permission to update a license asset group	license-asset-ruleset*	aws:ResourceTag/${TagKey}	Write
UpdateLicenseAssetRuleset	Grants permission to update a license asset ruleset	license-asset-ruleset*	aws:ResourceTag/${TagKey}	Write
UpdateLicenseConfiguration	Grants permission to update an existing license configuration	license-configuration*	aws:ResourceTag/${TagKey} license-manager:ResourceTag/${TagKey}	Write
UpdateLicenseManagerReportGenerator	Grants permission to update a report generator for supported license manager resources	report-generator*	aws:ResourceTag/${TagKey} license-manager:ResourceTag/${TagKey}	Write
UpdateLicenseSpecificationsForResource	Grants permission to updates license specifications for a selected resource	license-configuration*	aws:ResourceTag/${TagKey} license-manager:ResourceTag/${TagKey}	Write
UpdateServiceSettings	Grants permission to updates service settings			Permissions management, Write

Resource types defined by AWS License Manager

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
grant	arn:${Partition}:license-manager::${Account}:grant:${GrantId}	aws:ResourceTag/${TagKey}
license	arn:${Partition}:license-manager::${Account}:license:${LicenseId}	aws:ResourceTag/${TagKey}
license-asset-group	arn:${Partition}:license-manager:${Region}:${Account}:license-asset-group:${LicenseAssetGroupId}	aws:ResourceTag/${TagKey}
license-asset-ruleset	arn:${Partition}:license-manager:${Region}:${Account}:license-asset-ruleset:${LicenseAssetRulesetId}	aws:ResourceTag/${TagKey}
license-configuration	arn:${Partition}:license-manager:${Region}:${Account}:license-configuration:${LicenseConfigurationId}	aws:ResourceTag/${TagKey} license-manager:ResourceTag/${TagKey}
report-generator	arn:${Partition}:license-manager:${Region}:${Account}:report-generator:${ReportGeneratorId}	aws:ResourceTag/${TagKey} license-manager:ResourceTag/${TagKey}

Condition keys for AWS License Manager

AWS License Manager defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by tag keys that are passed in the request	ArrayOfString
license-manager:ResourceTag/${TagKey}	Filters access by the tag key-value pairs attached to the resource	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Launch Wizard (launchwizard)

AWS License Manager Linux Subscriptions Manager (license-manager-linux-subscriptions)