Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Proton

AWS Proton (service prefix: proton) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS Proton

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AcceptEnvironmentAccountConnection	proton:AcceptEnvironmentAccountConnection			Write
CancelComponentDeployment	proton:CancelComponentDeployment			Write
CancelEnvironmentDeployment	proton:CancelEnvironmentDeployment			Write
CancelServiceInstanceDeployment	proton:CancelServiceInstanceDeployment			Write
CancelServicePipelineDeployment	proton:CancelServicePipelineDeployment			Write
CreateComponent	proton:CreateComponent			Write
CreateComponent	proton:TagResource			Tagging, Write
CreateEnvironment	proton:CreateEnvironment			Write
	proton:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	proton.amazonaws.com	Write
CreateEnvironmentAccountConnection	proton:CreateEnvironmentAccountConnection			Write
	proton:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	proton.amazonaws.com	Write
CreateEnvironmentTemplate	proton:CreateEnvironmentTemplate			Write
CreateEnvironmentTemplate	proton:TagResource			Tagging, Write
CreateEnvironmentTemplateVersion	proton:CreateEnvironmentTemplateVersion			Write
CreateEnvironmentTemplateVersion	proton:TagResource			Tagging, Write
CreateRepository	proton:CreateRepository			Write
CreateRepository	codestar-connections:PassConnection			Read
CreateService	proton:CreateService			Write
	proton:TagResource			Tagging, Write
	codestar-connections:PassConnection			Read
CreateServiceInstance	proton:CreateServiceInstance			Write
CreateServiceInstance	proton:TagResource			Tagging, Write
CreateServiceSyncConfig	proton:CreateServiceSyncConfig			Write
CreateServiceTemplate	proton:CreateServiceTemplate			Write
CreateServiceTemplate	proton:TagResource			Tagging, Write
CreateServiceTemplateVersion	proton:CreateServiceTemplateVersion			Write
CreateTemplateSyncConfig	proton:CreateTemplateSyncConfig			Write
DeleteComponent	proton:DeleteComponent			Write
DeleteDeployment	proton:DeleteDeployment			Write
DeleteEnvironment	proton:DeleteEnvironment			Write
DeleteEnvironmentAccountConnection	proton:DeleteEnvironmentAccountConnection			Write
DeleteEnvironmentTemplate	proton:DeleteEnvironmentTemplate			Write
DeleteEnvironmentTemplateVersion	proton:DeleteEnvironmentTemplateVersion			Write
DeleteRepository	proton:DeleteRepository			Write
DeleteService	proton:DeleteService			Write
DeleteServiceSyncConfig	proton:DeleteServiceSyncConfig			Write
DeleteServiceTemplate	proton:DeleteServiceTemplate			Write
DeleteServiceTemplateVersion	proton:DeleteServiceTemplateVersion			Write
DeleteTemplateSyncConfig	proton:DeleteTemplateSyncConfig			Write
GetAccountSettings	proton:GetAccountSettings			Read
GetComponent	proton:GetComponent			Read
GetDeployment	proton:GetComponent			Read
	proton:GetDeployment			Read
	proton:GetEnvironment			Read
	proton:GetService			Read
	proton:GetServiceInstance			Read
GetEnvironment	proton:GetEnvironment			Read
GetEnvironmentAccountConnection	proton:GetEnvironmentAccountConnection			Read
GetEnvironmentTemplate	proton:GetEnvironmentTemplate			Read
GetEnvironmentTemplateVersion	proton:GetEnvironmentTemplateVersion			Read
GetRepository	proton:GetRepository			Read
GetRepositorySyncStatus	proton:GetRepositorySyncStatus			Read
GetResourcesSummary	proton:GetResourcesSummary			Read
GetService	proton:GetService			Read
GetServiceInstance	proton:GetServiceInstance			Read
GetServiceInstanceSyncStatus	proton:GetServiceInstanceSyncStatus			Read
GetServiceSyncBlockerSummary	proton:GetServiceSyncBlockerSummary			Read
GetServiceSyncConfig	proton:GetServiceSyncConfig			Read
GetServiceTemplate	proton:GetServiceTemplate			Read
GetServiceTemplateVersion	proton:GetServiceTemplateVersion			Read
GetTemplateSyncConfig	proton:GetTemplateSyncConfig			Read
GetTemplateSyncStatus	proton:GetTemplateSyncStatus			Read
ListComponentOutputs	proton:ListComponentOutputs			List
ListComponentProvisionedResources	proton:ListComponentProvisionedResources			List
ListComponents	proton:ListComponents			List
ListDeployments	proton:ListDeployments			List
ListEnvironmentAccountConnections	proton:ListEnvironmentAccountConnections			List
ListEnvironmentOutputs	proton:ListEnvironmentOutputs			List
ListEnvironmentProvisionedResources	proton:ListEnvironmentProvisionedResources			List
ListEnvironmentTemplateVersions	proton:ListEnvironmentTemplateVersions			List
ListEnvironmentTemplates	proton:ListEnvironmentTemplates			List
ListEnvironments	proton:ListEnvironments			List
ListRepositories	proton:ListRepositories			List
ListRepositorySyncDefinitions	proton:ListRepositorySyncDefinitions			List
ListServiceInstanceOutputs	proton:ListServiceInstanceOutputs			List
ListServiceInstanceProvisionedResources	proton:ListServiceInstanceProvisionedResources			List
ListServiceInstances	proton:ListServiceInstances			List
ListServicePipelineOutputs	proton:ListServicePipelineOutputs			List
ListServicePipelineProvisionedResources	proton:ListServicePipelineProvisionedResources			List
ListServiceTemplateVersions	proton:ListServiceTemplateVersions			List
ListServiceTemplates	proton:ListServiceTemplates			List
ListServices	proton:ListServices			List
ListTagsForResource	proton:ListTagsForResource			Read
NotifyResourceDeploymentStatusChange	proton:NotifyResourceDeploymentStatusChange			Write
RejectEnvironmentAccountConnection	proton:RejectEnvironmentAccountConnection			Write
TagResource	proton:TagResource			Tagging, Write
UntagResource	proton:UntagResource			Tagging, Write
UpdateAccountSettings	proton:UpdateAccountSettings			Write
UpdateAccountSettings	iam:PassRole	iam:PassedToService	proton.amazonaws.com	Write
UpdateComponent	proton:UpdateComponent			Write
UpdateEnvironment	proton:UpdateEnvironment			Write
UpdateEnvironment	iam:PassRole	iam:PassedToService	proton.amazonaws.com	Write
UpdateEnvironmentAccountConnection	proton:UpdateEnvironmentAccountConnection			Write
UpdateEnvironmentAccountConnection	iam:PassRole	iam:PassedToService	proton.amazonaws.com	Write
UpdateEnvironmentTemplate	proton:UpdateEnvironmentTemplate			Write
UpdateEnvironmentTemplateVersion	proton:UpdateEnvironmentTemplateVersion			Write
UpdateService	proton:UpdateService			Write
UpdateServiceInstance	proton:UpdateServiceInstance			Write
UpdateServicePipeline	proton:UpdateServicePipeline			Write
UpdateServiceSyncBlocker	proton:UpdateServiceSyncBlocker			Write
UpdateServiceTemplate	proton:UpdateServiceTemplate			Write
UpdateServiceTemplateVersion	proton:UpdateServiceTemplateVersion			Write

Actions defined by AWS Proton

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptEnvironmentAccountConnection	Grants permission to reject an environment account connection request from another environment account	environment-account-connection*	aws:ResourceTag/${TagKey}	Write
CancelComponentDeployment	Grants permission to cancel component deployment	component*	aws:ResourceTag/${TagKey}	Write
CancelEnvironmentDeployment	Grants permission to cancel an environment deployment	environment*	aws:ResourceTag/${TagKey} proton:EnvironmentTemplate	Write
CancelServiceInstanceDeployment	Grants permission to cancel a service instance deployment	service-instance*	aws:ResourceTag/${TagKey} proton:ServiceTemplate	Write
CancelServicePipelineDeployment	Grants permission to cancel a service pipeline deployment	service*	aws:ResourceTag/${TagKey} proton:ServiceTemplate	Write
CreateComponent	Grants permission to create component	component*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateEnvironment	Grants permission to create an environment	environment*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys proton:EnvironmentTemplate	Write
CreateEnvironmentAccountConnection	Grants permission to create an environment account connection		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateEnvironmentTemplate	Grants permission to create an environment template	environment-template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateEnvironmentTemplateMajorVersion	Grants permission to create an environment template major version. DEPRECATED - use CreateEnvironmentTemplateVersion instead	environment-template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateEnvironmentTemplateMinorVersion	Grants permission to create an environment template minor version. DEPRECATED - use CreateEnvironmentTemplateVersion instead	environment-template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateEnvironmentTemplateVersion	Grants permission to create an environment template version	environment-template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRepository	Grants permission to create a repository	repository*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateService	Grants permission to create a service	service*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys proton:ServiceTemplate	Write
CreateServiceInstance	Grants permission to create a service instance	service-instance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys proton:ServiceTemplate	Write
CreateServiceSyncConfig	Grants permission to create a service sync config			Write
CreateServiceTemplate	Grants permission to create a service template	service-template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateServiceTemplateMajorVersion	Grants permission to create a service template major version. DEPRECATED - use CreateServiceTemplateVersion instead	service-template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateServiceTemplateMinorVersion	Grants permission to create a service template minor version. DEPRECATED - use CreateServiceTemplateVersion instead	service-template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateServiceTemplateVersion	Grants permission to create a service template version	service-template*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTemplateSyncConfig	Grants permission to create a template sync config			Write
DeleteAccountRoles	Grants permission to delete account roles. DEPRECATED - use UpdateAccountSettings instead			Write
DeleteComponent	Grants permission to delete component	component*	aws:ResourceTag/${TagKey}	Write
DeleteDeployment	Grants permission to delete a deployment	deployment*	aws:ResourceTag/${TagKey}	Write
DeleteEnvironment	Grants permission to delete an environment	environment*	aws:ResourceTag/${TagKey} proton:EnvironmentTemplate	Write
DeleteEnvironmentAccountConnection	Grants permission to delete an environment account connection	environment-account-connection*	aws:ResourceTag/${TagKey}	Write
DeleteEnvironmentTemplate	Grants permission to delete an environment template	environment-template*	aws:ResourceTag/${TagKey}	Write
DeleteEnvironmentTemplateMajorVersion	Grants permission to delete an environment template major version. DEPRECATED - use DeleteEnvironmentTemplateVersion instead	environment-template*	aws:ResourceTag/${TagKey}	Write
DeleteEnvironmentTemplateMinorVersion	Grants permission to delete an environment template minor version. DEPRECATED - use DeleteEnvironmentTemplateVersion instead	environment-template*	aws:ResourceTag/${TagKey}	Write
DeleteEnvironmentTemplateVersion	Grants permission to delete an environment template version	environment-template*	aws:ResourceTag/${TagKey}	Write
DeleteRepository	Grants permission to delete a repository	repository*	aws:ResourceTag/${TagKey}	Write
DeleteService	Grants permission to delete a service	service*	aws:ResourceTag/${TagKey} proton:ServiceTemplate	Write
DeleteServiceSyncConfig	Grants permission to delete a service sync config			Write
DeleteServiceTemplate	Grants permission to delete a service template	service-template*	aws:ResourceTag/${TagKey}	Write
DeleteServiceTemplateMajorVersion	Grants permission to delete a service template major version. DEPRECATED - use DeleteServiceTemplateVersion instead	service-template*	aws:ResourceTag/${TagKey}	Write
DeleteServiceTemplateMinorVersion	Grants permission to delete a service template minor version. DEPRECATED - use DeleteServiceTemplateVersion instead	service-template*	aws:ResourceTag/${TagKey}	Write
DeleteServiceTemplateVersion	Grants permission to delete a service template version	service-template*	aws:ResourceTag/${TagKey}	Write
DeleteTemplateSyncConfig	Grants permission to delete a TemplateSyncConfig			Write
GetAccountRoles	Grants permission to get account roles. DEPRECATED - use GetAccountSettings instead			Read
GetAccountSettings	Grants permission to describe the account settings			Read
GetComponent	Grants permission to describe a component	component*	aws:ResourceTag/${TagKey}	Read
GetDeployment	Grants permission to describe a deployment	deployment*	aws:ResourceTag/${TagKey}	Read
GetEnvironment	Grants permission to describe an environment	environment*	aws:ResourceTag/${TagKey}	Read
GetEnvironmentAccountConnection	Grants permission to describe an environment account connection	environment-account-connection*	aws:ResourceTag/${TagKey}	Read
GetEnvironmentTemplate	Grants permission to describe an environment template	environment-template*	aws:ResourceTag/${TagKey}	Read
GetEnvironmentTemplateMajorVersion	Grants permission to get an environment template major version. DEPRECATED - use GetEnvironmentTemplateVersion instead	environment-template*	aws:ResourceTag/${TagKey}	Read
GetEnvironmentTemplateMinorVersion	Grants permission to get an environment template minor version. DEPRECATED - use GetEnvironmentTemplateVersion instead	environment-template*	aws:ResourceTag/${TagKey}	Read
GetEnvironmentTemplateVersion	Grants permission to describe an environment template version	environment-template*	aws:ResourceTag/${TagKey}	Read
GetRepository	Grants permission to describe a repository	repository*	aws:ResourceTag/${TagKey}	Read
GetRepositorySyncStatus	Grants permission to get the latest sync status for a repository			Read
GetResourceTemplateVersionStatusCounts	Grants permission to list resource template version status counts			Read
GetResourcesSummary	Grants permission to get resources summary			Read
GetService	Grants permission to describe a service	service*	aws:ResourceTag/${TagKey}	Read
GetServiceInstance	Grants permission to describe a service instance	service-instance*	aws:ResourceTag/${TagKey}	Read
GetServiceInstanceSyncStatus	Grants permission to describe the sync status of a service instance			Read
GetServiceSyncBlockerSummary	Grants permission to describe service sync blockers on a service or service instance			Read
GetServiceSyncConfig	Grants permission to describe a service sync config			Read
GetServiceTemplate	Grants permission to describe a service template	service-template*	aws:ResourceTag/${TagKey}	Read
GetServiceTemplateMajorVersion	Grants permission to get a service template major version. DEPRECATED - use GetServiceTemplateVersion instead	service-template*	aws:ResourceTag/${TagKey}	Read
GetServiceTemplateMinorVersion	Grants permission to get a service template minor version. DEPRECATED - use GetServiceTemplateVersion instead	service-template*	aws:ResourceTag/${TagKey}	Read
GetServiceTemplateVersion	Grants permission to describe a service template version	service-template*	aws:ResourceTag/${TagKey}	Read
GetTemplateSyncConfig	Grants permission to describe a TemplateSyncConfig			Read
GetTemplateSyncStatus	Grants permission to describe the sync status of a template			Read
ListComponentOutputs	Grants permission to list component outputs	component*	aws:ResourceTag/${TagKey}	List
ListComponentOutputs	Grants permission to list component outputs	deployment	aws:ResourceTag/${TagKey}	List
ListComponentProvisionedResources	Grants permission to list component provisioned resources	component*	aws:ResourceTag/${TagKey}	List
ListComponents	Grants permission to list components	environment	aws:ResourceTag/${TagKey}	List
		service	aws:ResourceTag/${TagKey}
		service-instance	aws:ResourceTag/${TagKey}
ListDeployments	Grants permission to list deployments			List
ListEnvironmentAccountConnections	Grants permission to list environment account connections			List
ListEnvironmentOutputs	Grants permission to list environment outputs	deployment	aws:ResourceTag/${TagKey}	List
ListEnvironmentOutputs	Grants permission to list environment outputs	environment*	aws:ResourceTag/${TagKey}	List
ListEnvironmentProvisionedResources	Grants permission to list environment provisioned resources	environment*	aws:ResourceTag/${TagKey}	List
ListEnvironmentTemplateMajorVersions	Grants permission to list environment template major versions. DEPRECATED - use ListEnvironmentTemplateVersions instead	environment-template*	aws:ResourceTag/${TagKey}	List
ListEnvironmentTemplateMinorVersions	Grants permission to list an environment template minor versions. DEPRECATED - use ListEnvironmentTemplateVersions instead	environment-template*	aws:ResourceTag/${TagKey}	List
ListEnvironmentTemplateVersions	Grants permission to list environment template versions	environment-template*	aws:ResourceTag/${TagKey}	List
ListEnvironmentTemplates	Grants permission to list environment templates			List
ListEnvironments	Grants permission to list environments			List
ListRepositories	Grants permission to list repositories			List
ListRepositorySyncDefinitions	Grants permission to list repository sync definitions			List
ListServiceInstanceOutputs	Grants permission to list service instance outputs	deployment	aws:ResourceTag/${TagKey}	List
		service*	aws:ResourceTag/${TagKey}
		service-instance*	aws:ResourceTag/${TagKey}
ListServiceInstanceProvisionedResources	Grants permission to list service instance provisioned resources	service*	aws:ResourceTag/${TagKey}	List
ListServiceInstanceProvisionedResources		service-instance*	aws:ResourceTag/${TagKey}	List
ListServiceInstances	Grants permission to list service instances			List
ListServicePipelineOutputs	Grants permission to list service pipeline outputs	deployment	aws:ResourceTag/${TagKey}	List
ListServicePipelineOutputs	Grants permission to list service pipeline outputs	service*	aws:ResourceTag/${TagKey}	List
ListServicePipelineProvisionedResources	Grants permission to list service pipeline provisioned resources	service*	aws:ResourceTag/${TagKey}	List
ListServiceTemplateMajorVersions	Grants permission to list service template major versions. DEPRECATED - use ListServiceTemplateVersions instead	service-template*	aws:ResourceTag/${TagKey}	List
ListServiceTemplateMinorVersions	Grants permission to list service template minor versions. DEPRECATED - use ListServiceTemplateVersions instead	service-template*	aws:ResourceTag/${TagKey}	List
ListServiceTemplateVersions	Grants permission to list service template versions	service-template*	aws:ResourceTag/${TagKey}	List
ListServiceTemplates	Grants permission to list service templates			List
ListServices	Grants permission to list services			List
ListTagsForResource	Grants permission to list tags of a resource	component	aws:ResourceTag/${TagKey}	Read
		environment	aws:ResourceTag/${TagKey}
		environment-account-connection	aws:ResourceTag/${TagKey}
		environment-template	aws:ResourceTag/${TagKey}
		environment-template-major-version	aws:ResourceTag/${TagKey}
		environment-template-minor-version	aws:ResourceTag/${TagKey}
		environment-template-version	aws:ResourceTag/${TagKey}
		repository	aws:ResourceTag/${TagKey}
		service	aws:ResourceTag/${TagKey}
		service-instance	aws:ResourceTag/${TagKey}
		service-template	aws:ResourceTag/${TagKey}
		service-template-major-version	aws:ResourceTag/${TagKey}
		service-template-minor-version	aws:ResourceTag/${TagKey}
		service-template-version	aws:ResourceTag/${TagKey}
NotifyResourceDeploymentStatusChange	Grants permission to notify Proton of resource deployment status changes	environment	aws:ResourceTag/${TagKey}	Write
NotifyResourceDeploymentStatusChange		service-instance	aws:ResourceTag/${TagKey}	Write
RejectEnvironmentAccountConnection	Grants permission to reject an environment account connection request from another environment account	environment-account-connection*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add tags to a resource	component	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		environment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		environment-account-connection	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		environment-template	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		environment-template-major-version	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		environment-template-minor-version	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		environment-template-version	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		repository	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		service	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		service-instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		service-template	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		service-template-major-version	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		service-template-minor-version	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		service-template-version	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from a resource	component	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		environment	aws:ResourceTag/${TagKey} aws:TagKeys
		environment-account-connection	aws:ResourceTag/${TagKey} aws:TagKeys
		environment-template	aws:ResourceTag/${TagKey} aws:TagKeys
		environment-template-major-version	aws:ResourceTag/${TagKey} aws:TagKeys
		environment-template-minor-version	aws:ResourceTag/${TagKey} aws:TagKeys
		environment-template-version	aws:ResourceTag/${TagKey} aws:TagKeys
		repository	aws:ResourceTag/${TagKey} aws:TagKeys
		service	aws:ResourceTag/${TagKey} aws:TagKeys
		service-instance	aws:ResourceTag/${TagKey} aws:TagKeys
		service-template	aws:ResourceTag/${TagKey} aws:TagKeys
		service-template-major-version	aws:ResourceTag/${TagKey} aws:TagKeys
		service-template-minor-version	aws:ResourceTag/${TagKey} aws:TagKeys
		service-template-version	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAccountRoles	Grants permission to update account roles. DEPRECATED - use UpdateAccountSettings instead			Write
UpdateAccountSettings	Grants permission to update the account settings			Write
UpdateComponent	Grants permission to update component	component*	aws:ResourceTag/${TagKey}	Write
UpdateEnvironment	Grants permission to update an environment	environment*	aws:ResourceTag/${TagKey} proton:EnvironmentTemplate	Write
UpdateEnvironmentAccountConnection	Grants permission to update an environment account connection	environment-account-connection*	aws:ResourceTag/${TagKey}	Write
UpdateEnvironmentTemplate	Grants permission to update an environment template	environment-template*	aws:ResourceTag/${TagKey}	Write
UpdateEnvironmentTemplateMajorVersion	Grants permission to update an environment template major version. DEPRECATED - use UpdateEnvironmentTemplateVersion instead	environment-template*	aws:ResourceTag/${TagKey}	Write
UpdateEnvironmentTemplateMinorVersion	Grants permission to update an environment template minor version. DEPRECATED - use UpdateEnvironmentTemplateVersion instead	environment-template*	aws:ResourceTag/${TagKey}	Write
UpdateEnvironmentTemplateVersion	Grants permission to update an environment template version	environment-template*	aws:ResourceTag/${TagKey}	Write
UpdateService	Grants permission to update a service	service*	aws:ResourceTag/${TagKey} proton:ServiceTemplate	Write
UpdateServiceInstance	Grants permission to update a service instance	service-instance*	aws:ResourceTag/${TagKey} proton:ServiceTemplate	Write
UpdateServicePipeline	Grants permission to update a service pipeline	service*	aws:ResourceTag/${TagKey} proton:ServiceTemplate	Write
UpdateServiceSyncBlocker	Grants permission to update a service sync blocker			Write
UpdateServiceSyncConfig	Grants permission to update a service sync config			Write
UpdateServiceTemplate	Grants permission to update a service template	service-template*	aws:ResourceTag/${TagKey}	Write
UpdateServiceTemplateMajorVersion	Grants permission to update a service template major version. DEPRECATED - use UpdateServiceTemplateVersion instead	service-template*	aws:ResourceTag/${TagKey}	Write
UpdateServiceTemplateMinorVersion	Grants permission to create a service template minor version. DEPRECATED - use UpdateServiceTemplateVersion instead	service-template*	aws:ResourceTag/${TagKey}	Write
UpdateServiceTemplateVersion	Grants permission to update a service template version	service-template*	aws:ResourceTag/${TagKey}	Write
UpdateTemplateSyncConfig	Grants permission to update a TemplateSyncConfig			Write

Resource types defined by AWS Proton

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
component	arn:${Partition}:proton:${Region}:${Account}:component/${Id}	aws:ResourceTag/${TagKey}
deployment	arn:${Partition}:proton:${Region}:${Account}:deployment/${Id}	aws:ResourceTag/${TagKey}
environment	arn:${Partition}:proton:${Region}:${Account}:environment/${Name}	aws:ResourceTag/${TagKey}
environment-account-connection	arn:${Partition}:proton:${Region}:${Account}:environment-account-connection/${Id}	aws:ResourceTag/${TagKey}
environment-template	arn:${Partition}:proton:${Region}:${Account}:environment-template/${Name}	aws:ResourceTag/${TagKey}
environment-template-major-version	arn:${Partition}:proton:${Region}:${Account}:environment-template/${TemplateName}:${MajorVersionId}	aws:ResourceTag/${TagKey}
environment-template-minor-version	arn:${Partition}:proton:${Region}:${Account}:environment-template/${TemplateName}:${MajorVersionId}.${MinorVersionId}	aws:ResourceTag/${TagKey}
environment-template-version	arn:${Partition}:proton:${Region}:${Account}:environment-template/${TemplateName}:${MajorVersion}.${MinorVersion}	aws:ResourceTag/${TagKey}
repository	arn:${Partition}:proton:${Region}:${Account}:repository/${Provider}:${Name}	aws:ResourceTag/${TagKey}
service	arn:${Partition}:proton:${Region}:${Account}:service/${Name}	aws:ResourceTag/${TagKey}
service-instance	arn:${Partition}:proton:${Region}:${Account}:service/${ServiceName}/service-instance/${Name}	aws:ResourceTag/${TagKey}
service-template	arn:${Partition}:proton:${Region}:${Account}:service-template/${Name}	aws:ResourceTag/${TagKey}
service-template-major-version	arn:${Partition}:proton:${Region}:${Account}:service-template/${TemplateName}:${MajorVersionId}	aws:ResourceTag/${TagKey}
service-template-minor-version	arn:${Partition}:proton:${Region}:${Account}:service-template/${TemplateName}:${MajorVersionId}.${MinorVersionId}	aws:ResourceTag/${TagKey}
service-template-version	arn:${Partition}:proton:${Region}:${Account}:service-template/${TemplateName}:${MajorVersion}.${MinorVersion}	aws:ResourceTag/${TagKey}

Condition keys for AWS Proton

AWS Proton defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by tag keys in the request	ArrayOfString
proton:EnvironmentTemplate	Filters access by specified environment template related to resource	String
proton:ServiceTemplate	Filters access by specified service template related to resource	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS PrivateLink (vpce)

AWS Purchase Orders Console (purchase-orders)