Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Q

Amazon Q (service prefix: q) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Actions defined by Amazon Q

Amazon Q has no API operations that can be used in the Actions element of an IAM policy statement.

Permission-only actions for Amazon Q

The following actions are defined by Amazon Q but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateConnectorResource	Grants permission to associate an AWS resource with an Amazon Q connector			Write
AssociateLoginDomain	Grants permission to associate a login domain with an Amazon Q Developer Profile	profile*	aws:ResourceTag/${TagKey}	Write
BatchDescribeGroups	Grants permission to describe multiple groups for an Amazon Q Developer Profile	profile*	aws:ResourceTag/${TagKey}	Read
BatchDescribeUsers	Grants permission to describe multiple users for an Amazon Q Developer Profile	profile*	aws:ResourceTag/${TagKey}	Read
BatchGetGroups	Grants permission to get multiple groups for an Amazon Q Developer Profile	profile*	aws:ResourceTag/${TagKey}	Read
BatchGetUsers	Grants permission to get multiple users for an Amazon Q Developer Profile	profile*	aws:ResourceTag/${TagKey}	Read
CreateArtifact	Grants permission to create an artifact with Amazon Q			Write
CreateAssignment	Grants permission to create a user or group assignment for an Amazon Q Developer Profile	profile*	aws:ResourceTag/${TagKey} identitystore:GroupId identitystore:UserId	Write
CreateAuthGrant	Grants permission to create OAuth user in Amazon Q			Write
CreateOAuthAppConnection	Grants permission to register an OAuth application in Amazon Q			Write
CreatePlugin	Grants permission to create and configure a third party plugin in Amazon Q	plugin*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateScimAccessToken	Grants permission to create a SCIM access token for an Amazon Q Developer Profile	profile*	aws:ResourceTag/${TagKey}	Write
DeleteAssignment	Grants permission to delete a user or group assignment for an Amazon Q Developer Profile	profile*	aws:ResourceTag/${TagKey} identitystore:GroupId identitystore:UserId	Write
DeleteConversation	Grants permission to delete a conversation with Amazon Q			Write
DeleteOAuthAppConnection	Grants permission to delete an OAuth application in Amazon Q			Write
DeletePlugin	Grants permission to delete a configured plugin in Amazon Q	plugin*	aws:ResourceTag/${TagKey}	Write
DeleteScimAccessToken	Grants permission to delete a SCIM access token for an Amazon Q Developer Profile	profile*	aws:ResourceTag/${TagKey}	Write
DisassociateLoginDomain	Grants permission to disassociate a login domain from an Amazon Q Developer Profile	profile*	aws:ResourceTag/${TagKey}	Write
GenerateCodeFromCommands	Grants permission to generate code from CLI commands in Amazon Q			Read
GenerateCodeRecommendations	Grants permission to generate code recommendations in Amazon Q			Read
GetArtifact	Grants permission to view an Amazon Q artifact			Read
GetArtifactActionResult	Grants permission to view results of an action in an Amazon Q artifact			Read
GetConnector	Grants permission to view information about a specific Amazon Q connector			Read
GetConversation	Grants permission to get individual messages associated with a specific conversation with Amazon Q			Read
GetIdentityMetadata	Grants permission to Amazon Q to get the identity metadata			Read
GetPlugin	Grants permission to view information about a specific configured Amazon Q plugin	plugin*	aws:ResourceTag/${TagKey}	Read
GetTroubleshootingResults	Grants permission to get troubleshooting results with Amazon Q			Read
ListConversations	Grants permission to list individual conversations associated with a specific Amazon Q user			Read
ListDashboardMetrics	Grants permission to read metrics to populate Amazon Q dashboard			List
ListGroups	Grants permission to list groups for an Amazon Q Developer Profile	profile*	aws:ResourceTag/${TagKey}	List
ListLoginDomains	Grants permission to list login domains for an Amazon Q Developer Profile	profile*	aws:ResourceTag/${TagKey}	List
ListPluginProviders	Grants permission to list available plugins in Amazon Q			List
ListPlugins	Grants permission to list configured plugins in Amazon Q	plugin*	aws:ResourceTag/${TagKey}	List
ListScimAccessTokens	Grants permission to list SCIM access tokens for an Amazon Q Developer Profile	profile*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list all tags associated with an Amazon Q resource	plugin	aws:ResourceTag/${TagKey}	List
ListUsers	Grants permission to list users for an Amazon Q Developer Profile	profile*	aws:ResourceTag/${TagKey}	List
PassRequest	Grants permission to allow Amazon Q to perform actions on your behalf			Write
PerformArtifactAction	Grants permission to perform an action in an Amazon Q artifact			Write
RejectConnector	Grants permission to reject a connection request for an Amazon Q connector			Write
SendEvent	Grants permission to trigger asynchronous Amazon Q actions			Write
SendMessage	Grants permission to send a message to Amazon Q			Write
StartConversation	Grants permission to start a conversation with Amazon Q			Write
StartTroubleshootingAnalysis	Grants permission to start a troubleshooting analysis with Amazon Q			Write
StartTroubleshootingResolutionExplanation	Grants permission to start a troubleshooting resolution explanation with Amazon Q			Write
TagResource	Grants permission to associate tags with an Amazon Q resource	plugin	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource		profile	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags associated with an Amazon Q resource	plugin	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource		profile	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateAssignment	Grants permission to update a user or group assignment for an Amazon Q Developer Profile	profile*	aws:ResourceTag/${TagKey} identitystore:GroupId identitystore:UserId	Write
UpdateAuthGrant	Grants permission to update OAuth user in Amazon Q			Write
UpdateConversation	Grants permission to update a conversation with Amazon Q			Write
UpdateOAuthAppConnection	Grants permission to update an OAuth application in Amazon Q			Write
UpdatePlugin	Grants permission to update a third party plugin in Amazon Q	plugin*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateTroubleshootingCommandResult	Grants permission to update a troubleshooting command result with Amazon Q			Write
UsePlugin	Grants permission to use Amazon Q plugins	plugin*	aws:ResourceTag/${TagKey}	Write
VerifyOAuthAppConnection	Grants permission to verify an OAuth application in Amazon Q			Write

Resource types defined by Amazon Q

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
plugin	arn:${Partition}:qdeveloper:${Region}:${Account}:plugin/${Identifier}	aws:ResourceTag/${TagKey}
profile	arn:${Partition}:codewhisperer:${Region}:${Account}:profile/${Identifier}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Q

Amazon Q defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the Amazon Q resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
identitystore:GroupId	Filters access by IAM Identity Center Group ID	ArrayOfString
identitystore:UserId	Filters access by IAM Identity Center User ID	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Polly (polly)

Amazon Q Business (qbusiness)