Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon OpenSearch Ingestion

Amazon OpenSearch Ingestion (service prefix: osis) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon OpenSearch Ingestion
Actions defined by Amazon OpenSearch Ingestion
Resource types defined by Amazon OpenSearch Ingestion
Condition keys for Amazon OpenSearch Ingestion

API operations defined by Amazon OpenSearch Ingestion

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreatePipeline	osis:CreatePipeline			Write
	osis:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	osis-pipelines.amazonaws.com	Write
CreatePipelineEndpoint	osis:CreatePipelineEndpoint			Write
DeletePipeline	osis:DeletePipeline			Write
DeletePipelineEndpoint	osis:DeletePipelineEndpoint			Write
DeleteResourcePolicy	osis:DeleteResourcePolicy			Write
GetPipeline	osis:GetPipeline			Read
GetPipelineBlueprint	osis:GetPipelineBlueprint			Read
GetPipelineChangeProgress	osis:GetPipelineChangeProgress			Read
GetResourcePolicy	osis:GetResourcePolicy			Read
ListPipelineBlueprints	osis:ListPipelineBlueprints			List
ListPipelineEndpointConnections	osis:ListPipelineEndpointConnections			List
ListPipelineEndpoints	osis:ListPipelineEndpoints			List
ListPipelines	osis:ListPipelines			List
ListTagsForResource	osis:ListTagsForResource			Read
PutResourcePolicy	osis:PutResourcePolicy			Write
RevokePipelineEndpointConnections	osis:RevokePipelineEndpointConnections			Write
StartPipeline	osis:StartPipeline			Write
StopPipeline	osis:StopPipeline			Write
TagResource	osis:TagResource			Tagging, Write
UntagResource	osis:UntagResource			Tagging, Write
UpdatePipeline	osis:UpdatePipeline			Write
UpdatePipeline	iam:PassRole	iam:PassedToService	osis-pipelines.amazonaws.com	Write
ValidatePipeline	osis:ValidatePipeline			Read
ValidatePipeline	iam:PassRole	iam:PassedToService	osis-pipelines.amazonaws.com	Write

Actions defined by Amazon OpenSearch Ingestion

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreatePipeline	Grants permission to create an OpenSearch Ingestion pipeline		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreatePipelineEndpoint	Grants permission to create an OpenSearch Ingestion pipeline endpoint	pipeline*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeletePipeline	Grants permission to delete an OpenSearch Ingestion pipeline	pipeline*	aws:ResourceTag/${TagKey}	Write
DeletePipelineEndpoint	Grants permission to delete an OpenSearch Ingestion pipeline endpoint in the current account	pipeline-endpoint*	aws:ResourceTag/${TagKey}	Write
DeleteResourcePolicy	Grants permission to delete a resource policy for an OpenSearch Ingestion resource	pipeline*	aws:ResourceTag/${TagKey}	Write
GetPipeline	Grants permission to retrieve configuration information for an OpenSearch Ingestion pipeline	pipeline*	aws:ResourceTag/${TagKey}	Read
GetPipelineBlueprint	Grants permission to get the contents of an OpenSearch Ingestion pipeline blueprint	pipeline-blueprint*		Read
GetPipelineChangeProgress	Grants permission to get granular information about the status of an OpenSearch Ingestion pipeline	pipeline*	aws:ResourceTag/${TagKey}	Read
GetResourcePolicy	Grants permission to get a resource policy for an OpenSearch Ingestion resource	pipeline*	aws:ResourceTag/${TagKey}	Read
Ingest	Grants permission to ingest data through an OpenSearch Ingestion pipeline	pipeline*	aws:ResourceTag/${TagKey}	Write
ListPipelineBlueprints	Grants permission to list the names of available blueprints for an OpenSearch Ingestion pipeline configuration			List
ListPipelineEndpointConnections	Grants permission to list OpenSearch Ingestion pipeline endpoint connections to pipelines in the current account			List
ListPipelineEndpoints	Grants permission to list OpenSearch Ingestion pipeline endpoints in the current account			List
ListPipelines	Grants permission to list basic configuration for each OpenSearch Ingestion pipeline in the current account and Region			List
ListTagsForResource	Grants permission to list all resource tags associated with an OpenSearch Ingestion pipeline	pipeline*	aws:ResourceTag/${TagKey}	Read
PutResourcePolicy	Grants permission to put a resource policy for an OpenSearch Ingestion resource	pipeline*	aws:ResourceTag/${TagKey}	Write
RevokePipelineEndpointConnections	Grants permission to revoke an OpenSearch Ingestion pipeline endpoint connection from a pipeline in the current account	pipeline*	aws:ResourceTag/${TagKey}	Write
StartPipeline	Grants permission to start an OpenSearch Ingestion pipeline	pipeline*	aws:ResourceTag/${TagKey}	Write
StopPipeline	Grants permission to stop an OpenSearch Ingestion pipeline	pipeline*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to attach resource tags to an OpenSearch Ingestion pipeline	pipeline*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove resource tags from an OpenSearch Ingestion Service pipeline	pipeline*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdatePipeline	Grants permission to modify the configuration of an OpenSearch Ingestion pipeline	pipeline*	aws:ResourceTag/${TagKey}	Write
ValidatePipeline	Grants permission to validate the configuration of an OpenSearch Ingestion pipeline			Read

Resource types defined by Amazon OpenSearch Ingestion

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
pipeline	arn:${Partition}:osis:${Region}:${Account}:pipeline/${PipelineName}	aws:ResourceTag/${TagKey}
pipeline-blueprint	arn:${Partition}:osis:${Region}:${Account}:blueprint/${BlueprintName}
pipeline-endpoint	arn:${Partition}:osis:${Region}:${Account}:endpoint/${EndpointId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon OpenSearch Ingestion

Amazon OpenSearch Ingestion defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon OpenSearch (opensearch)

Amazon OpenSearch Serverless (aoss)