Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Mainframe Modernization Service

AWS Mainframe Modernization Service (service prefix: m2) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Mainframe Modernization Service
Actions defined by AWS Mainframe Modernization Service
Resource types defined by AWS Mainframe Modernization Service
Condition keys for AWS Mainframe Modernization Service

API operations defined by AWS Mainframe Modernization Service

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CancelBatchJobExecution	m2:CancelBatchJobExecution			Write
CreateApplication	m2:CreateApplication			Write
	m2:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	m2.amazonaws.com	Write
CreateDataSetExportTask	m2:CreateDataSetExportTask			Write
CreateDataSetImportTask	m2:CreateDataSetImportTask			Write
CreateDeployment	m2:CreateDeployment			Write
CreateEnvironment	m2:CreateEnvironment			Write
CreateEnvironment	m2:TagResource			Tagging, Write
DeleteApplication	m2:DeleteApplication			Write
DeleteApplicationFromEnvironment	m2:DeleteApplicationFromEnvironment			Write
DeleteEnvironment	m2:DeleteEnvironment			Write
GetApplication	m2:GetApplication			Read
GetApplicationVersion	m2:GetApplicationVersion			Read
GetBatchJobExecution	m2:GetBatchJobExecution			Read
GetDataSetDetails	m2:GetDataSetDetails			Read
GetDataSetExportTask	m2:GetDataSetExportTask			Read
GetDataSetImportTask	m2:GetDataSetImportTask			Read
GetDeployment	m2:GetDeployment			Read
GetEnvironment	m2:GetEnvironment			Read
GetSignedBluinsightsUrl	m2:GetSignedBluinsightsUrl			Read
ListApplicationVersions	m2:ListApplicationVersions			Read
ListApplications	m2:ListApplications			List
ListBatchJobDefinitions	m2:ListBatchJobDefinitions			Read
ListBatchJobExecutions	m2:ListBatchJobExecutions			Read
ListBatchJobRestartPoints	m2:ListBatchJobRestartPoints			Read
ListDataSetExportHistory	m2:ListDataSetExportHistory			Read
ListDataSetImportHistory	m2:ListDataSetImportHistory			Read
ListDataSets	m2:ListDataSets			Read
ListDeployments	m2:ListDeployments			Read
ListEngineVersions	m2:ListEngineVersions			Read
ListEnvironments	m2:ListEnvironments			List
ListTagsForResource	m2:ListTagsForResource			Read
StartApplication	m2:StartApplication			Write
StartBatchJob	m2:StartBatchJob			Write
StopApplication	m2:StopApplication			Write
TagResource	m2:TagResource			Tagging, Write
UntagResource	m2:UntagResource			Tagging, Write
UpdateApplication	m2:UpdateApplication			Write
UpdateEnvironment	m2:UpdateEnvironment			Write

Actions defined by AWS Mainframe Modernization Service

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CancelBatchJobExecution	Grants permission to cancel the execution of a batch job	Application*	aws:ResourceTag/${TagKey}	Write
CreateApplication	Grants permission to create an application		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDataSetExportTask	Grants permission to create a data set export task	Application*	aws:ResourceTag/${TagKey}	Write
CreateDataSetImportTask	Grants permission to create a data set import task	Application*	aws:ResourceTag/${TagKey}	Write
CreateDeployment	Grants permission to create a deployment	Application*	aws:ResourceTag/${TagKey}	Write
CreateDeployment	Grants permission to create a deployment	Environment	aws:ResourceTag/${TagKey}	Write
CreateEnvironment	Grants permission to Create an environment		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteApplication	Grants permission to delete an application	Application*	aws:ResourceTag/${TagKey}	Write
DeleteApplicationFromEnvironment	Grants permission to delete an application from a runtime environment	Application*	aws:ResourceTag/${TagKey}	Write
DeleteEnvironment	Grants permission to delete a runtime environment	Environment*	aws:ResourceTag/${TagKey}	Write
GetApplication	Grants permission to retrieve an application	Application*	aws:ResourceTag/${TagKey}	Read
GetApplicationVersion	Grants permission to retrieve an application version	Application*	aws:ResourceTag/${TagKey}	Read
GetBatchJobExecution	Grants permission to retrieve a batch job execution	Application*	aws:ResourceTag/${TagKey}	Read
GetDataSetDetails	Grants permission to retrieve data set details	Application*	aws:ResourceTag/${TagKey}	Read
GetDataSetExportTask	Grants permission to export a data set at the specified S3 location	Application*	aws:ResourceTag/${TagKey}	Read
GetDataSetImportTask	Grants permission to retrieve a data set import task	Application*	aws:ResourceTag/${TagKey}	Read
GetDeployment	Grants permission to retrieve a deployment	Application*	aws:ResourceTag/${TagKey}	Read
GetEnvironment	Grants permission to retrieve a runtime environment	Environment*	aws:ResourceTag/${TagKey}	Read
GetSignedBluinsightsUrl	Grants permission to create a signed Bluinsights url			Read
ListApplicationVersions	Grants permission to list the versions of an application	Application*	aws:ResourceTag/${TagKey}	Read
ListApplications	Grants permission to list applications			List
ListBatchJobDefinitions	Grants permission to list batch job definitions	Application*	aws:ResourceTag/${TagKey}	Read
ListBatchJobExecutions	Grants permission to list executions for a batch job	Application*	aws:ResourceTag/${TagKey}	Read
ListBatchJobRestartPoints	Grants permission to retrieve a batch job execution	Application*	aws:ResourceTag/${TagKey}	Read
ListDataSetExportHistory	Grants permission to list data set export history	Application*	aws:ResourceTag/${TagKey}	Read
ListDataSetImportHistory	Grants permission to list data set import history	Application*	aws:ResourceTag/${TagKey}	Read
ListDataSets	Grants permission to list data sets	Application*	aws:ResourceTag/${TagKey}	Read
ListDeployments	Grants permission to list deployments	Application*	aws:ResourceTag/${TagKey}	Read
ListEngineVersions	Grants permission to list engine versions			Read
ListEnvironments	Grants permission to list runtime environments			List
ListTagsForResource	Grants permission to list tags for a resource			Read
StartApplication	Grants permission to start an application	Application*	aws:ResourceTag/${TagKey}	Write
StartBatchJob	Grants permission to start a batch job	Application*	aws:ResourceTag/${TagKey}	Write
StopApplication	Grants permission to stop an application	Application*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag a resource	Application	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource	Grants permission to tag a resource	Environment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to untag a resource	Application	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to untag a resource	Environment	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateApplication	Grants permission to update an application	Application*	aws:ResourceTag/${TagKey}	Write
UpdateEnvironment	Grants permission to update a runtime environment	Environment*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS Mainframe Modernization Service

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
Application	arn:${Partition}:m2:${Region}:${Account}:app/${ApplicationId}	aws:ResourceTag/${TagKey}
Environment	arn:${Partition}:m2:${Region}:${Account}:env/${EnvironmentId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Mainframe Modernization Service

AWS Mainframe Modernization Service defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a tag key and value pair that is allowed in the request	String
aws:ResourceTag/${TagKey}	Filters access by a tag key and value pair of a resource	String
aws:TagKeys	Filters access by a list of tag keys that are allowed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Mainframe Modernization Application Testing (apptest)

AWS Microservice Extractor for .NET (serviceextract)