Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Q in Connect

Amazon Q in Connect (service prefix: wisdom) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Q in Connect
Actions defined by Amazon Q in Connect
Permission-only actions for Amazon Q in Connect
Resource types defined by Amazon Q in Connect
Condition keys for Amazon Q in Connect

API operations defined by Amazon Q in Connect

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
ActivateMessageTemplate	qconnect	wisdom:ActivateMessageTemplate			Write
CreateAIAgent	qconnect	wisdom:CreateAIAgent			Write
CreateAIAgent	qconnect	wisdom:TagResource			Tagging, Write
CreateAIAgentVersion	qconnect	wisdom:CreateAIAgentVersion			Write
CreateAIGuardrail	qconnect	wisdom:CreateAIGuardrail			Write
CreateAIGuardrail	qconnect	wisdom:TagResource			Tagging, Write
CreateAIGuardrailVersion	qconnect	wisdom:CreateAIGuardrailVersion			Write
CreateAIPrompt	qconnect	wisdom:CreateAIPrompt			Write
CreateAIPrompt	qconnect	wisdom:TagResource			Tagging, Write
CreateAIPromptVersion	qconnect	wisdom:CreateAIPromptVersion			Write
CreateAssistant	qconnect	wisdom:CreateAssistant			Write
CreateAssistant	qconnect	wisdom:TagResource			Tagging, Write
CreateAssistantAssociation	qconnect	wisdom:CreateAssistantAssociation			Write
		wisdom:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	wisdom.amazonaws.com	Write
CreateContent	qconnect	wisdom:CreateContent			Write
CreateContent	qconnect	wisdom:TagResource			Tagging, Write
CreateContentAssociation	qconnect	wisdom:CreateContentAssociation			Write
CreateContentAssociation	qconnect	wisdom:TagResource			Tagging, Write
CreateKnowledgeBase	qconnect	wisdom:CreateKnowledgeBase			Write
CreateKnowledgeBase	qconnect	wisdom:TagResource			Tagging, Write
CreateMessageTemplate	qconnect	wisdom:CreateMessageTemplate			Write
CreateMessageTemplate	qconnect	wisdom:TagResource			Tagging, Write
CreateMessageTemplateAttachment	qconnect	wisdom:CreateMessageTemplateAttachment			Write
CreateMessageTemplateVersion	qconnect	wisdom:CreateMessageTemplateVersion			Write
CreateQuickResponse	qconnect	wisdom:CreateQuickResponse			Write
CreateQuickResponse	qconnect	wisdom:TagResource			Tagging, Write
CreateSession	qconnect	wisdom:CreateSession			Write
CreateSession	qconnect	wisdom:TagResource			Tagging, Write
DeactivateMessageTemplate	qconnect	wisdom:DeactivateMessageTemplate			Write
DeleteAIAgent	qconnect	wisdom:DeleteAIAgent			Write
DeleteAIAgentVersion	qconnect	wisdom:DeleteAIAgentVersion			Write
DeleteAIGuardrail	qconnect	wisdom:DeleteAIGuardrail			Write
DeleteAIGuardrailVersion	qconnect	wisdom:DeleteAIGuardrailVersion			Write
DeleteAIPrompt	qconnect	wisdom:DeleteAIPrompt			Write
DeleteAIPromptVersion	qconnect	wisdom:DeleteAIPromptVersion			Write
DeleteAssistant	qconnect	wisdom:DeleteAssistant			Write
DeleteAssistantAssociation	qconnect	wisdom:DeleteAssistantAssociation			Write
DeleteContent	qconnect	wisdom:DeleteContent			Write
DeleteContentAssociation	qconnect	wisdom:DeleteContentAssociation			Write
DeleteImportJob	qconnect	wisdom:DeleteImportJob			Write
DeleteKnowledgeBase	qconnect	wisdom:DeleteKnowledgeBase			Write
DeleteMessageTemplate	qconnect	wisdom:DeleteMessageTemplate			Write
DeleteMessageTemplateAttachment	qconnect	wisdom:DeleteMessageTemplateAttachment			Write
DeleteQuickResponse	qconnect	wisdom:DeleteQuickResponse			Write
GetAIAgent	qconnect	wisdom:GetAIAgent			Read
GetAIGuardrail	qconnect	wisdom:GetAIGuardrail			Read
GetAIPrompt	qconnect	wisdom:GetAIPrompt			Read
GetAssistant	qconnect	wisdom:GetAssistant			Read
GetAssistantAssociation	qconnect	wisdom:GetAssistantAssociation			Read
GetContent	qconnect	wisdom:GetContent			Read
GetContentAssociation	qconnect	wisdom:GetContentAssociation			Read
GetContentSummary	qconnect	wisdom:GetContentSummary			Read
GetImportJob	qconnect	wisdom:GetImportJob			Read
GetKnowledgeBase	qconnect	wisdom:GetKnowledgeBase			Read
GetMessageTemplate	qconnect	wisdom:GetMessageTemplate			Read
GetNextMessage	qconnect	wisdom:GetNextMessage			Read
GetQuickResponse	qconnect	wisdom:GetQuickResponse			Read
GetRecommendations	qconnect	wisdom:GetRecommendations			Read
GetSession	qconnect	wisdom:GetSession			Read
ListAIAgentVersions	qconnect	wisdom:ListAIAgentVersions			List
ListAIAgents	qconnect	wisdom:ListAIAgents			List
ListAIGuardrailVersions	qconnect	wisdom:ListAIGuardrailVersions			List
ListAIGuardrails	qconnect	wisdom:ListAIGuardrails			List
ListAIPromptVersions	qconnect	wisdom:ListAIPromptVersions			List
ListAIPrompts	qconnect	wisdom:ListAIPrompts			List
ListAssistantAssociations	qconnect	wisdom:ListAssistantAssociations			List
ListAssistants	qconnect	wisdom:ListAssistants			List
ListContentAssociations	qconnect	wisdom:ListContentAssociations			List
ListContents	qconnect	wisdom:ListContents			List
ListImportJobs	qconnect	wisdom:ListImportJobs			List
ListKnowledgeBases	qconnect	wisdom:ListKnowledgeBases			List
ListMessageTemplateVersions	qconnect	wisdom:ListMessageTemplateVersions			List
ListMessageTemplates	qconnect	wisdom:ListMessageTemplates			List
ListMessages	qconnect	wisdom:ListMessages			List
ListModels	qconnect	wisdom:ListModels			List
ListQuickResponses	qconnect	wisdom:ListQuickResponses			List
ListSpans	qconnect	wisdom:ListSpans			List
ListTagsForResource	qconnect	wisdom:ListTagsForResource			Read
NotifyRecommendationsReceived	qconnect	wisdom:NotifyRecommendationsReceived			Write
PutFeedback	qconnect	wisdom:PutFeedback			Write
QueryAssistant	qconnect	wisdom:QueryAssistant			Read
RemoveAssistantAIAgent	qconnect	wisdom:RemoveAssistantAIAgent			Write
RemoveKnowledgeBaseTemplateUri	qconnect	wisdom:RemoveKnowledgeBaseTemplateUri			Write
RenderMessageTemplate	qconnect	wisdom:GetMessageTemplate			Read
RenderMessageTemplate	qconnect	wisdom:RenderMessageTemplate			Read
Retrieve	qconnect	wisdom:Retrieve			Read
SearchContent	qconnect	wisdom:SearchContent			Read
SearchMessageTemplates	qconnect	wisdom:SearchMessageTemplates			Read
SearchQuickResponses	qconnect	wisdom:GetQuickResponse			Read
SearchQuickResponses	qconnect	wisdom:SearchQuickResponses			Read
SearchSessions	qconnect	wisdom:SearchSessions			Read
SendMessage	qconnect	wisdom:SendMessage			Write
StartContentUpload	qconnect	wisdom:StartContentUpload			Write
StartImportJob	qconnect	wisdom:StartImportJob			Write
TagResource	qconnect	wisdom:TagResource			Tagging, Write
UntagResource	qconnect	wisdom:UntagResource			Tagging, Write
UpdateAIAgent	qconnect	wisdom:UpdateAIAgent			Write
UpdateAIGuardrail	qconnect	wisdom:UpdateAIGuardrail			Write
UpdateAIPrompt	qconnect	wisdom:UpdateAIPrompt			Write
UpdateAssistantAIAgent	qconnect	wisdom:UpdateAssistantAIAgent			Write
UpdateContent	qconnect	wisdom:UpdateContent			Write
UpdateKnowledgeBaseTemplateUri	qconnect	wisdom:UpdateKnowledgeBaseTemplateUri			Write
UpdateMessageTemplate	qconnect	wisdom:UpdateMessageTemplate			Write
UpdateMessageTemplateMetadata	qconnect	wisdom:UpdateMessageTemplateMetadata			Write
UpdateQuickResponse	qconnect	wisdom:UpdateQuickResponse			Write
UpdateSession	qconnect	wisdom:UpdateSession			Write
UpdateSessionData	qconnect	wisdom:UpdateSessionData			Write
CreateAssistant	wisdom	wisdom:CreateAssistant			Write
CreateAssistant	wisdom	wisdom:TagResource			Tagging, Write
CreateAssistantAssociation	wisdom	wisdom:CreateAssistantAssociation			Write
		wisdom:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	wisdom.amazonaws.com	Write
CreateContent	wisdom	wisdom:CreateContent			Write
CreateContent	wisdom	wisdom:TagResource			Tagging, Write
CreateKnowledgeBase	wisdom	wisdom:CreateKnowledgeBase			Write
CreateKnowledgeBase	wisdom	wisdom:TagResource			Tagging, Write
CreateQuickResponse	wisdom	wisdom:CreateQuickResponse			Write
CreateQuickResponse	wisdom	wisdom:TagResource			Tagging, Write
CreateSession	wisdom	wisdom:CreateSession			Write
CreateSession	wisdom	wisdom:TagResource			Tagging, Write
DeleteAssistant	wisdom	wisdom:DeleteAssistant			Write
DeleteAssistantAssociation	wisdom	wisdom:DeleteAssistantAssociation			Write
DeleteContent	wisdom	wisdom:DeleteContent			Write
DeleteImportJob	wisdom	wisdom:DeleteImportJob			Write
DeleteKnowledgeBase	wisdom	wisdom:DeleteKnowledgeBase			Write
DeleteQuickResponse	wisdom	wisdom:DeleteQuickResponse			Write
GetAssistant	wisdom	wisdom:GetAssistant			Read
GetAssistantAssociation	wisdom	wisdom:GetAssistantAssociation			Read
GetContent	wisdom	wisdom:GetContent			Read
GetContentSummary	wisdom	wisdom:GetContentSummary			Read
GetImportJob	wisdom	wisdom:GetImportJob			Read
GetKnowledgeBase	wisdom	wisdom:GetKnowledgeBase			Read
GetQuickResponse	wisdom	wisdom:GetQuickResponse			Read
GetRecommendations	wisdom	wisdom:GetRecommendations			Read
GetSession	wisdom	wisdom:GetSession			Read
ListAssistantAssociations	wisdom	wisdom:ListAssistantAssociations			List
ListAssistants	wisdom	wisdom:ListAssistants			List
ListContents	wisdom	wisdom:ListContents			List
ListImportJobs	wisdom	wisdom:ListImportJobs			List
ListKnowledgeBases	wisdom	wisdom:ListKnowledgeBases			List
ListQuickResponses	wisdom	wisdom:ListQuickResponses			List
ListTagsForResource	wisdom	wisdom:ListTagsForResource			Read
NotifyRecommendationsReceived	wisdom	wisdom:NotifyRecommendationsReceived			Write
QueryAssistant	wisdom	wisdom:QueryAssistant			Read
RemoveKnowledgeBaseTemplateUri	wisdom	wisdom:RemoveKnowledgeBaseTemplateUri			Write
SearchContent	wisdom	wisdom:SearchContent			Read
SearchQuickResponses	wisdom	wisdom:GetQuickResponse			Read
SearchQuickResponses	wisdom	wisdom:SearchQuickResponses			Read
SearchSessions	wisdom	wisdom:SearchSessions			Read
StartContentUpload	wisdom	wisdom:StartContentUpload			Write
StartImportJob	wisdom	wisdom:StartImportJob			Write
TagResource	wisdom	wisdom:TagResource			Tagging, Write
UntagResource	wisdom	wisdom:UntagResource			Tagging, Write
UpdateContent	wisdom	wisdom:UpdateContent			Write
UpdateKnowledgeBaseTemplateUri	wisdom	wisdom:UpdateKnowledgeBaseTemplateUri			Write
UpdateQuickResponse	wisdom	wisdom:UpdateQuickResponse			Write

Actions defined by Amazon Q in Connect

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
ActivateMessageTemplate	Grants permission to activate a message template	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
ActivateMessageTemplate	Grants permission to activate a message template	MessageTemplate*	aws:ResourceTag/${TagKey} wisdom:MessageTemplate/RoutingProfileArn	Write
CreateAIAgent	Grants permission to create an ai agent		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateAIAgentVersion	Grants permission to create an ai agent version	AIAgent*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAIGuardrail	Grants permission to create an ai guardrail		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateAIGuardrailVersion	Grants permission to create an ai guardrail version	AIGuardrail*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAIPrompt	Grants permission to create an ai prompt		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateAIPromptVersion	Grants permission to create an ai prompt version	AIPrompt*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAssistant	Grants permission to create an assistant		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateAssistantAssociation	Grants permission to create an association between an assistant and another resource		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateContent	Grants permission to create content	KnowledgeBase*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateContentAssociation	Grants permission to create a content association	Content*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateContentAssociation	Grants permission to create a content association	KnowledgeBase*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateKnowledgeBase	Grants permission to create a knowledge base		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateMessageTemplate	Grants permission to create a message template	KnowledgeBase*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateMessageTemplateAttachment	Grants permission to create an attachment to a message template	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
CreateMessageTemplateAttachment		MessageTemplate*	aws:ResourceTag/${TagKey} wisdom:MessageTemplate/RoutingProfileArn	Write
CreateMessageTemplateVersion	Grants permission to create a version of a message template	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
CreateMessageTemplateVersion	Grants permission to create a version of a message template	MessageTemplate*	aws:ResourceTag/${TagKey} wisdom:MessageTemplate/RoutingProfileArn	Write
CreateQuickResponse	Grants permission to create quick response		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateSession	Grants permission to create a session		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeactivateMessageTemplate	Grants permission to deactivate a message template	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
DeactivateMessageTemplate	Grants permission to deactivate a message template	MessageTemplate*	aws:ResourceTag/${TagKey} wisdom:MessageTemplate/RoutingProfileArn	Write
DeleteAIAgent	Grants permission to delete an ai agent	AIAgent*	aws:ResourceTag/${TagKey}	Write
DeleteAIAgentVersion	Grants permission to delete an ai agent version	AIAgent*	aws:ResourceTag/${TagKey}	Write
DeleteAIGuardrail	Grants permission to delete an ai guardrail	AIGuardrail*	aws:ResourceTag/${TagKey}	Write
DeleteAIGuardrailVersion	Grants permission to delete an ai guardrail version	AIGuardrail*	aws:ResourceTag/${TagKey}	Write
DeleteAIPrompt	Grants permission to delete an ai prompt	AIPrompt*	aws:ResourceTag/${TagKey}	Write
DeleteAIPromptVersion	Grants permission to delete an ai prompt version	AIPrompt*	aws:ResourceTag/${TagKey}	Write
DeleteAssistant	Grants permission to delete an assistant	Assistant*	aws:ResourceTag/${TagKey}	Write
DeleteAssistantAssociation	Grants permission to delete an assistant association	AssistantAssociation*	aws:ResourceTag/${TagKey}	Write
DeleteContent	Grants permission to delete content	Content*	aws:ResourceTag/${TagKey}	Write
DeleteContent	Grants permission to delete content	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
DeleteContentAssociation	Grants permission to delete a content association	Content*	aws:ResourceTag/${TagKey}	Write
		ContentAssociation*	aws:ResourceTag/${TagKey}
		KnowledgeBase*	aws:ResourceTag/${TagKey}
DeleteImportJob	Grants permission to delete a import job of a knowledge base	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
DeleteKnowledgeBase	Grants permission to delete a knowledge base	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
DeleteMessageTemplate	Grants permission to delete a message template	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
DeleteMessageTemplate	Grants permission to delete a message template	MessageTemplate*	aws:ResourceTag/${TagKey} wisdom:MessageTemplate/RoutingProfileArn	Write
DeleteMessageTemplateAttachment	Grants permission to delete an attachment from a message template	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
DeleteMessageTemplateAttachment		MessageTemplate*	aws:ResourceTag/${TagKey} wisdom:MessageTemplate/RoutingProfileArn	Write
DeleteQuickResponse	Grants permission to delete quick response	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
DeleteQuickResponse	Grants permission to delete quick response	QuickResponse*	aws:ResourceTag/${TagKey}	Write
GetAIAgent	Grants permission to retrieve information about an ai agent	AIAgent*	aws:ResourceTag/${TagKey}	Read
GetAIGuardrail	Grants permission to retrieve information about an ai guardrail	AIGuardrail*	aws:ResourceTag/${TagKey}	Read
GetAIPrompt	Grants permission to retrieve information about an ai prompt	AIPrompt*	aws:ResourceTag/${TagKey}	Read
GetAssistant	Grants permission to retrieve information about an assistant	Assistant*	aws:ResourceTag/${TagKey}	Read
GetAssistantAssociation	Grants permission to retrieve information about an assistant association	AssistantAssociation*	aws:ResourceTag/${TagKey}	Read
GetContent	Grants permission to retrieve content, including a pre-signed URL to download the content	Content*	aws:ResourceTag/${TagKey}	Read
GetContent		KnowledgeBase*	aws:ResourceTag/${TagKey}	Read
GetContentAssociation	Grants permission to retrieve information about a content association	Content*	aws:ResourceTag/${TagKey}	Read
		ContentAssociation*	aws:ResourceTag/${TagKey}
		KnowledgeBase*	aws:ResourceTag/${TagKey}
GetContentSummary	Grants permission to retrieve summary information about the content	Content*	aws:ResourceTag/${TagKey}	Read
GetContentSummary		KnowledgeBase*	aws:ResourceTag/${TagKey}	Read
GetImportJob	Grants permission to retrieve information about the import job	KnowledgeBase*	aws:ResourceTag/${TagKey}	Read
GetKnowledgeBase	Grants permission to retrieve information about the knowledge base	KnowledgeBase*	aws:ResourceTag/${TagKey}	Read
GetMessageTemplate	Grants permission to retrieve a message template	KnowledgeBase*	aws:ResourceTag/${TagKey} wisdom:MessageTemplate/RoutingProfileArn	Read
GetMessageTemplate	Grants permission to retrieve a message template	MessageTemplate*	aws:ResourceTag/${TagKey} wisdom:MessageTemplate/RoutingProfileArn	Read
GetNextMessage	Grants permission to retrieve for next message in a session	Session*	aws:ResourceTag/${TagKey}	Read
GetQuickResponse	Grants permission to retrieve content	KnowledgeBase*	aws:ResourceTag/${TagKey}	Read
GetQuickResponse	Grants permission to retrieve content	QuickResponse*	aws:ResourceTag/${TagKey}	Read
GetRecommendations	Grants permission to retrieve recommendations for the specified session	Session*	aws:ResourceTag/${TagKey}	Read
GetSession	Grants permission to retrieve information for a specified session	Session*	aws:ResourceTag/${TagKey}	Read
ListAIAgentVersions	Grants permission to list information about ai agent versions	AIAgent*	aws:ResourceTag/${TagKey}	List
ListAIAgents	Grants permission to list information about ai agents			List
ListAIGuardrailVersions	Grants permission to list information about ai guardrail versions	AIGuardrail*	aws:ResourceTag/${TagKey}	List
ListAIGuardrails	Grants permission to list information about ai guardrails			List
ListAIPromptVersions	Grants permission to list information about ai prompt versions	AIPrompt*	aws:ResourceTag/${TagKey}	List
ListAIPrompts	Grants permission to list information about ai prompts			List
ListAssistantAssociations	Grants permission to list information about assistant associations			List
ListAssistants	Grants permission to list information about assistants			List
ListContentAssociations	Grants permission to list information about content associations	Content*	aws:ResourceTag/${TagKey}	List
ListContentAssociations		KnowledgeBase*	aws:ResourceTag/${TagKey}	List
ListContents	Grants permission to list the content with a knowledge base	KnowledgeBase*	aws:ResourceTag/${TagKey}	List
ListImportJobs	Grants permission to list information about knowledge bases	KnowledgeBase*	aws:ResourceTag/${TagKey}	List
ListKnowledgeBases	Grants permission to list information about knowledge bases			List
ListMessageTemplateVersions	Grants permission to list message template versions for the specified message template	KnowledgeBase*	aws:ResourceTag/${TagKey}	List
ListMessageTemplateVersions		MessageTemplate*	aws:ResourceTag/${TagKey} wisdom:MessageTemplate/RoutingProfileArn	List
ListMessageTemplates	Grants permission to list the message templates for a knowledge base	KnowledgeBase*	aws:ResourceTag/${TagKey}	List
ListMessages	Grants permission to list messages in a session	Session*	aws:ResourceTag/${TagKey}	List
ListModels	Grants permission to list models available for an assistant	Assistant*	aws:ResourceTag/${TagKey}	List
ListQuickResponses	Grants permission to list the quick response with a knowledge base	KnowledgeBase*	aws:ResourceTag/${TagKey}	List
ListSpans	Grants permission to list AI agent traces for a session	Session*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list the tags for the specified resource			Read
NotifyRecommendationsReceived	Grants permission to remove the specified recommendations from the specified assistant's queue of newly available recommendations	Session*	aws:ResourceTag/${TagKey}	Write
PutFeedback	Grants permission to submit feedback	Assistant*	aws:ResourceTag/${TagKey}	Write
QueryAssistant	Grants permission to perform a manual search against the specified assistant	Assistant*	aws:ResourceTag/${TagKey}	Read
RemoveAssistantAIAgent	Grants permission to remove an ai agent from an assistant	Assistant*	aws:ResourceTag/${TagKey}	Write
RemoveKnowledgeBaseTemplateUri	Grants permission to remove a URI template from a knowledge base	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
RenderMessageTemplate	Grants permission to render a message template	KnowledgeBase*	aws:ResourceTag/${TagKey} wisdom:MessageTemplate/RoutingProfileArn	Read
RenderMessageTemplate	Grants permission to render a message template	MessageTemplate*	aws:ResourceTag/${TagKey} wisdom:MessageTemplate/RoutingProfileArn	Read
Retrieve	Grants permission to retrieve knowledge content from specified assistant associations	Assistant*	aws:ResourceTag/${TagKey}	Read
SearchContent	Grants permission to search for content referencing a specified knowledge base. Can be used to get a specific content resource by its name	KnowledgeBase*	aws:ResourceTag/${TagKey}	Read
SearchMessageTemplates	Grants permission to search for message templates referencing a specified knowledge base	KnowledgeBase*	aws:ResourceTag/${TagKey} wisdom:SearchFilter/Qualifier wisdom:SearchFilter/RoutingProfileArn	Read
SearchQuickResponses	Grants permission to search for quick response referencing a specified knowledge base	KnowledgeBase*	aws:ResourceTag/${TagKey} wisdom:SearchFilter/RoutingProfileArn	Read
SearchSessions	Grants permission to search for sessions referencing a specified assistant. Can be used to et a specific session resource by its name			Read
SendMessage	Grants permission to send a message	Session*	aws:ResourceTag/${TagKey}	Write
StartContentUpload	Grants permission to get a URL to upload content to a knowledge base	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
StartImportJob	Grants permission to create multiple quick responses	KnowledgeBase*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
TagResource	Grants permission to add the specified tags to the specified resource	Assistant	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		AssistantAssociation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Content	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		ContentAssociation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		KnowledgeBase	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		MessageTemplate	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys wisdom:MessageTemplate/RoutingProfileArn
		QuickResponse	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Session	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove the specified tags from the specified resource	Assistant	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		AssistantAssociation	aws:ResourceTag/${TagKey} aws:TagKeys
		Content	aws:ResourceTag/${TagKey} aws:TagKeys
		ContentAssociation	aws:ResourceTag/${TagKey} aws:TagKeys
		KnowledgeBase	aws:ResourceTag/${TagKey} aws:TagKeys
		MessageTemplate	aws:ResourceTag/${TagKey} aws:TagKeys wisdom:MessageTemplate/RoutingProfileArn
		QuickResponse	aws:ResourceTag/${TagKey} aws:TagKeys
		Session	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAIAgent	Grants permission to update information about an ai agent	AIAgent*	aws:ResourceTag/${TagKey}	Write
UpdateAIGuardrail	Grants permission to update information about an ai guardrail	AIGuardrail*	aws:ResourceTag/${TagKey}	Write
UpdateAIPrompt	Grants permission to update information about an ai prompt	AIPrompt*	aws:ResourceTag/${TagKey}	Write
UpdateAssistantAIAgent	Grants permission to update assistant information about an ai agent	Assistant*	aws:ResourceTag/${TagKey}	Write
UpdateContent	Grants permission to update information about the content	Content*	aws:ResourceTag/${TagKey}	Write
UpdateContent	Grants permission to update information about the content	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
UpdateKnowledgeBaseTemplateUri	Grants permission to update the template URI of a knowledge base	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
UpdateMessageTemplate	Grants permission to update content of the message template	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
UpdateMessageTemplate	Grants permission to update content of the message template	MessageTemplate*	aws:ResourceTag/${TagKey} wisdom:MessageTemplate/RoutingProfileArn	Write
UpdateMessageTemplateMetadata	Grants permission to update metadata of the message template	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
UpdateMessageTemplateMetadata		MessageTemplate*	aws:ResourceTag/${TagKey} wisdom:MessageTemplate/RoutingProfileArn	Write
UpdateQuickResponse	Grants permission to update information or content of the quick response	KnowledgeBase*	aws:ResourceTag/${TagKey}	Write
UpdateQuickResponse		QuickResponse*	aws:ResourceTag/${TagKey}	Write
UpdateSession	Grants permission to update a session	Session*	aws:ResourceTag/${TagKey}	Write
UpdateSessionData	Grants permission to update data stored in a session	Session*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon Q in Connect

The following actions are defined by Amazon Q in Connect but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AllowVendedLogDeliveryForResource	Grants permission to configure vended log delivery for an assistant	Assistant	aws:ResourceTag/${TagKey}	Permissions management, Write

Resource types defined by Amazon Q in Connect

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
AIAgent	arn:${Partition}:wisdom:${Region}:${Account}:ai-agent/${AssistantId}/${AIAgentId}	aws:ResourceTag/${TagKey}
AIGuardrail	arn:${Partition}:wisdom:${Region}:${Account}:ai-guardrail/${AssistantId}/${AIGuardrailId}	aws:ResourceTag/${TagKey}
AIPrompt	arn:${Partition}:wisdom:${Region}:${Account}:ai-prompt/${AssistantId}/${AIPromptId}	aws:ResourceTag/${TagKey}
Assistant	arn:${Partition}:wisdom:${Region}:${Account}:assistant/${AssistantId}	aws:ResourceTag/${TagKey}
AssistantAssociation	arn:${Partition}:wisdom:${Region}:${Account}:association/${AssistantId}/${AssistantAssociationId}	aws:ResourceTag/${TagKey}
Content	arn:${Partition}:wisdom:${Region}:${Account}:content/${KnowledgeBaseId}/${ContentId}	aws:ResourceTag/${TagKey}
ContentAssociation	arn:${Partition}:wisdom:${Region}:${Account}:content-association/${KnowledgeBaseId}/${ContentId}/${ContentAssociationId}	aws:ResourceTag/${TagKey}
KnowledgeBase	arn:${Partition}:wisdom:${Region}:${Account}:knowledge-base/${KnowledgeBaseId}	aws:ResourceTag/${TagKey}
MessageTemplate	arn:${Partition}:wisdom:${Region}:${Account}:message-template/${KnowledgeBaseId}/${MessageTemplateId}	aws:ResourceTag/${TagKey} wisdom:MessageTemplate/RoutingProfileArn
QuickResponse	arn:${Partition}:wisdom:${Region}:${Account}:quick-response/${KnowledgeBaseId}/${QuickResponseId}	aws:ResourceTag/${TagKey}
Session	arn:${Partition}:wisdom:${Region}:${Account}:session/${AssistantId}/${SessionId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Q in Connect

Amazon Q in Connect defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
wisdom:MessageTemplate/RoutingProfileArn	Filters access by the connect routing profile arns associated with the resource	ArrayOfARN
wisdom:SearchFilter/Qualifier	Filters access by the qualifiers that are passed in the request	ArrayOfString
wisdom:SearchFilter/RoutingProfileArn	Filters access by the connect routing profile arn that is passed in the request	ARN

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Q Developer (qdeveloper)

Amazon QLDB (qldb)