Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Private CA Connector for Active Directory

AWS Private CA Connector for Active Directory (service prefix: pca-connector-ad) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Private CA Connector for Active Directory
Actions defined by AWS Private CA Connector for Active Directory
Resource types defined by AWS Private CA Connector for Active Directory
Condition keys for AWS Private CA Connector for Active Directory

API operations defined by AWS Private CA Connector for Active Directory

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
CreateConnector	pca-connector-ad:CreateConnector	Write
CreateConnector	pca-connector-ad:TagResource	Tagging, Write
CreateDirectoryRegistration	pca-connector-ad:CreateDirectoryRegistration	Write
CreateDirectoryRegistration	pca-connector-ad:TagResource	Tagging, Write
CreateServicePrincipalName	pca-connector-ad:CreateServicePrincipalName	Write
CreateTemplate	pca-connector-ad:CreateTemplate	Write
CreateTemplate	pca-connector-ad:TagResource	Tagging, Write
CreateTemplateGroupAccessControlEntry	pca-connector-ad:CreateTemplateGroupAccessControlEntry	Write
DeleteConnector	pca-connector-ad:DeleteConnector	Write
DeleteDirectoryRegistration	pca-connector-ad:DeleteDirectoryRegistration	Write
DeleteServicePrincipalName	pca-connector-ad:DeleteServicePrincipalName	Write
DeleteTemplate	pca-connector-ad:DeleteTemplate	Write
DeleteTemplateGroupAccessControlEntry	pca-connector-ad:DeleteTemplateGroupAccessControlEntry	Write
GetConnector	pca-connector-ad:GetConnector	Read
GetDirectoryRegistration	pca-connector-ad:GetDirectoryRegistration	Read
GetServicePrincipalName	pca-connector-ad:GetServicePrincipalName	Read
GetTemplate	pca-connector-ad:GetTemplate	Read
GetTemplateGroupAccessControlEntry	pca-connector-ad:GetTemplateGroupAccessControlEntry	Read
ListConnectors	pca-connector-ad:ListConnectors	List
ListDirectoryRegistrations	pca-connector-ad:ListDirectoryRegistrations	List
ListServicePrincipalNames	pca-connector-ad:ListServicePrincipalNames	List
ListTagsForResource	pca-connector-ad:ListTagsForResource	Read
ListTemplateGroupAccessControlEntries	pca-connector-ad:ListTemplateGroupAccessControlEntries	List
ListTemplates	pca-connector-ad:ListTemplates	List
TagResource	pca-connector-ad:TagResource	Tagging, Write
UntagResource	pca-connector-ad:UntagResource	Tagging, Write
UpdateTemplate	pca-connector-ad:UpdateTemplate	Write
UpdateTemplateGroupAccessControlEntry	pca-connector-ad:UpdateTemplateGroupAccessControlEntry	Write

Actions defined by AWS Private CA Connector for Active Directory

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateConnector	Grants permission to create a Connector in your account		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDirectoryRegistration	Grants permission to create a DirectoryRegistration in your account		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateServicePrincipalName	Grants permission to create a ServicePrincipalName for a DirectoryRegistration	DirectoryRegistration*	aws:ResourceTag/${TagKey}	Write
CreateTemplate	Grants permission to create a Template for a Connector	Connector*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTemplateGroupAccessControlEntry	Grants permission to create a TemplateGroupAccessControlEntry for a Template	Template*	aws:ResourceTag/${TagKey}	Write
DeleteConnector	Grants permission to delete a Connector in your account	Connector*	aws:ResourceTag/${TagKey}	Write
DeleteDirectoryRegistration	Grants permission to delete a DirectoryRegistration in your account	DirectoryRegistration*	aws:ResourceTag/${TagKey}	Write
DeleteServicePrincipalName	Grants permission to delete a ServicePrincipalName for a DirectoryRegistration	DirectoryRegistration*	aws:ResourceTag/${TagKey}	Write
DeleteTemplate	Grants permission to delete a Template for a Connector	Template*	aws:ResourceTag/${TagKey}	Write
DeleteTemplateGroupAccessControlEntry	Grants permission to delete a TemplateGroupAccessControlEntry for a Template	Template*	aws:ResourceTag/${TagKey}	Write
GetConnector	Grants permission to get a Connector in your account	Connector*	aws:ResourceTag/${TagKey}	Read
GetDirectoryRegistration	Grants permission to get a DirectoryRegistration in your account	DirectoryRegistration*	aws:ResourceTag/${TagKey}	Read
GetServicePrincipalName	Grants permission to get a ServicePrincipalName for a DirectoryRegistration	DirectoryRegistration*	aws:ResourceTag/${TagKey}	Read
GetTemplate	Grants permission to get a Template for a Connector	Template*	aws:ResourceTag/${TagKey}	Read
GetTemplateGroupAccessControlEntry	Grants permission to get a TemplateGroupAccessControlEntry for a Template	Template*	aws:ResourceTag/${TagKey}	Read
ListConnectors	Grants permission to list the Connectors in your account			List
ListDirectoryRegistrations	Grants permission to list the DirectoryRegistrations in your account			List
ListServicePrincipalNames	Grants permission to list the ServicePrincipalNames for a DirectoryRegistration	DirectoryRegistration*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list the tags for a pca-connector-ad resource in your account			Read
ListTemplateGroupAccessControlEntries	Grants permission to list the TemplateGroupAccessControlEntries for a Template	Template*	aws:ResourceTag/${TagKey}	List
ListTemplates	Grants permission to list the Templates for a Connector	Connector*	aws:ResourceTag/${TagKey}	List
TagResource	Grants permission to tag a pca-connector-ad resource in your account	Connector	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		DirectoryRegistration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Template	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag a pca-connector-ad resource in your account	Connector	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		DirectoryRegistration	aws:ResourceTag/${TagKey} aws:TagKeys
		Template	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateTemplate	Grants permission to update a Template for a Connector	Template*	aws:ResourceTag/${TagKey}	Write
UpdateTemplateGroupAccessControlEntry	Grants permission to update a TemplateGroupAccessControlEntry for a Template	Template*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS Private CA Connector for Active Directory

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
Connector	arn:${Partition}:pca-connector-ad:${Region}:${Account}:connector/${ConnectorId}	aws:ResourceTag/${TagKey}
DirectoryRegistration	arn:${Partition}:pca-connector-ad:${Region}:${Account}:directory-registration/${DirectoryId}	aws:ResourceTag/${TagKey}
Template	arn:${Partition}:pca-connector-ad:${Region}:${Account}:connector/${ConnectorId}/template/${TemplateId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Private CA Connector for Active Directory

AWS Private CA Connector for Active Directory defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by on the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by on the tags associated with the resource	String
aws:TagKeys	Filters access by on the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS PricingPlanManager Service (pricingplanmanager)

AWS Private CA Connector for SCEP (pca-connector-scep)