Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Pinpoint

Amazon Pinpoint (service prefix: mobiletargeting) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Pinpoint
Actions defined by Amazon Pinpoint
Permission-only actions for Amazon Pinpoint
Resource types defined by Amazon Pinpoint
Condition keys for Amazon Pinpoint

API operations defined by Amazon Pinpoint

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateApp	mobiletargeting:CreateApp			Write
CreateApp	mobiletargeting:TagResource			Tagging, Write
CreateCampaign	mobiletargeting:CreateCampaign			Write
CreateCampaign	mobiletargeting:TagResource			Tagging, Write
CreateEmailTemplate	mobiletargeting:CreateEmailTemplate			Write
CreateEmailTemplate	mobiletargeting:TagResource			Tagging, Write
CreateExportJob	mobiletargeting:CreateExportJob			Write
CreateExportJob	iam:PassRole	iam:PassedToService	mobiletargeting.amazonaws.com	Write
CreateImportJob	mobiletargeting:CreateImportJob			Write
CreateImportJob	iam:PassRole	iam:PassedToService	mobiletargeting.amazonaws.com	Write
CreateInAppTemplate	mobiletargeting:CreateInAppTemplate			Write
CreateInAppTemplate	mobiletargeting:TagResource			Tagging, Write
CreateJourney	mobiletargeting:CreateJourney			Write
	mobiletargeting:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	mobiletargeting.amazonaws.com	Write
CreatePushTemplate	mobiletargeting:CreatePushTemplate			Write
CreatePushTemplate	mobiletargeting:TagResource			Tagging, Write
CreateRecommenderConfiguration	mobiletargeting:CreateRecommenderConfiguration			Write
CreateRecommenderConfiguration	iam:PassRole	iam:PassedToService	mobiletargeting.amazonaws.com	Write
CreateSegment	mobiletargeting:CreateSegment			Write
CreateSegment	mobiletargeting:TagResource			Tagging, Write
CreateSmsTemplate	mobiletargeting:CreateSmsTemplate			Write
CreateSmsTemplate	mobiletargeting:TagResource			Tagging, Write
CreateVoiceTemplate	mobiletargeting:CreateVoiceTemplate			Write
CreateVoiceTemplate	mobiletargeting:TagResource			Tagging, Write
DeleteAdmChannel	mobiletargeting:DeleteAdmChannel			Write
DeleteApnsChannel	mobiletargeting:DeleteApnsChannel			Write
DeleteApnsSandboxChannel	mobiletargeting:DeleteApnsSandboxChannel			Write
DeleteApnsVoipChannel	mobiletargeting:DeleteApnsVoipChannel			Write
DeleteApnsVoipSandboxChannel	mobiletargeting:DeleteApnsVoipSandboxChannel			Write
DeleteApp	mobiletargeting:DeleteApp			Write
DeleteBaiduChannel	mobiletargeting:DeleteBaiduChannel			Write
DeleteCampaign	mobiletargeting:DeleteCampaign			Write
DeleteEmailChannel	mobiletargeting:DeleteEmailChannel			Write
DeleteEmailTemplate	mobiletargeting:DeleteEmailTemplate			Write
DeleteEndpoint	mobiletargeting:DeleteEndpoint			Write
DeleteEventStream	mobiletargeting:DeleteEventStream			Write
DeleteGcmChannel	mobiletargeting:DeleteGcmChannel			Write
DeleteInAppTemplate	mobiletargeting:DeleteInAppTemplate			Write
DeleteJourney	mobiletargeting:DeleteJourney			Write
DeletePushTemplate	mobiletargeting:DeletePushTemplate			Write
DeleteRecommenderConfiguration	mobiletargeting:DeleteRecommenderConfiguration			Write
DeleteSegment	mobiletargeting:DeleteSegment			Write
DeleteSmsChannel	mobiletargeting:DeleteSmsChannel			Write
DeleteSmsTemplate	mobiletargeting:DeleteSmsTemplate			Write
DeleteUserEndpoints	mobiletargeting:DeleteUserEndpoints			Write
DeleteVoiceChannel	mobiletargeting:DeleteVoiceChannel			Write
DeleteVoiceTemplate	mobiletargeting:DeleteVoiceTemplate			Write
GetAdmChannel	mobiletargeting:GetAdmChannel			Read
GetApnsChannel	mobiletargeting:GetApnsChannel			Read
GetApnsSandboxChannel	mobiletargeting:GetApnsSandboxChannel			Read
GetApnsVoipChannel	mobiletargeting:GetApnsVoipChannel			Read
GetApnsVoipSandboxChannel	mobiletargeting:GetApnsVoipSandboxChannel			Read
GetApp	mobiletargeting:GetApp			Read
GetApplicationDateRangeKpi	mobiletargeting:GetApplicationDateRangeKpi			Read
GetApplicationSettings	mobiletargeting:GetApplicationSettings			List
GetApps	mobiletargeting:GetApps			Read
GetBaiduChannel	mobiletargeting:GetBaiduChannel			Read
GetCampaign	mobiletargeting:GetCampaign			Read
GetCampaignActivities	mobiletargeting:GetCampaignActivities			List
GetCampaignDateRangeKpi	mobiletargeting:GetCampaignDateRangeKpi			Read
GetCampaignVersion	mobiletargeting:GetCampaignVersion			Read
GetCampaignVersions	mobiletargeting:GetCampaignVersions			List
GetCampaigns	mobiletargeting:GetCampaigns			List
GetChannels	mobiletargeting:GetChannels			List
GetEmailChannel	mobiletargeting:GetEmailChannel			Read
GetEmailTemplate	mobiletargeting:GetEmailTemplate			Read
GetEndpoint	mobiletargeting:GetEndpoint			Read
GetEventStream	mobiletargeting:GetEventStream			Read
GetExportJob	mobiletargeting:GetExportJob			Read
GetExportJobs	mobiletargeting:GetExportJobs			List
GetGcmChannel	mobiletargeting:GetGcmChannel			Read
GetImportJob	mobiletargeting:GetImportJob			Read
GetImportJobs	mobiletargeting:GetImportJobs			List
GetInAppMessages	mobiletargeting:GetInAppMessages			Read
GetInAppTemplate	mobiletargeting:GetInAppTemplate			Read
GetJourney	mobiletargeting:GetJourney			Read
GetJourneyDateRangeKpi	mobiletargeting:GetJourneyDateRangeKpi			Read
GetJourneyExecutionActivityMetrics	mobiletargeting:GetJourneyExecutionActivityMetrics			Read
GetJourneyExecutionMetrics	mobiletargeting:GetJourneyExecutionMetrics			Read
GetJourneyRunExecutionActivityMetrics	mobiletargeting:GetJourneyRunExecutionActivityMetrics			Read
GetJourneyRunExecutionMetrics	mobiletargeting:GetJourneyRunExecutionMetrics			Read
GetJourneyRuns	mobiletargeting:GetJourneyRuns			List
GetPushTemplate	mobiletargeting:GetPushTemplate			Read
GetRecommenderConfiguration	mobiletargeting:GetRecommenderConfiguration			Read
GetRecommenderConfigurations	mobiletargeting:GetRecommenderConfigurations			List
GetSegment	mobiletargeting:GetSegment			Read
GetSegmentExportJobs	mobiletargeting:GetSegmentExportJobs			List
GetSegmentImportJobs	mobiletargeting:GetSegmentImportJobs			List
GetSegmentVersion	mobiletargeting:GetSegmentVersion			Read
GetSegmentVersions	mobiletargeting:GetSegmentVersions			List
GetSegments	mobiletargeting:GetSegments			List
GetSmsChannel	mobiletargeting:GetSmsChannel			Read
GetSmsTemplate	mobiletargeting:GetSmsTemplate			Read
GetUserEndpoints	mobiletargeting:GetUserEndpoints			Read
GetVoiceChannel	mobiletargeting:GetVoiceChannel			Read
GetVoiceTemplate	mobiletargeting:GetVoiceTemplate			Read
ListJourneys	mobiletargeting:ListJourneys			List
ListTagsForResource	mobiletargeting:ListTagsForResource			Read
ListTemplateVersions	mobiletargeting:ListTemplateVersions			List
ListTemplates	mobiletargeting:ListTemplates			List
PhoneNumberValidate	mobiletargeting:PhoneNumberValidate			Read
PutEventStream	mobiletargeting:PutEventStream			Write
PutEventStream	iam:PassRole	iam:PassedToService	mobiletargeting.amazonaws.com	Write
PutEvents	mobiletargeting:PutEvents			Write
RemoveAttributes	mobiletargeting:RemoveAttributes			Write
SendMessages	mobiletargeting:SendMessages			Write
SendOTPMessage	mobiletargeting:SendOTPMessage			Write
SendUsersMessages	mobiletargeting:SendUsersMessages			Write
TagResource	mobiletargeting:TagResource			Tagging, Write
UntagResource	mobiletargeting:UntagResource			Tagging, Write
UpdateAdmChannel	mobiletargeting:UpdateAdmChannel			Write
UpdateApnsChannel	mobiletargeting:UpdateApnsChannel			Write
UpdateApnsSandboxChannel	mobiletargeting:UpdateApnsSandboxChannel			Write
UpdateApnsVoipChannel	mobiletargeting:UpdateApnsVoipChannel			Write
UpdateApnsVoipSandboxChannel	mobiletargeting:UpdateApnsVoipSandboxChannel			Write
UpdateApplicationSettings	mobiletargeting:UpdateApplicationSettings			Write
UpdateBaiduChannel	mobiletargeting:UpdateBaiduChannel			Write
UpdateCampaign	mobiletargeting:UpdateCampaign			Write
UpdateEmailChannel	mobiletargeting:UpdateEmailChannel			Write
UpdateEmailChannel	iam:PassRole	iam:PassedToService	mobiletargeting.amazonaws.com	Write
UpdateEmailTemplate	mobiletargeting:UpdateEmailTemplate			Write
UpdateEndpoint	mobiletargeting:UpdateEndpoint			Write
UpdateEndpointsBatch	mobiletargeting:UpdateEndpointsBatch			Write
UpdateGcmChannel	mobiletargeting:UpdateGcmChannel			Write
UpdateInAppTemplate	mobiletargeting:UpdateInAppTemplate			Write
UpdateJourney	mobiletargeting:UpdateJourney			Write
UpdateJourney	iam:PassRole	iam:PassedToService	mobiletargeting.amazonaws.com	Write
UpdateJourneyState	mobiletargeting:UpdateJourneyState			Write
UpdatePushTemplate	mobiletargeting:UpdatePushTemplate			Write
UpdateRecommenderConfiguration	mobiletargeting:UpdateRecommenderConfiguration			Write
UpdateRecommenderConfiguration	iam:PassRole	iam:PassedToService	mobiletargeting.amazonaws.com	Write
UpdateSegment	mobiletargeting:UpdateSegment			Write
UpdateSmsChannel	mobiletargeting:UpdateSmsChannel			Write
UpdateSmsTemplate	mobiletargeting:UpdateSmsTemplate			Write
UpdateTemplateActiveVersion	mobiletargeting:UpdateTemplateActiveVersion			Write
UpdateVoiceChannel	mobiletargeting:UpdateVoiceChannel			Write
UpdateVoiceTemplate	mobiletargeting:UpdateVoiceTemplate			Write
VerifyOTPMessage	mobiletargeting:VerifyOTPMessage			Write

Actions defined by Amazon Pinpoint

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateApp	Grants permission to create an app	apps*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCampaign	Grants permission to create a campaign for an app	app*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateEmailTemplate	Grants permission to create an email template	template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateExportJob	Grants permission to create an export job that exports endpoint definitions to Amazon S3	app*	aws:ResourceTag/${TagKey}	Write
CreateImportJob	Grants permission to import endpoint definitions from to create a segment	app*	aws:ResourceTag/${TagKey}	Write
CreateInAppTemplate	Grants permission to create an in-app message template	template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateJourney	Grants permission to create a Journey for an app	journeys*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePushTemplate	Grants permission to create a push notification template	template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRecommenderConfiguration	Grants permission to create an Amazon Pinpoint configuration for a recommender model	recommenders*		Write
CreateSegment	Grants permission to create a segment that is based on endpoint data reported to Pinpoint by your app. To allow a user to create a segment by importing endpoint data from outside of Pinpoint, allow the mobiletargeting:CreateImportJob action	app*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSmsTemplate	Grants permission to create an sms message template	template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateVoiceTemplate	Grants permission to create a voice message template	template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAdmChannel	Grants permission to delete the ADM channel for an app	channel*		Write
DeleteApnsChannel	Grants permission to delete the APNs channel for an app	channel*		Write
DeleteApnsSandboxChannel	Grants permission to delete the APNs sandbox channel for an app	channel*		Write
DeleteApnsVoipChannel	Grants permission to delete the APNs VoIP channel for an app	channel*		Write
DeleteApnsVoipSandboxChannel	Grants permission to delete the APNs VoIP sandbox channel for an app	channel*		Write
DeleteApp	Grants permission to delete a specific campaign	app*	aws:ResourceTag/${TagKey}	Write
DeleteBaiduChannel	Grants permission to delete the Baidu channel for an app	channel*		Write
DeleteCampaign	Grants permission to delete a specific campaign	campaign*	aws:ResourceTag/${TagKey}	Write
DeleteEmailChannel	Grants permission to delete the email channel for an app	channel*		Write
DeleteEmailTemplate	Grants permission to delete an email template or an email template version	template*	aws:ResourceTag/${TagKey}	Write
DeleteEndpoint	Grants permission to delete an endpoint	endpoint*		Write
DeleteEventStream	Grants permission to delete the event stream for an app	event-stream*		Write
DeleteGcmChannel	Grants permission to delete the GCM channel for an app	channel*		Write
DeleteInAppTemplate	Grants permission to delete an in-app message template or an in-app message template version	template*	aws:ResourceTag/${TagKey}	Write
DeleteJourney	Grants permission to delete a specific journey	journey*	aws:ResourceTag/${TagKey}	Write
DeletePushTemplate	Grants permission to delete a push notification template or a push notification template version	template*	aws:ResourceTag/${TagKey}	Write
DeleteRecommenderConfiguration	Grants permission to delete an Amazon Pinpoint configuration for a recommender model	recommender*		Write
DeleteSegment	Grants permission to delete a specific segment	segment*	aws:ResourceTag/${TagKey}	Write
DeleteSmsChannel	Grants permission to delete the SMS channel for an app	channel*		Write
DeleteSmsTemplate	Grants permission to delete an sms message template or an sms message template version	template*	aws:ResourceTag/${TagKey}	Write
DeleteUserEndpoints	Grants permission to delete all of the endpoints that are associated with a user ID	user*		Write
DeleteVoiceChannel	Grants permission to delete the Voice channel for an app	channel*		Write
DeleteVoiceTemplate	Grants permission to delete a voice message template or a voice message template version	template*	aws:ResourceTag/${TagKey}	Write
GetAdmChannel	Grants permission to retrieve information about the Amazon Device Messaging (ADM) channel for an app	channel*		Read
GetApnsChannel	Grants permission to retrieve information about the APNs channel for an app	channel*		Read
GetApnsSandboxChannel	Grants permission to retrieve information about the APNs sandbox channel for an app	channel*		Read
GetApnsVoipChannel	Grants permission to retrieve information about the APNs VoIP channel for an app	channel*		Read
GetApnsVoipSandboxChannel	Grants permission to retrieve information about the APNs VoIP sandbox channel for an app	channel*		Read
GetApp	Grants permission to retrieve information about a specific app in your Amazon Pinpoint account	app*	aws:ResourceTag/${TagKey}	Read
GetApplicationDateRangeKpi	Grants permission to retrieve (queries) pre-aggregated data for a standard metric that applies to an application	application-metrics*		Read
GetApplicationSettings	Grants permission to retrieve the default settings for an app	app*	aws:ResourceTag/${TagKey}	List
GetApps	Grants permission to retrieve a list of apps in your Amazon Pinpoint account	apps*		Read
GetBaiduChannel	Grants permission to retrieve information about the Baidu channel for an app	channel*		Read
GetCampaign	Grants permission to retrieve information about a specific campaign	campaign*	aws:ResourceTag/${TagKey}	Read
GetCampaignActivities	Grants permission to retrieve information about the activities performed by a campaign	campaign*	aws:ResourceTag/${TagKey}	List
GetCampaignDateRangeKpi	Grants permission to retrieve (queries) pre-aggregated data for a standard metric that applies to a campaign	campaign-metrics*		Read
GetCampaignVersion	Grants permission to retrieve information about a specific campaign version	campaign*	aws:ResourceTag/${TagKey}	Read
GetCampaignVersions	Grants permission to retrieve information about the current and prior versions of a campaign	campaign*	aws:ResourceTag/${TagKey}	List
GetCampaigns	Grants permission to retrieve information about all campaigns for an app	app*	aws:ResourceTag/${TagKey}	List
GetChannels	Grants permission to get all channels information for your app	channels*		List
GetEmailChannel	Grants permission to obtain information about the email channel in an app	channel*		Read
GetEmailTemplate	Grants permission to retrieve information about a specific or the active version of an email template	template*	aws:ResourceTag/${TagKey}	Read
GetEndpoint	Grants permission to retrieve information about a specific endpoint	endpoint*		Read
GetEventStream	Grants permission to retrieve information about the event stream for an app	event-stream*		Read
GetExportJob	Grants permission to obtain information about a specific export job	export-job*		Read
GetExportJobs	Grants permission to retrieve a list of all of the export jobs for an app	app*	aws:ResourceTag/${TagKey}	List
GetGcmChannel	Grants permission to retrieve information about the GCM channel for an app	channel*		Read
GetImportJob	Grants permission to retrieve information about a specific import job	import-job*		Read
GetImportJobs	Grants permission to retrieve information about all import jobs for an app	app*	aws:ResourceTag/${TagKey}	List
GetInAppMessages	Grants permission to retrive in-app messages for the given endpoint id	app*	aws:ResourceTag/${TagKey}	Read
GetInAppTemplate	Grants permission to retrieve information about a specific or the active version of an in-app message template	template*	aws:ResourceTag/${TagKey}	Read
GetJourney	Grants permission to retrieve information about a specific journey	journey*	aws:ResourceTag/${TagKey}	Read
GetJourneyDateRangeKpi	Grants permission to retrieve (queries) pre-aggregated data for a standard engagement metric that applies to a journey	journey-metrics*		Read
GetJourneyExecutionActivityMetrics	Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey activity	journey-execution-activity-metrics*		Read
GetJourneyExecutionMetrics	Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey	journey-execution-metrics*		Read
GetJourneyRunExecutionActivityMetrics	Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey activity for a single journey run	journey*	aws:ResourceTag/${TagKey}	Read
GetJourneyRunExecutionMetrics	Grants permission to retrieve (queries) pre-aggregated data for a standard execution metric that applies to a journey for a single journey run	journey*	aws:ResourceTag/${TagKey}	Read
GetJourneyRuns	Grants permission to retrieve information about all journey runs for a journey	journey*	aws:ResourceTag/${TagKey}	List
GetPushTemplate	Grants permission to retrieve information about a specific or the active version of an push notification template	template*	aws:ResourceTag/${TagKey}	Read
GetRecommenderConfiguration	Grants permission to retrieve information about an Amazon Pinpoint configuration for a recommender model	recommender*		Read
GetRecommenderConfigurations	Grants permission to retrieve information about all the recommender model configurations that are associated with an Amazon Pinpoint account	recommenders*		List
GetSegment	Grants permission to retrieve information about a specific segment	segment*	aws:ResourceTag/${TagKey}	Read
GetSegmentExportJobs	Grants permission to retrieve information about jobs that export endpoint definitions from segments to Amazon S3	segment*	aws:ResourceTag/${TagKey}	List
GetSegmentImportJobs	Grants permission to retrieve information about jobs that create segments by importing endpoint definitions from	segment*	aws:ResourceTag/${TagKey}	List
GetSegmentVersion	Grants permission to retrieve information about a specific segment version	segment*	aws:ResourceTag/${TagKey}	Read
GetSegmentVersions	Grants permission to retrieve information about the current and prior versions of a segment	segment*	aws:ResourceTag/${TagKey}	List
GetSegments	Grants permission to retrieve information about the segments for an app	app*	aws:ResourceTag/${TagKey}	List
GetSmsChannel	Grants permission to obtain information about the SMS channel in an app	channel*		Read
GetSmsTemplate	Grants permission to retrieve information about a specific or the active version of an sms message template	template*	aws:ResourceTag/${TagKey}	Read
GetUserEndpoints	Grants permission to retrieve information about the endpoints that are associated with a user ID	user*		Read
GetVoiceChannel	Grants permission to obtain information about the Voice channel in an app	channel*		Read
GetVoiceTemplate	Grants permission to retrieve information about a specific or the active version of a voice message template	template*	aws:ResourceTag/${TagKey}	Read
ListJourneys	Grants permission to retrieve information about all journeys for an app	app*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags for a resource	app	aws:ResourceTag/${TagKey}	Read
		campaign	aws:ResourceTag/${TagKey}
		journey	aws:ResourceTag/${TagKey}
		segment	aws:ResourceTag/${TagKey}
		template	aws:ResourceTag/${TagKey}
ListTemplateVersions	Grants permission to retrieve all versions about a specific template	template*	aws:ResourceTag/${TagKey}	List
ListTemplates	Grants permission to retrieve metadata about the queried templates	templates*		List
PhoneNumberValidate	Grants permission to obtain metadata for a phone number, such as the number type (mobile, landline, or VoIP), location, and provider	phone-number-validate*		Read
PutEventStream	Grants permission to create or update an event stream for an app	event-stream*		Write
PutEvents	Grants permission to create or update events for an app	events*		Write
RemoveAttributes	Grants permission to remove the attributes for an app	attribute*		Write
SendMessages	Grants permission to send an SMS message or push notification to specific endpoints	messages*		Write
SendOTPMessage	Grants permission to send an OTP code to a user of your application	otp*		Write
SendUsersMessages	Grants permission to send an SMS message or push notification to all endpoints that are associated with a specific user ID	messages*		Write
TagResource	Grants permission to add tags to a resource	app	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		campaign	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		journey	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		segment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		template	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from a resource	app	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		campaign	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		journey	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		segment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		template	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAdmChannel	Grants permission to update the Amazon Device Messaging (ADM) channel for an app	channel*		Write
UpdateApnsChannel	Grants permission to update the Apple Push Notification service (APNs) channel for an app	channel*		Write
UpdateApnsSandboxChannel	Grants permission to update the Apple Push Notification service (APNs) sandbox channel for an app	channel*		Write
UpdateApnsVoipChannel	Grants permission to update the Apple Push Notification service (APNs) VoIP channel for an app	channel*		Write
UpdateApnsVoipSandboxChannel	Grants permission to update the Apple Push Notification service (APNs) VoIP sandbox channel for an app	channel*		Write
UpdateApplicationSettings	Grants permission to update the default settings for an app	app*	aws:ResourceTag/${TagKey}	Write
UpdateBaiduChannel	Grants permission to update the Baidu channel for an app	channel*		Write
UpdateCampaign	Grants permission to update a specific campaign	campaign*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateEmailChannel	Grants permission to update the email channel for an app	channel*		Write
UpdateEmailTemplate	Grants permission to update a specific email template under the same version or generate a new version	template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateEndpoint	Grants permission to create an endpoint or update the information for an endpoint	endpoint*		Write
UpdateEndpointsBatch	Grants permission to create or update endpoints as a batch operation	app*	aws:ResourceTag/${TagKey}	Write
UpdateGcmChannel	Grants permission to update the Firebase Cloud Messaging (FCM) or Google Cloud Messaging (GCM) API key that allows to send push notifications to your Android app	channel*		Write
UpdateInAppTemplate	Grants permission to update a specific in-app message template under the same version or generate a new version	template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateJourney	Grants permission to update a specific journey	journey*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateJourneyState	Grants permission to update a specific journey state	journey*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdatePushTemplate	Grants permission to update a specific push notification template under the same version or generate a new version	template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateRecommenderConfiguration	Grants permission to update an Amazon Pinpoint configuration for a recommender model	recommender*		Write
UpdateSegment	Grants permission to update a specific segment	segment*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateSmsChannel	Grants permission to update the SMS channel for an app	channel*		Write
UpdateSmsTemplate	Grants permission to update a specific sms message template under the same version or generate a new version	template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateTemplateActiveVersion	Grants permission to update the active version parameter of a specific template	template*	aws:ResourceTag/${TagKey}	Write
UpdateVoiceChannel	Grants permission to update the Voice channel for an app	channel*		Write
UpdateVoiceTemplate	Grants permission to update a specific voice message template under the same version or generate a new version	template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
VerifyOTPMessage	Grants permission to check the validity of One-Time Passwords (OTPs)	verify-otp*		Write

Permission-only actions for Amazon Pinpoint

The following actions are defined by Amazon Pinpoint but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
GetReports	Grants permission to mobiletargeting:GetReports	reports*		Read

Resource types defined by Amazon Pinpoint

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
app	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}	aws:ResourceTag/${TagKey}
application-metrics	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/kpis/daterange/${KpiName}
apps	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/*
attribute	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/attributes/${AttributeType}
campaign	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/campaigns/${CampaignId}	aws:ResourceTag/${TagKey}
campaign-metrics	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/campaigns/${CampaignId}/kpis/daterange/${KpiName}
channel	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/channels/${ChannelType}
channels	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/channels
endpoint	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/endpoints/${EndpointId}
event-stream	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/eventstream
events	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/events
export-job	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/jobs/export/${JobId}
import-job	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/jobs/import/${JobId}
journey	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/journeys/${JourneyId}	aws:ResourceTag/${TagKey}
journey-execution-activity-metrics	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/journeys/${JourneyId}/activities/${JourneyActivityId}/execution-metrics
journey-execution-metrics	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/journeys/${JourneyId}/execution-metrics
journey-metrics	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/journeys/${JourneyId}/kpis/daterange/${KpiName}
journeys	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/journeys
messages	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/messages
otp	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/otp
phone-number-validate	arn:${Partition}:mobiletargeting:${Region}:${Account}:phone/number/validate
recommender	arn:${Partition}:mobiletargeting:${Region}:${Account}:recommenders/${RecommenderId}
recommenders	arn:${Partition}:mobiletargeting:${Region}:${Account}:recommenders/*
reports	arn:${Partition}:mobiletargeting:${Region}:${Account}:reports
segment	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/segments/${SegmentId}	aws:ResourceTag/${TagKey}
template	arn:${Partition}:mobiletargeting:${Region}:${Account}:templates/${TemplateName}/${TemplateType}	aws:ResourceTag/${TagKey}
templates	arn:${Partition}:mobiletargeting:${Region}:${Account}:templates
user	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/users/${UserId}
verify-otp	arn:${Partition}:mobiletargeting:${Region}:${Account}:apps/${AppId}/verify-otp

Condition keys for Amazon Pinpoint

Amazon Pinpoint defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a key that is present in the request the user makes to the pinpoint service	String
aws:ResourceTag/${TagKey}	Filters access by a tag key and value pair	String
aws:TagKeys	Filters access by the list of all the tag key names present in the request the user makes to the pinpoint service	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Personalize (personalize)

Amazon Pinpoint Email Service (ses)