Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Route 53 Recovery Readiness

Amazon Route 53 Recovery Readiness (service prefix: route53-recovery-readiness) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Route 53 Recovery Readiness
Actions defined by Amazon Route 53 Recovery Readiness
Resource types defined by Amazon Route 53 Recovery Readiness
Condition keys for Amazon Route 53 Recovery Readiness

API operations defined by Amazon Route 53 Recovery Readiness

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
CreateCell	route53-recovery-readiness:CreateCell	Write
CreateCell	route53-recovery-readiness:TagResource	Tagging, Write
CreateCrossAccountAuthorization	route53-recovery-readiness:CreateCrossAccountAuthorization	Write
CreateReadinessCheck	route53-recovery-readiness:CreateReadinessCheck	Write
CreateReadinessCheck	route53-recovery-readiness:TagResource	Tagging, Write
CreateRecoveryGroup	route53-recovery-readiness:CreateRecoveryGroup	Write
CreateRecoveryGroup	route53-recovery-readiness:TagResource	Tagging, Write
CreateResourceSet	route53-recovery-readiness:CreateResourceSet	Write
CreateResourceSet	route53-recovery-readiness:TagResource	Tagging, Write
DeleteCell	route53-recovery-readiness:DeleteCell	Write
DeleteCrossAccountAuthorization	route53-recovery-readiness:DeleteCrossAccountAuthorization	Write
DeleteReadinessCheck	route53-recovery-readiness:DeleteReadinessCheck	Write
DeleteRecoveryGroup	route53-recovery-readiness:DeleteRecoveryGroup	Write
DeleteResourceSet	route53-recovery-readiness:DeleteResourceSet	Write
GetArchitectureRecommendations	route53-recovery-readiness:GetArchitectureRecommendations	Read
GetCell	route53-recovery-readiness:GetCell	Read
GetCellReadinessSummary	route53-recovery-readiness:GetCellReadinessSummary	Read
GetReadinessCheck	route53-recovery-readiness:GetReadinessCheck	Read
GetReadinessCheckResourceStatus	route53-recovery-readiness:GetReadinessCheckResourceStatus	Read
GetReadinessCheckStatus	route53-recovery-readiness:GetReadinessCheckStatus	Read
GetRecoveryGroup	route53-recovery-readiness:GetRecoveryGroup	Read
GetRecoveryGroupReadinessSummary	route53-recovery-readiness:GetRecoveryGroupReadinessSummary	Read
GetResourceSet	route53-recovery-readiness:GetResourceSet	Read
ListCells	route53-recovery-readiness:ListCells	Read
ListCrossAccountAuthorizations	route53-recovery-readiness:ListCrossAccountAuthorizations	Read
ListReadinessChecks	route53-recovery-readiness:ListReadinessChecks	Read
ListRecoveryGroups	route53-recovery-readiness:ListRecoveryGroups	Read
ListResourceSets	route53-recovery-readiness:ListResourceSets	Read
ListRules	route53-recovery-readiness:ListRules	Read
ListTagsForResources	route53-recovery-readiness:ListTagsForResources	Read
TagResource	route53-recovery-readiness:TagResource	Tagging, Write
UntagResource	route53-recovery-readiness:UntagResource	Tagging, Write
UpdateCell	route53-recovery-readiness:UpdateCell	Write
UpdateReadinessCheck	route53-recovery-readiness:UpdateReadinessCheck	Write
UpdateRecoveryGroup	route53-recovery-readiness:UpdateRecoveryGroup	Write
UpdateResourceSet	route53-recovery-readiness:UpdateResourceSet	Write

Actions defined by Amazon Route 53 Recovery Readiness

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateCell	Grants permission to create a new cell	cell*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCrossAccountAuthorization	Grants permission to create a cross account authorization			Write
CreateReadinessCheck	Grants permission to create a readiness check	readinesscheck*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRecoveryGroup	Grants permission to create a recovery group	recoverygroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateResourceSet	Grants permission to create a resource set	resourceset*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteCell	Grants permission to delete a cell	cell*	aws:ResourceTag/${TagKey}	Write
DeleteCrossAccountAuthorization	Grants permission to delete a cross account authorization			Write
DeleteReadinessCheck	Grants permission to delete a readiness check	readinesscheck*	aws:ResourceTag/${TagKey}	Write
DeleteRecoveryGroup	Grants permission to delete a recovery group	recoverygroup*	aws:ResourceTag/${TagKey}	Write
DeleteResourceSet	Grants permission to delete a resource set	resourceset*	aws:ResourceTag/${TagKey}	Write
GetArchitectureRecommendations	Grants permission to get architecture recommendations for a recovery group	recoverygroup*	aws:ResourceTag/${TagKey}	Read
GetCell	Grants permission to get information about a cell	cell*	aws:ResourceTag/${TagKey}	Read
GetCellReadinessSummary	Grants permission to get a readiness summary for a cell	cell*	aws:ResourceTag/${TagKey}	Read
GetReadinessCheck	Grants permission to get information about a readiness check	readinesscheck*	aws:ResourceTag/${TagKey}	Read
GetReadinessCheckResourceStatus	Grants permission to get the readiness status for an individual resource	readinesscheck*	aws:ResourceTag/${TagKey}	Read
GetReadinessCheckStatus	Grants permission to get the status of a readiness check (for a resource set)	readinesscheck*	aws:ResourceTag/${TagKey}	Read
GetRecoveryGroup	Grants permission to get information about a recovery group	recoverygroup*	aws:ResourceTag/${TagKey}	Read
GetRecoveryGroupReadinessSummary	Grants permission to get a readiness summary for a recovery group	recoverygroup*	aws:ResourceTag/${TagKey}	Read
GetResourceSet	Grants permission to get information about a resource set	resourceset*	aws:ResourceTag/${TagKey}	Read
ListCells	Grants permission to list cells			Read
ListCrossAccountAuthorizations	Grants permission to list cross account authorizations			Read
ListReadinessChecks	Grants permission to list readiness checks			Read
ListRecoveryGroups	Grants permission to list recovery groups			Read
ListResourceSets	Grants permission to list resource sets			Read
ListRules	Grants permission to list readiness rules			Read
ListTagsForResources	Grants permission to list tags for a resource			Read
TagResource	Grants permission to add a tag to a resource	cell	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		readinesscheck	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		recoverygroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		resourceset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove a tag from a resource	cell	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		readinesscheck	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		recoverygroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		resourceset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UpdateCell	Grants permission to update a cell	cell*	aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateReadinessCheck	Grants permission to update a readiness check	readinesscheck*	aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateRecoveryGroup	Grants permission to update a recovery group	recoverygroup*	aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateResourceSet	Grants permission to update a resource set	resourceset*	aws:ResourceTag/${TagKey} aws:TagKeys	Write

Resource types defined by Amazon Route 53 Recovery Readiness

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
cell	arn:${Partition}:route53-recovery-readiness::${Account}:cell/${ResourceId}	aws:ResourceTag/${TagKey}
readinesscheck	arn:${Partition}:route53-recovery-readiness::${Account}:readiness-check/${ResourceId}	aws:ResourceTag/${TagKey}
recoverygroup	arn:${Partition}:route53-recovery-readiness::${Account}:recovery-group/${ResourceId}	aws:ResourceTag/${TagKey}
resourceset	arn:${Partition}:route53-recovery-readiness::${Account}:resource-set/${ResourceId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Route 53 Recovery Readiness

Amazon Route 53 Recovery Readiness defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Route 53 Recovery Controls (route53-recovery-control-config)

Amazon Route 53 Resolver (route53resolver)