Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Resilience Hub

AWS Resilience Hub (service prefix: resiliencehub) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Resilience Hub
Actions defined by AWS Resilience Hub
Resource types defined by AWS Resilience Hub
Condition keys for AWS Resilience Hub

API operations defined by AWS Resilience Hub

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
AcceptResourceGroupingRecommendations	resiliencehub	resiliencehub:AcceptResourceGroupingRecommendations			Write
AddDraftAppVersionResourceMappings	resiliencehub	resiliencehub:AddDraftAppVersionResourceMappings			Write
BatchUpdateRecommendationStatus	resiliencehub	resiliencehub:BatchUpdateRecommendationStatus			Write
CreateApp	resiliencehub	resiliencehub:CreateApp			Write
		resiliencehub:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	resiliencehub.amazonaws.com	Write
CreateAppVersionAppComponent	resiliencehub	resiliencehub:CreateAppVersionAppComponent			Write
CreateAppVersionResource	resiliencehub	resiliencehub:CreateAppVersionResource			Write
CreateRecommendationTemplate	resiliencehub	resiliencehub:CreateRecommendationTemplate			Write
CreateRecommendationTemplate	resiliencehub	resiliencehub:TagResource			Tagging, Write
CreateResiliencyPolicy	resiliencehub	resiliencehub:CreateResiliencyPolicy			Write
CreateResiliencyPolicy	resiliencehub	resiliencehub:TagResource			Tagging, Write
DeleteApp	resiliencehub	resiliencehub:DeleteApp			Write
DeleteAppAssessment	resiliencehub	resiliencehub:DeleteAppAssessment			Write
DeleteAppInputSource	resiliencehub	resiliencehub:DeleteAppInputSource			Write
DeleteAppVersionAppComponent	resiliencehub	resiliencehub:DeleteAppVersionAppComponent			Write
DeleteAppVersionResource	resiliencehub	resiliencehub:DeleteAppVersionResource			Write
DeleteRecommendationTemplate	resiliencehub	resiliencehub:DeleteRecommendationTemplate			Write
DeleteResiliencyPolicy	resiliencehub	resiliencehub:DeleteResiliencyPolicy			Write
DescribeApp	resiliencehub	resiliencehub:DescribeApp			Read
DescribeAppAssessment	resiliencehub	resiliencehub:DescribeAppAssessment			Read
DescribeAppVersion	resiliencehub	resiliencehub:DescribeAppVersion			Read
DescribeAppVersionAppComponent	resiliencehub	resiliencehub:DescribeAppVersionAppComponent			Read
DescribeAppVersionResource	resiliencehub	resiliencehub:DescribeAppVersionResource			Read
DescribeAppVersionResourcesResolutionStatus	resiliencehub	resiliencehub:DescribeAppVersionResourcesResolutionStatus			Read
DescribeAppVersionTemplate	resiliencehub	resiliencehub:DescribeAppVersionTemplate			Read
DescribeDraftAppVersionResourcesImportStatus	resiliencehub	resiliencehub:DescribeDraftAppVersionResourcesImportStatus			Read
DescribeMetricsExport	resiliencehub	resiliencehub:DescribeMetricsExport			Read
DescribeResiliencyPolicy	resiliencehub	resiliencehub:DescribeResiliencyPolicy			Read
DescribeResourceGroupingRecommendationTask	resiliencehub	resiliencehub:DescribeResourceGroupingRecommendationTask			Read
ImportResourcesToDraftAppVersion	resiliencehub	resiliencehub:ImportResourcesToDraftAppVersion			Write
ListAlarmRecommendations	resiliencehub	resiliencehub:ListAlarmRecommendations			List
ListAppAssessmentComplianceDrifts	resiliencehub	resiliencehub:ListAppAssessmentComplianceDrifts			List
ListAppAssessmentResourceDrifts	resiliencehub	resiliencehub:ListAppAssessmentResourceDrifts			List
ListAppAssessments	resiliencehub	resiliencehub:ListAppAssessments			List
ListAppComponentCompliances	resiliencehub	resiliencehub:ListAppComponentCompliances			List
ListAppComponentRecommendations	resiliencehub	resiliencehub:ListAppComponentRecommendations			List
ListAppInputSources	resiliencehub	resiliencehub:ListAppInputSources			List
ListAppVersionAppComponents	resiliencehub	resiliencehub:ListAppVersionAppComponents			List
ListAppVersionResourceMappings	resiliencehub	resiliencehub:ListAppVersionResourceMappings			List
ListAppVersionResources	resiliencehub	resiliencehub:ListAppVersionResources			List
ListAppVersions	resiliencehub	resiliencehub:ListAppVersions			List
ListApps	resiliencehub	resiliencehub:ListApps			List
ListMetrics	resiliencehub	resiliencehub:ListMetrics			List
ListRecommendationTemplates	resiliencehub	resiliencehub:ListRecommendationTemplates			List
ListResiliencyPolicies	resiliencehub	resiliencehub:ListResiliencyPolicies			List
ListResourceGroupingRecommendations	resiliencehub	resiliencehub:ListResourceGroupingRecommendations			List
ListSopRecommendations	resiliencehub	resiliencehub:ListSopRecommendations			List
ListSuggestedResiliencyPolicies	resiliencehub	resiliencehub:ListSuggestedResiliencyPolicies			List
ListTagsForResource	resiliencehub	resiliencehub:ListTagsForResource			Read
ListTestRecommendations	resiliencehub	resiliencehub:ListTestRecommendations			List
ListUnsupportedAppVersionResources	resiliencehub	resiliencehub:ListUnsupportedAppVersionResources			List
PublishAppVersion	resiliencehub	resiliencehub:PublishAppVersion			Write
PutDraftAppVersionTemplate	resiliencehub	resiliencehub:PutDraftAppVersionTemplate			Write
RejectResourceGroupingRecommendations	resiliencehub	resiliencehub:RejectResourceGroupingRecommendations			Write
RemoveDraftAppVersionResourceMappings	resiliencehub	resiliencehub:RemoveDraftAppVersionResourceMappings			Write
ResolveAppVersionResources	resiliencehub	resiliencehub:ResolveAppVersionResources			Write
StartAppAssessment	resiliencehub	resiliencehub:StartAppAssessment			Write
StartAppAssessment	resiliencehub	resiliencehub:TagResource			Tagging, Write
StartMetricsExport	resiliencehub	resiliencehub:StartMetricsExport			Write
StartResourceGroupingRecommendationTask	resiliencehub	resiliencehub:StartResourceGroupingRecommendationTask			Write
TagResource	resiliencehub	resiliencehub:TagResource			Tagging, Write
UntagResource	resiliencehub	resiliencehub:UntagResource			Tagging, Write
UpdateApp	resiliencehub	resiliencehub:UpdateApp			Write
UpdateApp	resiliencehub	iam:PassRole	iam:PassedToService	resiliencehub.amazonaws.com	Write
UpdateAppVersion	resiliencehub	resiliencehub:UpdateAppVersion			Write
UpdateAppVersionAppComponent	resiliencehub	resiliencehub:UpdateAppVersionAppComponent			Write
UpdateAppVersionResource	resiliencehub	resiliencehub:UpdateAppVersionResource			Write
UpdateResiliencyPolicy	resiliencehub	resiliencehub:UpdateResiliencyPolicy			Write
CreateAssertion	resiliencehubv2	resiliencehub:CreateAssertion			Write
CreateInputSource	resiliencehubv2	resiliencehub:CreateInputSource			Write
CreatePolicy	resiliencehubv2	resiliencehub:CreatePolicy			Write
CreatePolicy	resiliencehubv2	resiliencehub:TagResource			Tagging, Write
CreateReport	resiliencehubv2	resiliencehub:CreateReport			Write
CreateService	resiliencehubv2	resiliencehub:CreateService			Write
CreateService	resiliencehubv2	iam:PassRole	iam:PassedToService	resiliencehub.amazonaws.com	Write
CreateServiceFunction	resiliencehubv2	resiliencehub:CreateServiceFunction			Write
CreateServiceFunctionResources	resiliencehubv2	resiliencehub:CreateServiceFunctionResources			Write
CreateSystem	resiliencehubv2	resiliencehub:CreateSystem			Write
CreateSystem	resiliencehubv2	resiliencehub:TagResource			Tagging, Write
CreateUserJourney	resiliencehubv2	resiliencehub:CreateUserJourney			Write
DeleteAssertion	resiliencehubv2	resiliencehub:DeleteAssertion			Write
DeleteInputSource	resiliencehubv2	resiliencehub:DeleteInputSource			Write
DeletePolicy	resiliencehubv2	resiliencehub:DeletePolicy			Write
DeleteService	resiliencehubv2	resiliencehub:DeleteService			Write
DeleteServiceFunction	resiliencehubv2	resiliencehub:DeleteServiceFunction			Write
DeleteServiceFunctionResources	resiliencehubv2	resiliencehub:DeleteServiceFunctionResources			Write
DeleteSystem	resiliencehubv2	resiliencehub:DeleteSystem			Write
DeleteUserJourney	resiliencehubv2	resiliencehub:DeleteUserJourney			Write
GetFailureModeFinding	resiliencehubv2	resiliencehub:GetFailureModeFinding			Read
GetPolicy	resiliencehubv2	resiliencehub:GetPolicy			Read
GetService	resiliencehubv2	resiliencehub:GetService			Read
GetSystem	resiliencehubv2	resiliencehub:GetSystem			Read
GetUserJourney	resiliencehubv2	resiliencehub:GetUserJourney			Read
ImportApp	resiliencehubv2	resiliencehub:ImportApp			Write
ImportPolicy	resiliencehubv2	resiliencehub:ImportPolicy			Write
ListAssertions	resiliencehubv2	resiliencehub:ListAssertions			Read
ListDependencies	resiliencehubv2	resiliencehub:ListDependencies			Read
ListFailureModeAssessments	resiliencehubv2	resiliencehub:ListFailureModeAssessments			Read
ListFailureModeFindings	resiliencehubv2	resiliencehub:ListFailureModeFindings			Read
ListInputSources	resiliencehubv2	resiliencehub:ListInputSources			Read
ListPolicies	resiliencehubv2	resiliencehub:ListPolicies			Read
ListReports	resiliencehubv2	resiliencehub:ListReports			Read
ListResources	resiliencehubv2	resiliencehub:ListResources			Read
ListServiceEvents	resiliencehubv2	resiliencehub:ListServiceEvents			Read
ListServiceFunctions	resiliencehubv2	resiliencehub:ListServiceFunctions			Read
ListServiceTopologyEdges	resiliencehubv2	resiliencehub:ListServiceTopologyEdges			Read
ListServices	resiliencehubv2	resiliencehub:ListServices			Read
ListSystems	resiliencehubv2	resiliencehub:ListSystems			Read
ListTagsForResource	resiliencehubv2	resiliencehub:ListTagsForResource			Read
ListUserJourneys	resiliencehubv2	resiliencehub:ListUserJourneys			Read
StartFailureModeAssessment	resiliencehubv2	resiliencehub:StartFailureModeAssessment			Write
TagResource	resiliencehubv2	resiliencehub:TagResource			Tagging, Write
UntagResource	resiliencehubv2	resiliencehub:UntagResource			Tagging, Write
UpdateDependency	resiliencehubv2	resiliencehub:UpdateDependency			Write
UpdateFailureModeFinding	resiliencehubv2	resiliencehub:UpdateFailureModeFinding			Write
UpdatePolicy	resiliencehubv2	resiliencehub:UpdatePolicy			Write
UpdateService	resiliencehubv2	resiliencehub:UpdateService			Write
UpdateService	resiliencehubv2	iam:PassRole	iam:PassedToService	resiliencehub.amazonaws.com	Write
UpdateServiceFunction	resiliencehubv2	resiliencehub:UpdateServiceFunction			Write
UpdateSystem	resiliencehubv2	resiliencehub:UpdateSystem			Write
UpdateUserJourney	resiliencehubv2	resiliencehub:UpdateUserJourney			Write

Actions defined by AWS Resilience Hub

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptResourceGroupingRecommendations	Grants permission to accept resource grouping recommendations	application*	aws:ResourceTag/${TagKey}	Write
AddDraftAppVersionResourceMappings	Grants permission to add draft application version resource mappings	application*	aws:ResourceTag/${TagKey}	Write
BatchUpdateRecommendationStatus	Grants permission to include or exclude one or more operational recommendations	application*	aws:ResourceTag/${TagKey}	Write
CreateApp	Grants permission to create application	application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAppVersionAppComponent	Grants permission to create application app component	application*	aws:ResourceTag/${TagKey}	Write
CreateAppVersionResource	Grants permission to create application resource	application*	aws:ResourceTag/${TagKey}	Write
CreateAssertion	Grants permission to create an assertion for a service	service*	aws:ResourceTag/${TagKey}	Write
CreateInputSource	Grants permission to create an input source for a service	service*	aws:ResourceTag/${TagKey}	Write
CreatePolicy	Grants permission to create a resilience policy that defines availability and disaster recovery requirements	policy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRecommendationTemplate	Grants permission to create recommendation template	application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateReport	Grants permission to create a report for a service	service*	aws:ResourceTag/${TagKey}	Write
CreateResiliencyPolicy	Grants permission to create resiliency policy	resiliency-policy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateService	Grants permission to create a service	policy	aws:ResourceTag/${TagKey}	Write
		service*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		system	aws:ResourceTag/${TagKey}
CreateServiceFunction	Grants permission to create a service function	service*	aws:ResourceTag/${TagKey}	Write
CreateServiceFunctionResources	Grants permission to create service function resources	service*	aws:ResourceTag/${TagKey}	Write
CreateSystem	Grants permission to create a system that represents a logical grouping of services	system*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateUserJourney	Grants permission to create a user journey within a system	policy	aws:ResourceTag/${TagKey}	Write
CreateUserJourney	Grants permission to create a user journey within a system	system*	aws:ResourceTag/${TagKey}	Write
DeleteApp	Grants permission to batch delete application	application*	aws:ResourceTag/${TagKey}	Write
DeleteAppAssessment	Grants permission to batch delete application assessment	application*	aws:ResourceTag/${TagKey}	Write
DeleteAppInputSource	Grants permission to remove application input source	application*	aws:ResourceTag/${TagKey}	Write
DeleteAppVersionAppComponent	Grants permission to delete application app component	application*	aws:ResourceTag/${TagKey}	Write
DeleteAppVersionResource	Grants permission to delete application resource	application*	aws:ResourceTag/${TagKey}	Write
DeleteAssertion	Grants permission to delete an assertion	service*	aws:ResourceTag/${TagKey}	Write
DeleteInputSource	Grants permission to delete an input source	service*	aws:ResourceTag/${TagKey}	Write
DeletePolicy	Grants permission to delete a resilience policy	policy*	aws:ResourceTag/${TagKey}	Write
DeleteRecommendationTemplate	Grants permission to batch delete recommendation template	application*	aws:ResourceTag/${TagKey}	Write
DeleteResiliencyPolicy	Grants permission to batch delete resiliency policy	resiliency-policy*	aws:ResourceTag/${TagKey}	Write
DeleteService	Grants permission to delete a service	service*	aws:ResourceTag/${TagKey}	Write
DeleteServiceFunction	Grants permission to delete a service function	service*	aws:ResourceTag/${TagKey}	Write
DeleteServiceFunctionResources	Grants permission to delete service function resources	service*	aws:ResourceTag/${TagKey}	Write
DeleteSystem	Grants permission to delete a system	system*	aws:ResourceTag/${TagKey}	Write
DeleteUserJourney	Grants permission to delete a user journey	system*	aws:ResourceTag/${TagKey}	Write
DescribeApp	Grants permission to describe application	application*	aws:ResourceTag/${TagKey}	Read
DescribeAppAssessment	Grants permission to describe application assessment	application*	aws:ResourceTag/${TagKey}	Read
DescribeAppVersion	Grants permission to describe application version	application*	aws:ResourceTag/${TagKey}	Read
DescribeAppVersionAppComponent	Grants permission to describe application version app component	application*	aws:ResourceTag/${TagKey}	Read
DescribeAppVersionResource	Grants permission to describe application version resource	application*	aws:ResourceTag/${TagKey}	Read
DescribeAppVersionResourcesResolutionStatus	Grants permission to describe application resolution	application*	aws:ResourceTag/${TagKey}	Read
DescribeAppVersionTemplate	Grants permission to describe application version template	application*	aws:ResourceTag/${TagKey}	Read
DescribeDraftAppVersionResourcesImportStatus	Grants permission to describe draft application version resources import status	application*	aws:ResourceTag/${TagKey}	Read
DescribeMetricsExport	Grants permission to describe metrics export			Read
DescribeResiliencyPolicy	Grants permission to describe resiliency policy	resiliency-policy*	aws:ResourceTag/${TagKey}	Read
DescribeResourceGroupingRecommendationTask	Grants permission to describe the latest status of the grouping recommendation process	application*	aws:ResourceTag/${TagKey}	Read
GetFailureModeFinding	Grants permission to retrieve a failure mode finding	service*	aws:ResourceTag/${TagKey}	Read
GetPolicy	Grants permission to retrieve a resilience policy	policy*	aws:ResourceTag/${TagKey}	Read
GetService	Grants permission to retrieve a service	service*	aws:ResourceTag/${TagKey}	Read
GetSystem	Grants permission to retrieve a system	system*	aws:ResourceTag/${TagKey}	Read
GetUserJourney	Grants permission to retrieve a user journey	system*	aws:ResourceTag/${TagKey}	Read
ImportApp	Grants permission to import a V1 app into the V2 resource model	application*	aws:ResourceTag/${TagKey}	Write
ImportApp		service*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
ImportPolicy	Grants permission to import a V1 policy into V2	policy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
ImportPolicy	Grants permission to import a V1 policy into V2	resiliency-policy*	aws:ResourceTag/${TagKey}	Write
ImportResourcesToDraftAppVersion	Grants permission to import resources to draft application version	application*	aws:ResourceTag/${TagKey}	Write
ListAlarmRecommendations	Grants permission to list alarm recommendation	application*	aws:ResourceTag/${TagKey}	List
ListAppAssessmentComplianceDrifts	Grants permission to list compliance drifts that were detected while running an assessment	application*	aws:ResourceTag/${TagKey}	List
ListAppAssessmentResourceDrifts	Grants permission to list resource drifts that were detected while running an assessment	application*	aws:ResourceTag/${TagKey}	List
ListAppAssessments	Grants permission to list application assessment			List
ListAppComponentCompliances	Grants permission to list app component compliances	application*	aws:ResourceTag/${TagKey}	List
ListAppComponentRecommendations	Grants permission to list app component recommendations	application*	aws:ResourceTag/${TagKey}	List
ListAppInputSources	Grants permission to list application input sources	application*	aws:ResourceTag/${TagKey}	List
ListAppVersionAppComponents	Grants permission to list application version app components	application*	aws:ResourceTag/${TagKey}	List
ListAppVersionResourceMappings	Grants permission to application version resource mappings	application*	aws:ResourceTag/${TagKey}	List
ListAppVersionResources	Grants permission to list application resources	application*	aws:ResourceTag/${TagKey}	List
ListAppVersions	Grants permission to list application version	application*	aws:ResourceTag/${TagKey}	List
ListApps	Grants permission to list applications			List
ListAssertions	Grants permission to list assertions for a service	service*	aws:ResourceTag/${TagKey}	Read
ListDependencies	Grants permission to list dependencies discovered for services			Read
ListFailureModeAssessments	Grants permission to list failure mode assessments	service*	aws:ResourceTag/${TagKey}	Read
ListFailureModeFindings	Grants permission to list failure mode findings	service*	aws:ResourceTag/${TagKey}	Read
ListInputSources	Grants permission to list input sources for a service	service*	aws:ResourceTag/${TagKey}	Read
ListMetrics	Grants permission to list metrics			List
ListPolicies	Grants permission to list resilience policies			Read
ListRecommendationTemplates	Grants permission to list recommendation templates	application*	aws:ResourceTag/${TagKey}	List
ListReports	Grants permission to list reports	service	aws:ResourceTag/${TagKey}	Read
ListResiliencyPolicies	Grants permission to list resiliency policies			List
ListResourceGroupingRecommendations	Grants permission to list resource grouping recommendations	application*	aws:ResourceTag/${TagKey}	List
ListResources	Grants permission to list resources for a service	service*	aws:ResourceTag/${TagKey}	Read
ListServiceEvents	Grants permission to list events for a service	service*	aws:ResourceTag/${TagKey}	Read
ListServiceFunctions	Grants permission to list service functions	service*	aws:ResourceTag/${TagKey}	Read
ListServiceTopologyEdges	Grants permission to list service topology edges	service*	aws:ResourceTag/${TagKey}	Read
ListServices	Grants permission to list services			Read
ListSopRecommendations	Grants permission to list SOP recommendations	application*	aws:ResourceTag/${TagKey}	List
ListSuggestedResiliencyPolicies	Grants permission to list suggested resiliency policies			List
ListSystemEvents	Grants permission to list events for a system	system*	aws:ResourceTag/${TagKey}	Read
ListSystems	Grants permission to list systems			Read
ListTagsForResource	Grants permission to list tags for a resource	app-assessment	aws:ResourceTag/${TagKey}	Read
		application	aws:ResourceTag/${TagKey}
		policy	aws:ResourceTag/${TagKey}
		recommendation-template	aws:ResourceTag/${TagKey}
		resiliency-policy	aws:ResourceTag/${TagKey}
		service	aws:ResourceTag/${TagKey}
		system	aws:ResourceTag/${TagKey}
ListTestRecommendations	Grants permission to list test recommendations	application*	aws:ResourceTag/${TagKey}	List
ListUnsupportedAppVersionResources	Grants permission to list unsupported application version resources	application*	aws:ResourceTag/${TagKey}	List
ListUserJourneys	Grants permission to list user journeys for a system	system*	aws:ResourceTag/${TagKey}	Read
PublishAppVersion	Grants permission to publish application version	application*	aws:ResourceTag/${TagKey}	Write
PutDraftAppVersionTemplate	Grants permission to put draft application version template	application*	aws:ResourceTag/${TagKey}	Write
RejectResourceGroupingRecommendations	Grants permission to reject resource grouping recommendations	application*	aws:ResourceTag/${TagKey}	Write
RemoveDraftAppVersionResourceMappings	Grants permission to remove draft application version mappings	application*	aws:ResourceTag/${TagKey}	Write
ResolveAppVersionResources	Grants permission to resolve application version resources	application*	aws:ResourceTag/${TagKey}	Write
StartAppAssessment	Grants permission to create application assessment	application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
StartFailureModeAssessment	Grants permission to start a failure mode assessment	service*	aws:ResourceTag/${TagKey}	Write
StartMetricsExport	Grants permission to start the metrics export			Write
StartResourceGroupingRecommendationTask	Grants permission to start the grouping recommendation generation process	application*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to assign a resource tag	app-assessment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		application	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		policy	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		recommendation-template	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		resiliency-policy	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		service	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		system	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag a resource	app-assessment	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		application	aws:ResourceTag/${TagKey} aws:TagKeys
		policy	aws:ResourceTag/${TagKey} aws:TagKeys
		recommendation-template	aws:ResourceTag/${TagKey} aws:TagKeys
		resiliency-policy	aws:ResourceTag/${TagKey} aws:TagKeys
		service	aws:ResourceTag/${TagKey} aws:TagKeys
		system	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateApp	Grants permission to update application	application*	aws:ResourceTag/${TagKey}	Write
UpdateAppVersion	Grants permission to update application version	application*	aws:ResourceTag/${TagKey}	Write
UpdateAppVersionAppComponent	Grants permission to update application app component	application*	aws:ResourceTag/${TagKey}	Write
UpdateAppVersionResource	Grants permission to update application resource	application*	aws:ResourceTag/${TagKey}	Write
UpdateAssertion	Grants permission to update an assertion	service*	aws:ResourceTag/${TagKey}	Write
UpdateDependency	Grants permission to update a dependency classification	service*	aws:ResourceTag/${TagKey}	Write
UpdateFailureModeFinding	Grants permission to update a failure mode finding	service*	aws:ResourceTag/${TagKey}	Write
UpdatePolicy	Grants permission to update a resilience policy	policy*	aws:ResourceTag/${TagKey}	Write
UpdateResiliencyPolicy	Grants permission to update resiliency policy	resiliency-policy*	aws:ResourceTag/${TagKey}	Write
UpdateService	Grants permission to update a service	policy	aws:ResourceTag/${TagKey}	Write
		service*	aws:ResourceTag/${TagKey}
		system	aws:ResourceTag/${TagKey}
UpdateServiceFunction	Grants permission to update a service function	service*	aws:ResourceTag/${TagKey}	Write
UpdateSystem	Grants permission to update a system	system*	aws:ResourceTag/${TagKey}	Write
UpdateUserJourney	Grants permission to update a user journey	policy	aws:ResourceTag/${TagKey}	Write
UpdateUserJourney	Grants permission to update a user journey	system*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS Resilience Hub

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
app-assessment	arn:${Partition}:resiliencehub:${Region}:${Account}:app-assessment/${AppAssessmentId}	aws:ResourceTag/${TagKey}
application	arn:${Partition}:resiliencehub:${Region}:${Account}:app/${AppId}	aws:ResourceTag/${TagKey}
policy	arn:${Partition}:resiliencehub:${Region}:${Account}:policy/${PolicyId}	aws:ResourceTag/${TagKey}
recommendation-template	arn:${Partition}:resiliencehub:${Region}:${Account}:recommendation-template/${RecommendationTemplateId}	aws:ResourceTag/${TagKey}
resiliency-policy	arn:${Partition}:resiliencehub:${Region}:${Account}:resiliency-policy/${ResiliencyPolicyId}	aws:ResourceTag/${TagKey}
service	arn:${Partition}:resiliencehub:${Region}:${Account}:service/${ServiceId}	aws:ResourceTag/${TagKey}
system	arn:${Partition}:resiliencehub:${Region}:${Account}:system/${SystemId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Resilience Hub

AWS Resilience Hub defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS rePost Private (repostspace)

AWS Resource Access Manager (RAM) (ram)