Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon CloudWatch Observability Admin Service

Amazon CloudWatch Observability Admin Service (service prefix: observabilityadmin) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon CloudWatch Observability Admin Service
Actions defined by Amazon CloudWatch Observability Admin Service
Resource types defined by Amazon CloudWatch Observability Admin Service
Condition keys for Amazon CloudWatch Observability Admin Service

API operations defined by Amazon CloudWatch Observability Admin Service

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateCentralizationRuleForOrganization	observabilityadmin:CreateCentralizationRuleForOrganization			Write
CreateCentralizationRuleForOrganization	observabilityadmin:TagResource			Tagging, Write
CreateS3TableIntegration	observabilityadmin:CreateS3TableIntegration			Write
	observabilityadmin:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	logs.amazonaws.com, test.logs.amazonaws.com	Write
CreateTelemetryPipeline	observabilityadmin:CreateTelemetryPipeline			Write
	observabilityadmin:TagResource			Tagging, Write
	cloudwatch:PutPipelineRule			Write
	iam:PassRole	iam:PassedToService	logs.amazonaws.com, telemetry-pipelines.observabilityadmin.amazonaws.com	Write
CreateTelemetryRule	observabilityadmin:CreateTelemetryRule			Write
CreateTelemetryRule	observabilityadmin:TagResource			Tagging, Write
CreateTelemetryRuleForOrganization	observabilityadmin:CreateTelemetryRuleForOrganization			Write
CreateTelemetryRuleForOrganization	observabilityadmin:TagResource			Tagging, Write
DeleteCentralizationRuleForOrganization	observabilityadmin:DeleteCentralizationRuleForOrganization			Write
DeleteS3TableIntegration	observabilityadmin:DeleteS3TableIntegration			Write
DeleteTelemetryPipeline	observabilityadmin:DeleteTelemetryPipeline			Write
DeleteTelemetryPipeline	cloudwatch:DeletePipelineRule			Write
DeleteTelemetryRule	observabilityadmin:DeleteTelemetryRule			Write
DeleteTelemetryRuleForOrganization	observabilityadmin:DeleteTelemetryRuleForOrganization			Write
GetCentralizationRuleForOrganization	observabilityadmin:GetCentralizationRuleForOrganization			Read
GetS3TableIntegration	observabilityadmin:GetS3TableIntegration			Read
GetTelemetryEnrichmentStatus	observabilityadmin:GetTelemetryEnrichmentStatus			Read
GetTelemetryEvaluationStatus	observabilityadmin:GetTelemetryEvaluationStatus			Read
GetTelemetryEvaluationStatusForOrganization	observabilityadmin:GetTelemetryEvaluationStatusForOrganization			Read
GetTelemetryPipeline	observabilityadmin:GetTelemetryPipeline			Read
GetTelemetryRule	observabilityadmin:GetTelemetryRule			Read
GetTelemetryRuleForOrganization	observabilityadmin:GetTelemetryRuleForOrganization			Read
ListCentralizationRulesForOrganization	observabilityadmin:ListCentralizationRulesForOrganization			List
ListResourceTelemetry	observabilityadmin:ListResourceTelemetry			Read
ListResourceTelemetryForOrganization	observabilityadmin:ListResourceTelemetryForOrganization			Read
ListS3TableIntegrations	observabilityadmin:ListS3TableIntegrations			List
ListTagsForResource	observabilityadmin:ListTagsForResource			List
ListTelemetryPipelines	observabilityadmin:ListTelemetryPipelines			List
ListTelemetryRules	observabilityadmin:ListTelemetryRules			List
ListTelemetryRulesForOrganization	observabilityadmin:ListTelemetryRulesForOrganization			List
StartTelemetryEnrichment	observabilityadmin:StartTelemetryEnrichment			Write
StartTelemetryEvaluation	observabilityadmin:StartTelemetryEvaluation			Write
StartTelemetryEvaluationForOrganization	observabilityadmin:StartTelemetryEvaluationForOrganization			Write
StopTelemetryEnrichment	observabilityadmin:StopTelemetryEnrichment			Write
StopTelemetryEvaluation	observabilityadmin:StopTelemetryEvaluation			Write
StopTelemetryEvaluationForOrganization	observabilityadmin:StopTelemetryEvaluationForOrganization			Write
TagResource	observabilityadmin:TagResource			Tagging, Write
TestTelemetryPipeline	observabilityadmin:TestTelemetryPipeline			Read
UntagResource	observabilityadmin:UntagResource			Tagging, Write
UpdateCentralizationRuleForOrganization	observabilityadmin:UpdateCentralizationRuleForOrganization			Write
UpdateTelemetryPipeline	observabilityadmin:UpdateTelemetryPipeline			Write
	cloudwatch:PutPipelineRule			Write
	iam:PassRole	iam:PassedToService	logs.amazonaws.com, telemetry-pipelines.observabilityadmin.amazonaws.com	Write
UpdateTelemetryRule	observabilityadmin:UpdateTelemetryRule			Write
UpdateTelemetryRuleForOrganization	observabilityadmin:UpdateTelemetryRuleForOrganization			Write
ValidateTelemetryPipelineConfiguration	observabilityadmin:ValidateTelemetryPipelineConfiguration			Read

Actions defined by Amazon CloudWatch Observability Admin Service

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateCentralizationRuleForOrganization	Grants permission to create a new organization centralization rule with the specified name for the organization	organization-centralization-rule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys observabilityadmin:CentralizationBackupRegion observabilityadmin:CentralizationDestinationAccount observabilityadmin:CentralizationDestinationRegion observabilityadmin:CentralizationRuleName observabilityadmin:CentralizationSourceId observabilityadmin:CentralizationSourceRegions	Write
CreateS3TableIntegration	Grants permission to create a new s3 table integration with the specified configuration	s3tableintegration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTelemetryPipeline	Grants permission to create a new telemetry pipeline with the specified name and configuration	telemetry-pipeline*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys observabilityadmin:SourceType	Write
CreateTelemetryRule	Grants permission to create a new telemetry rule with the specified name for the account	telemetry-rule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys observabilityadmin:TargetRegions	Write
CreateTelemetryRuleForOrganization	Grants permission to create a new organization telemetry rule with the specified name for the organization	organization-telemetry-rule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys observabilityadmin:TargetRegions	Write
DeleteCentralizationRuleForOrganization	Grants permission to delete an organization centralization rule with the specified name for the organization	organization-centralization-rule*	aws:ResourceTag/${TagKey} observabilityadmin:CentralizationRuleName	Write
DeleteS3TableIntegration	Grants permission to delete the s3 table integration with the specified arn	s3tableintegration*	aws:ResourceTag/${TagKey}	Write
DeleteTelemetryPipeline	Grants permission to delete the telemetry pipeline with the specified arn	telemetry-pipeline*	aws:ResourceTag/${TagKey}	Write
DeleteTelemetryRule	Grants permission to delete a telemetry rule with the specified name for the account	telemetry-rule*	aws:ResourceTag/${TagKey}	Write
DeleteTelemetryRuleForOrganization	Grants permission to delete an organization telemetry rule with the specified name for the organization	organization-telemetry-rule*	aws:ResourceTag/${TagKey}	Write
GetCentralizationRuleForOrganization	Grants permission to retrieve the specified organization centralization rule for the organization	organization-centralization-rule*	aws:ResourceTag/${TagKey} observabilityadmin:CentralizationRuleName	Read
GetS3TableIntegration	Grants permission to retrieve the specified s3 table integration for the account	s3tableintegration*	aws:ResourceTag/${TagKey}	Read
GetTelemetryEnrichmentStatus	Grants permission to retrieve the status of the Resource tags for telemetry feature for the account			Read
GetTelemetryEvaluationStatus	Grants permission to retrieve the Telemetry Config feature status for the account			Read
GetTelemetryEvaluationStatusForOrganization	Grants permission to retrieve the Telemetry Config feature status for the organization			Read
GetTelemetryPipeline	Grants permission to Get the telemetry pipeline with the specified name or arn	telemetry-pipeline*	aws:ResourceTag/${TagKey}	Read
GetTelemetryRule	Grants permission to retrieve the specified telemetry rule for the account	telemetry-rule*	aws:ResourceTag/${TagKey}	Read
GetTelemetryRuleForOrganization	Grants permission to retrieve the specified organization telemetry rule for the organization	organization-telemetry-rule*	aws:ResourceTag/${TagKey}	Read
ListCentralizationRulesForOrganization	Grants permission to list the centralization rules for the organization			List
ListResourceTelemetry	Grants permission to retrieve telemetry configurations for resources associated with the account		observabilityadmin:TargetRegions	Read
ListResourceTelemetryForOrganization	Grants permission to retrieve telemetry configurations for resources associated with accounts in the organization		observabilityadmin:TargetRegions	Read
ListS3TableIntegrations	Grants permission to list s3 table integrations for the account			List
ListTagsForResource	Grants permission to list the tags for the specified resource	organization-centralization-rule	aws:ResourceTag/${TagKey}	List
		organization-telemetry-rule	aws:ResourceTag/${TagKey}
		s3tableintegration	aws:ResourceTag/${TagKey}
		telemetry-pipeline	aws:ResourceTag/${TagKey}
		telemetry-rule	aws:ResourceTag/${TagKey}
ListTelemetryPipelines	Grants permission to List telemetry pipelines for the account			List
ListTelemetryRules	Grants permission to list the telemetry rules for the account			List
ListTelemetryRulesForOrganization	Grants permission to list the telemetry rules for the organization			List
StartTelemetryEnrichment	Grants permission to enable the Resource tags for telemetry feature for the account			Write
StartTelemetryEvaluation	Grants permission to start the Telemetry Config feature for the account		observabilityadmin:TargetRegions	Write
StartTelemetryEvaluationForOrganization	Grants permission to start the Telemetry Config feature for the organization		observabilityadmin:TargetRegions	Write
StopTelemetryEnrichment	Grants permission to disable the Resource tags for telemetry feature for the account			Write
StopTelemetryEvaluation	Grants permission to stop the Telemetry Config feature for the account			Write
StopTelemetryEvaluationForOrganization	Grants permission to stop the Telemetry Config feature for the organization			Write
TagResource	Grants permission to add or update the specified tags for the specified resource	organization-centralization-rule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		organization-telemetry-rule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		s3tableintegration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		telemetry-pipeline	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		telemetry-rule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
TestTelemetryPipeline	Grants permission to Test a telemetry pipeline configuration with sample data			Read
UntagResource	Grants permission to remove the specified tags from the specified resource	organization-centralization-rule	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		organization-telemetry-rule	aws:ResourceTag/${TagKey} aws:TagKeys
		s3tableintegration	aws:ResourceTag/${TagKey} aws:TagKeys
		telemetry-pipeline	aws:ResourceTag/${TagKey} aws:TagKeys
		telemetry-rule	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateCentralizationRuleForOrganization	Grants permission to update the specified centralization rule for the organization	organization-centralization-rule*	aws:ResourceTag/${TagKey} observabilityadmin:CentralizationBackupRegion observabilityadmin:CentralizationDestinationAccount observabilityadmin:CentralizationDestinationRegion observabilityadmin:CentralizationRuleName observabilityadmin:CentralizationSourceId observabilityadmin:CentralizationSourceRegions	Write
UpdateTelemetryPipeline	Grants permission to Update the telemetry pipeline with the specified arn	telemetry-pipeline*	aws:ResourceTag/${TagKey}	Write
UpdateTelemetryRule	Grants permission to update the specified telemetry rule for the account	telemetry-rule*	aws:ResourceTag/${TagKey} observabilityadmin:TargetRegions	Write
UpdateTelemetryRuleForOrganization	Grants permission to update the specified telemetry rule for the organization	organization-telemetry-rule*	aws:ResourceTag/${TagKey} observabilityadmin:TargetRegions	Write
ValidateTelemetryPipelineConfiguration	Grants permission to Validate a telemetry pipeline configuration			Read

Resource types defined by Amazon CloudWatch Observability Admin Service

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
organization-centralization-rule	arn:${Partition}:observabilityadmin:${Region}:${Account}:organization-centralization-rule/${CentralizationRuleName}	aws:ResourceTag/${TagKey}
organization-telemetry-rule	arn:${Partition}:observabilityadmin:${Region}:${Account}:organization-telemetry-rule/${TelemetryRuleName}	aws:ResourceTag/${TagKey}
s3tableintegration	arn:${Partition}:observabilityadmin:${Region}:${Account}:s3tableintegration/${S3TableIntegrationIdentifier}	aws:ResourceTag/${TagKey}
telemetry-pipeline	arn:${Partition}:observabilityadmin:${Region}:${Account}:telemetry-pipeline/${TelemetryPipelineIdentifier}	aws:ResourceTag/${TagKey}
telemetry-rule	arn:${Partition}:observabilityadmin:${Region}:${Account}:telemetry-rule/${TelemetryRuleName}	aws:ResourceTag/${TagKey}

Condition keys for Amazon CloudWatch Observability Admin Service

Amazon CloudWatch Observability Admin Service defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
observabilityadmin:CentralizationBackupRegion	Filters access by the backup region that is passed in the request	String
observabilityadmin:CentralizationDestinationAccount	Filters access by the destination account that is passed in the request	String
observabilityadmin:CentralizationDestinationRegion	Filters access by the destination region that is passed in the request	String
observabilityadmin:CentralizationRuleName	Filters access by the name of the centralization rule that is passed in the request	String
observabilityadmin:CentralizationSourceId	Filters access by the source account, organizational unit, or organization IDs that is passed in the request	ArrayOfString
observabilityadmin:CentralizationSourceRegions	Filters access by the source regions that are passed in the request	ArrayOfString
observabilityadmin:SourceType	Filters access by the source type that is passed in the request	String
observabilityadmin:TargetRegions	Filters access by the regions that are targetted by the request	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon CloudWatch Observability Access Manager (oam)

Amazon CloudWatch Synthetics (synthetics)