Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Systems Manager Incident Manager Contacts

AWS Systems Manager Incident Manager Contacts (service prefix: ssm-contacts) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Systems Manager Incident Manager Contacts
Actions defined by AWS Systems Manager Incident Manager Contacts
Permission-only actions for AWS Systems Manager Incident Manager Contacts
Resource types defined by AWS Systems Manager Incident Manager Contacts
Condition keys for AWS Systems Manager Incident Manager Contacts

API operations defined by AWS Systems Manager Incident Manager Contacts

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AcceptPage	ssm-contacts:AcceptPage	Write
ActivateContactChannel	ssm-contacts:ActivateContactChannel	Write
CreateContact	ssm-contacts:AssociateContact	Permissions management, Write
	ssm-contacts:CreateContact	Write
	ssm-contacts:TagResource	Tagging, Write
CreateContactChannel	ssm-contacts:CreateContactChannel	Write
CreateRotation	ssm-contacts:CreateRotation	Write
CreateRotation	ssm-contacts:TagResource	Tagging, Write
CreateRotationOverride	ssm-contacts:CreateRotationOverride	Write
DeactivateContactChannel	ssm-contacts:DeactivateContactChannel	Write
DeleteContact	ssm-contacts:DeleteContact	Write
DeleteContactChannel	ssm-contacts:DeleteContactChannel	Write
DeleteRotation	ssm-contacts:DeleteRotation	Write
DeleteRotationOverride	ssm-contacts:DeleteRotationOverride	Write
DescribeEngagement	ssm-contacts:DescribeEngagement	Read
DescribePage	ssm-contacts:DescribePage	Read
GetContact	ssm-contacts:GetContact	Read
GetContactChannel	ssm-contacts:GetContactChannel	Read
GetContactPolicy	ssm-contacts:GetContactPolicy	Read
GetRotation	ssm-contacts:GetRotation	Read
GetRotationOverride	ssm-contacts:GetRotationOverride	Read
ListContactChannels	ssm-contacts:ListContactChannels	List
ListContacts	ssm-contacts:ListContacts	List
ListEngagements	ssm-contacts:ListEngagements	List
ListPageReceipts	ssm-contacts:ListPageReceipts	List
ListPageResolutions	ssm-contacts:ListPageResolutions	List
ListPagesByContact	ssm-contacts:ListPagesByContact	List
ListPagesByEngagement	ssm-contacts:ListPagesByEngagement	List
ListPreviewRotationShifts	ssm-contacts:ListPreviewRotationShifts	List
ListRotationOverrides	ssm-contacts:ListRotationOverrides	List
ListRotationShifts	ssm-contacts:ListRotationShifts	List
ListRotations	ssm-contacts:ListRotations	List
ListTagsForResource	ssm-contacts:ListTagsForResource	Read
PutContactPolicy	ssm-contacts:PutContactPolicy	Write
SendActivationCode	ssm-contacts:SendActivationCode	Write
StartEngagement	ssm-contacts:StartEngagement	Write
StopEngagement	ssm-contacts:StopEngagement	Write
TagResource	ssm-contacts:TagResource	Tagging, Write
UntagResource	ssm-contacts:UntagResource	Tagging, Write
UpdateContact	ssm-contacts:AssociateContact	Permissions management, Write
UpdateContact	ssm-contacts:UpdateContact	Write
UpdateContactChannel	ssm-contacts:UpdateContactChannel	Write
UpdateRotation	ssm-contacts:UpdateRotation	Write

Actions defined by AWS Systems Manager Incident Manager Contacts

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptPage	Grants permission to accept a page	page*		Write
ActivateContactChannel	Grants permission to activate a contact's contact channel	contactchannel*		Write
CreateContact	Grants permission to create a contact	contact*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateContactChannel	Grants permission to create a contact channel for a contact	contact*	aws:ResourceTag/${TagKey}	Write
CreateRotation	Grants permission to create a rotation in an on-call schedule	rotation*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRotationOverride	Grants permission to create an override for a rotation in an on-call schedule	rotation*	aws:ResourceTag/${TagKey}	Write
DeactivateContactChannel	Grants permission to deactivate a contact's contact channel	contactchannel*		Write
DeleteContact	Grants permission to delete a contact	contact*	aws:ResourceTag/${TagKey}	Write
DeleteContactChannel	Grants permission to delete a contact's contact channel	contactchannel*		Write
DeleteRotation	Grants permission to delete a rotation	rotation*	aws:ResourceTag/${TagKey}	Write
DeleteRotationOverride	Grants permission to delete a rotation's rotation override	rotation*	aws:ResourceTag/${TagKey}	Write
DescribeEngagement	Grants permission to describe an engagement	engagement*		Read
DescribePage	Grants permission to describe a page	page*		Read
GetContact	Grants permission to get a contact	contact*	aws:ResourceTag/${TagKey}	Read
GetContactChannel	Grants permission to get a contact's contact channel	contactchannel*		Read
GetContactPolicy	Grants permission to get a contact's resource policy	contact*	aws:ResourceTag/${TagKey}	Read
GetRotation	Grants permission to retrieve information about an on-call rotation	rotation*	aws:ResourceTag/${TagKey}	Read
GetRotationOverride	Grants permission to retrieve information about an override in an on-call rotation	rotation*	aws:ResourceTag/${TagKey}	Read
ListContactChannels	Grants permission to list all of a contact's contact channels	contact*	aws:ResourceTag/${TagKey}	List
ListContacts	Grants permission to list all contacts			List
ListEngagements	Grants permission to list all engagements			List
ListPageReceipts	Grants permission to list all receipts of a page	page*		List
ListPageResolutions	Grants permission to list the resolution path of an engagement	page*		List
ListPagesByContact	Grants permission to list all pages sent to a contact	contact*	aws:ResourceTag/${TagKey}	List
ListPagesByEngagement	Grants permission to list all pages created in an engagement	engagement*		List
ListPreviewRotationShifts	Grants permission to retrieve a list of shifts based on rotation configuration parameters			List
ListRotationOverrides	Grants permission to retrieve a list of overrides currently specified for an on-call rotation	rotation*	aws:ResourceTag/${TagKey}	List
ListRotationShifts	Grants permission to retrieve a list of rotation shifts in an on-call schedule	rotation*	aws:ResourceTag/${TagKey}	List
ListRotations	Grants permission to retrieve a list of on-call rotations			List
ListTagsForResource	Grants permission to view a list of resource tags for a specified resource	contact	aws:ResourceTag/${TagKey}	Read
ListTagsForResource		rotation	aws:ResourceTag/${TagKey}	Read
PutContactPolicy	Grants permission to add a resource policy to a contact	contact*	aws:ResourceTag/${TagKey}	Write
SendActivationCode	Grants permission to send the activation code of a contact's contact channel	contactchannel*		Write
StartEngagement	Grants permission to start an engagement	contact*	aws:ResourceTag/${TagKey}	Write
StopEngagement	Grants permission to stop an engagement	engagement*		Write
TagResource	Grants permission to add tags to the specified resource	contact	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource	Grants permission to add tags to the specified resource	rotation	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from the specified resource	contact	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource		rotation	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateContact	Grants permission to update a contact	contact*	aws:ResourceTag/${TagKey}	Write
UpdateContactChannel	Grants permission to update a contact's contact channel	contactchannel*		Write
UpdateRotation	Grants permission to update the information specified for an on-call rotation	rotation*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for AWS Systems Manager Incident Manager Contacts

The following actions are defined by AWS Systems Manager Incident Manager Contacts but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateContact	Grants permission to use a contact in an escalation plan	contact*	aws:ResourceTag/${TagKey}	Permissions management, Write

Resource types defined by AWS Systems Manager Incident Manager Contacts

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
contact	arn:${Partition}:ssm-contacts:${Region}:${Account}:contact/${ContactAlias}	aws:ResourceTag/${TagKey}
contactchannel	arn:${Partition}:ssm-contacts:${Region}:${Account}:contactchannel/${ContactAlias}/${ContactChannelId}
engagement	arn:${Partition}:ssm-contacts:${Region}:${Account}:engagement/${ContactAlias}/${EngagementId}
page	arn:${Partition}:ssm-contacts:${Region}:${Account}:page/${ContactAlias}/${PageId}
rotation	arn:${Partition}:ssm-contacts:${Region}:${Account}:rotation/${RotationId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Systems Manager Incident Manager Contacts

AWS Systems Manager Incident Manager Contacts defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Systems Manager Incident Manager (ssm-incidents)

AWS Systems Manager Quick Setup (ssm-quicksetup)