Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Network Flow Monitor

Network Flow Monitor (service prefix: networkflowmonitor) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Network Flow Monitor
Actions defined by Network Flow Monitor
Resource types defined by Network Flow Monitor
Condition keys for Network Flow Monitor

API operations defined by Network Flow Monitor

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
CreateMonitor	networkflowmonitor:CreateMonitor	Write
CreateMonitor	networkflowmonitor:TagResource	Tagging, Write
CreateScope	networkflowmonitor:CreateScope	Write
CreateScope	networkflowmonitor:TagResource	Tagging, Write
DeleteMonitor	networkflowmonitor:DeleteMonitor	Write
DeleteScope	networkflowmonitor:DeleteScope	Write
GetMonitor	networkflowmonitor:GetMonitor	Read
GetQueryResultsMonitorTopContributors	networkflowmonitor:GetQueryResultsMonitorTopContributors	Read
GetQueryResultsWorkloadInsightsTopContributors	networkflowmonitor:GetQueryResultsWorkloadInsightsTopContributors	Read
GetQueryResultsWorkloadInsightsTopContributorsData	networkflowmonitor:GetQueryResultsWorkloadInsightsTopContributorsData	Read
GetQueryStatusMonitorTopContributors	networkflowmonitor:GetQueryStatusMonitorTopContributors	Read
GetQueryStatusWorkloadInsightsTopContributors	networkflowmonitor:GetQueryStatusWorkloadInsightsTopContributors	Read
GetQueryStatusWorkloadInsightsTopContributorsData	networkflowmonitor:GetQueryStatusWorkloadInsightsTopContributorsData	Read
GetScope	networkflowmonitor:GetScope	Read
ListMonitors	networkflowmonitor:ListMonitors	List
ListScopes	networkflowmonitor:ListScopes	List
ListTagsForResource	networkflowmonitor:ListTagsForResource	Read
StartQueryMonitorTopContributors	networkflowmonitor:StartQueryMonitorTopContributors	Write
StartQueryWorkloadInsightsTopContributors	networkflowmonitor:StartQueryWorkloadInsightsTopContributors	Write
StartQueryWorkloadInsightsTopContributorsData	networkflowmonitor:StartQueryWorkloadInsightsTopContributorsData	Write
StopQueryMonitorTopContributors	networkflowmonitor:StopQueryMonitorTopContributors	Write
StopQueryWorkloadInsightsTopContributors	networkflowmonitor:StopQueryWorkloadInsightsTopContributors	Write
StopQueryWorkloadInsightsTopContributorsData	networkflowmonitor:StopQueryWorkloadInsightsTopContributorsData	Write
TagResource	networkflowmonitor:TagResource	Tagging, Write
UntagResource	networkflowmonitor:UntagResource	Tagging, Write
UpdateMonitor	networkflowmonitor:UpdateMonitor	Write
UpdateScope	networkflowmonitor:UpdateScope	Write

Actions defined by Network Flow Monitor

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateMonitor	Grants permission to create a monitor	monitor*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateScope	Grants permission to create a scope		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteMonitor	Grants permission to delete a monitor	monitor*	aws:ResourceTag/${TagKey}	Write
DeleteScope	Grants permission to delete a scope	scope*	aws:ResourceTag/${TagKey}	Write
GetMonitor	Grants permission to get information about a monitor	monitor*	aws:ResourceTag/${TagKey}	Read
GetQueryResultsMonitorTopContributors	Grants permission to get the results of a query that retrieves top contributors data for a monitor	monitor*	aws:ResourceTag/${TagKey}	Read
GetQueryResultsWorkloadInsightsTopContributors	Grants permission to get the results of a query that retrieves top contributors for workload insights	scope*	aws:ResourceTag/${TagKey}	Read
GetQueryResultsWorkloadInsightsTopContributorsData	Grants permission to get the results of a query that retrieves top contributors data points for workload insights	scope*	aws:ResourceTag/${TagKey}	Read
GetQueryStatusMonitorTopContributors	Grants permission to get the status of a query that retrieves top contributors data for a monitor	monitor*	aws:ResourceTag/${TagKey}	Read
GetQueryStatusWorkloadInsightsTopContributors	Grants permission to get the status of a query that retrieves top contributors for workload insights	scope*	aws:ResourceTag/${TagKey}	Read
GetQueryStatusWorkloadInsightsTopContributorsData	Grants permission to get the status of a query that retrieves top contributors data points for workload insights	scope*	aws:ResourceTag/${TagKey}	Read
GetScope	Grants permission to get information about a scope	scope*	aws:ResourceTag/${TagKey}	Read
ListMonitors	Grants permission to list all monitors in an account and their statuses			List
ListScopes	Grants permission to get all scopes for an account			List
ListTagsForResource	Grants permission to list the tags for a resource	monitor	aws:ResourceTag/${TagKey}	Read
ListTagsForResource	Grants permission to list the tags for a resource	scope	aws:ResourceTag/${TagKey}	Read
Publish	Grants permission to publish a report			Write
StartQueryMonitorTopContributors	Grants permission to start a query for retrieving top contributors data for a monitor	monitor*	aws:ResourceTag/${TagKey}	Write
StartQueryWorkloadInsightsTopContributors	Grants permission to start a query for retrieving top contributors data for workload insights	scope*	aws:ResourceTag/${TagKey}	Write
StartQueryWorkloadInsightsTopContributorsData	Grants permission to start a query for retrieving top contributors data points for workload insights	scope*	aws:ResourceTag/${TagKey}	Write
StopQueryMonitorTopContributors	Grants permission to stop a query for retrieving top contributors data for a monitor	monitor*	aws:ResourceTag/${TagKey}	Write
StopQueryWorkloadInsightsTopContributors	Grants permission to stop a query for retrieving top contributors for workload insights	scope*	aws:ResourceTag/${TagKey}	Write
StopQueryWorkloadInsightsTopContributorsData	Grants permission to stop a query for retrieving top contributors data points for workload insights	scope*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add tags to a resource	monitor	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource	Grants permission to add tags to a resource	scope	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from a resource	monitor	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from a resource	scope	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateMonitor	Grants permission to update a monitor	monitor*	aws:ResourceTag/${TagKey}	Write
UpdateScope	Grants permission to update a scope	scope*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Network Flow Monitor

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
monitor	arn:${Partition}:networkflowmonitor:${Region}:${Account}:monitor/${MonitorName}	aws:ResourceTag/${TagKey}
scope	arn:${Partition}:networkflowmonitor:${Region}:${Account}:scope/${ScopeId}	aws:ResourceTag/${TagKey}

Condition keys for Network Flow Monitor

Network Flow Monitor defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the tag keys in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Multi-party approval (mpa)

Service Quotas (servicequotas)