Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Neptune Analytics

Amazon Neptune Analytics (service prefix: neptune-graph) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Neptune Analytics
Actions defined by Amazon Neptune Analytics
Resource types defined by Amazon Neptune Analytics
Condition keys for Amazon Neptune Analytics

API operations defined by Amazon Neptune Analytics

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CancelExportTask	neptune-graph:CancelExportTask			Write
CancelImportTask	neptune-graph:CancelImportTask			Write
CreateGraph	neptune-graph:CreateGraph			Write
CreateGraph	neptune-graph:TagResource			Tagging, Write
CreateGraphSnapshot	neptune-graph:CreateGraphSnapshot			Write
CreateGraphSnapshot	neptune-graph:TagResource			Tagging, Write
CreateGraphUsingImportTask	neptune-graph:CreateGraphUsingImportTask			Write
	neptune-graph:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	neptune-graph.amazonaws.com	Write
CreatePrivateGraphEndpoint	neptune-graph:CreatePrivateGraphEndpoint			Write
DeleteGraph	neptune-graph:DeleteGraph			Write
DeleteGraphSnapshot	neptune-graph:DeleteGraphSnapshot			Write
DeletePrivateGraphEndpoint	neptune-graph:DeletePrivateGraphEndpoint			Write
GetExportTask	neptune-graph:GetExportTask			Read
GetGraph	neptune-graph:GetGraph			Read
GetGraphSnapshot	neptune-graph:GetGraphSnapshot			Read
GetImportTask	neptune-graph:GetImportTask			Read
GetPrivateGraphEndpoint	neptune-graph:GetPrivateGraphEndpoint			Read
ListExportTasks	neptune-graph:ListExportTasks			Read
ListGraphSnapshots	neptune-graph:ListGraphSnapshots			Read
ListGraphs	neptune-graph:ListGraphs			Read
ListImportTasks	neptune-graph:ListImportTasks			Read
ListPrivateGraphEndpoints	neptune-graph:ListPrivateGraphEndpoints			Read
ListTagsForResource	neptune-graph:ListTagsForResource			Read
ResetGraph	neptune-graph:ResetGraph			Write
RestoreGraphFromSnapshot	neptune-graph:RestoreGraphFromSnapshot			Write
RestoreGraphFromSnapshot	neptune-graph:TagResource			Tagging, Write
StartExportTask	neptune-graph:StartExportTask			Write
	neptune-graph:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	neptune-graph.amazonaws.com	Write
StartGraph	neptune-graph:StartGraph			Write
StartImportTask	neptune-graph:StartImportTask			Write
StartImportTask	iam:PassRole	iam:PassedToService	neptune-graph.amazonaws.com	Write
StopGraph	neptune-graph:StopGraph			Write
TagResource	neptune-graph:TagResource			Tagging, Write
UntagResource	neptune-graph:UntagResource			Tagging, Write
UpdateGraph	neptune-graph:UpdateGraph			Write

Actions defined by Amazon Neptune Analytics

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CancelExportTask	Grants permission to cancel an ongoing export task	export-task*	aws:ResourceTag/${TagKey}	Write
CancelImportTask	Grants permission to cancel an ongoing import task	import-task*		Write
CancelQuery	Grants permission to cancel a query	graph*	aws:ResourceTag/${TagKey}	Write
CreateGraph	Grants permission to create a new graph	graph*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys neptune-graph:PublicConnectivity	Write
CreateGraphSnapshot	Grants permission to create a new snapshot from an existing graph	graph*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateGraphSnapshot		graph-snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateGraphUsingImportTask	Grants permission to create a new graph while importing data into the new graph	graph*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys neptune-graph:PublicConnectivity	Write
CreateGraphUsingImportTask		import-task*	aws:RequestTag/${TagKey} aws:TagKeys neptune-graph:PublicConnectivity	Write
CreatePrivateGraphEndpoint	Grants permission to create a new private graph endpoint to access the graph from within a vpc	graph*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteDataViaQuery	Grants permission to delete data via query APIs on the graph	graph*	aws:ResourceTag/${TagKey}	Write
DeleteGraph	Grants permission to delete a graph	graph*	aws:ResourceTag/${TagKey}	Write
DeleteGraphSnapshot	Grants permission to delete a snapshot	graph-snapshot*	aws:ResourceTag/${TagKey}	Write
DeletePrivateGraphEndpoint	Grants permission to delete a private graph endpoint of a graph	graph*	aws:ResourceTag/${TagKey}	Write
GetEngineStatus	Grants permission to get the engine status of the graph	graph*	aws:ResourceTag/${TagKey}	Read
GetExportTask	Grants permission to get details about an export task	export-task*	aws:ResourceTag/${TagKey}	Read
GetGraph	Grants permission to get details about a graph	graph*	aws:ResourceTag/${TagKey}	Read
GetGraphSnapshot	Grants permission to get details about a snapshot	graph-snapshot*	aws:ResourceTag/${TagKey}	Read
GetGraphSummary	Grants permission to get the summary for the data in the graph	graph*	aws:ResourceTag/${TagKey}	Read
GetImportTask	Grants permission to get details about an import task	import-task*		Read
GetPrivateGraphEndpoint	Grants permission to get details about a private graph endpoint of a graph	graph*	aws:ResourceTag/${TagKey}	Read
GetQueryStatus	Grants permission to check the status of a given query	graph*	aws:ResourceTag/${TagKey}	Read
GetStatisticsStatus	Grants permission to get the statistics for the data in the graph	graph*	aws:ResourceTag/${TagKey}	Read
ListExportTasks	Grants permission to list the export tasks in your account	export-task*		Read
ListGraphSnapshots	Grants permission to list the snapshots in your account	graph-snapshot*	aws:ResourceTag/${TagKey}	Read
ListGraphs	Grants permission to list the graphs in your account	graph*	aws:ResourceTag/${TagKey}	Read
ListImportTasks	Grants permission to list the import tasks in your account	import-task*		Read
ListPrivateGraphEndpoints	Grants permission to list the private graph endpoints for a given graph	graph*	aws:ResourceTag/${TagKey}	Read
ListQueries	Grants permission to check the status of all active queries	graph*	aws:ResourceTag/${TagKey}	Read
ListTagsForResource	Grants permission to lists tag for a Neptune Analytics resource	graph	aws:ResourceTag/${TagKey}	Read
ListTagsForResource		graph-snapshot	aws:ResourceTag/${TagKey}	Read
ReadDataViaQuery	Grants permission to read data via query APIs on the graph	graph*	aws:ResourceTag/${TagKey}	Read
ResetGraph	Grants permission to reset a graph which deletes all data within the graph	graph*	aws:ResourceTag/${TagKey}	Write
RestoreGraphFromSnapshot	Grants permission to create a new graph from an existing snapshot	graph*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys neptune-graph:PublicConnectivity	Write
RestoreGraphFromSnapshot		graph-snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys neptune-graph:PublicConnectivity	Write
StartExportTask	Grants permission to export data from an existing graph	export-task*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
StartExportTask	Grants permission to export data from an existing graph	graph*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
StartGraph	Grants permission to start a graph	graph*	aws:ResourceTag/${TagKey}	Write
StartImportTask	Grants permission to import data into an existing graph	graph*	aws:ResourceTag/${TagKey}	Write
StartImportTask	Grants permission to import data into an existing graph	import-task*		Write
StopGraph	Grants permission to stop a graph	graph*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag a Neptune Analytics resource	graph	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource	Grants permission to tag a Neptune Analytics resource	graph-snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to untag a Neptune Analytics resource	graph	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to untag a Neptune Analytics resource	graph-snapshot	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateGraph	Grants permission to modify a graph	graph*	aws:ResourceTag/${TagKey} neptune-graph:PublicConnectivity	Write
WriteDataViaQuery	Grants permission to write data via query APIs on the graph	graph*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Neptune Analytics

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
export-task	arn:${Partition}:neptune-graph:${Region}:${Account}:export-task/${ResourceId}
graph	arn:${Partition}:neptune-graph:${Region}:${Account}:graph/${ResourceId}	aws:ResourceTag/${TagKey}
graph-snapshot	arn:${Partition}:neptune-graph:${Region}:${Account}:graph-snapshot/${ResourceId}	aws:ResourceTag/${TagKey}
import-task	arn:${Partition}:neptune-graph:${Region}:${Account}:import-task/${ResourceId}

Condition keys for Amazon Neptune Analytics

Amazon Neptune Analytics defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a tag's key and value in a request	String
aws:ResourceTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:TagKeys	Filters access by the tag keys in a request	ArrayOfString
neptune-graph:PublicConnectivity	Filters access by the value of the public connectivity parameter provided in the request or its default value, if unspecified. All access to graphs is IAM authenticated	Bool

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Neptune (neptune-db)

Amazon Nimble Studio (nimble)