Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Systems Manager Incident Manager

AWS Systems Manager Incident Manager (service prefix: ssm-incidents) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Systems Manager Incident Manager
Actions defined by AWS Systems Manager Incident Manager
Resource types defined by AWS Systems Manager Incident Manager
Condition keys for AWS Systems Manager Incident Manager

API operations defined by AWS Systems Manager Incident Manager

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
BatchGetIncidentFindings	ssm-incidents:BatchGetIncidentFindings			Read
CreateReplicationSet	ssm-incidents:CreateReplicationSet			Write
CreateReplicationSet	ssm-incidents:TagResource			Tagging, Write
CreateResponsePlan	ssm-incidents:CreateResponsePlan			Write
	ssm-incidents:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ssm-incidents.amazonaws.com	Write
CreateTimelineEvent	ssm-incidents:CreateTimelineEvent			Write
DeleteIncidentRecord	ssm-incidents:DeleteIncidentRecord			Write
DeleteReplicationSet	ssm-incidents:DeleteReplicationSet			Write
DeleteResourcePolicy	ssm-incidents:DeleteResourcePolicy			Permissions management, Write
DeleteResponsePlan	ssm-incidents:DeleteResponsePlan			Write
DeleteTimelineEvent	ssm-incidents:DeleteTimelineEvent			Write
GetIncidentRecord	ssm-incidents:GetIncidentRecord			Read
GetReplicationSet	ssm-incidents:GetReplicationSet			Read
GetResourcePolicies	ssm-incidents:GetResourcePolicies			Read
GetResponsePlan	ssm-incidents:GetResponsePlan			Read
GetTimelineEvent	ssm-incidents:GetTimelineEvent			Read
ListIncidentFindings	ssm-incidents:ListIncidentFindings			List
ListIncidentRecords	ssm-incidents:ListIncidentRecords			List
ListRelatedItems	ssm-incidents:ListRelatedItems			List
ListReplicationSets	ssm-incidents:ListReplicationSets			List
ListResponsePlans	ssm-incidents:ListResponsePlans			List
ListTagsForResource	ssm-incidents:ListTagsForResource			Read
ListTimelineEvents	ssm-incidents:ListTimelineEvents			List
PutResourcePolicy	ssm-incidents:PutResourcePolicy			Permissions management, Write
StartIncident	ssm-incidents:StartIncident			Write
TagResource	ssm-incidents:TagResource			Tagging, Write
UntagResource	ssm-incidents:UntagResource			Tagging, Write
UpdateDeletionProtection	ssm-incidents:UpdateDeletionProtection			Write
UpdateIncidentRecord	ssm-incidents:UpdateIncidentRecord			Write
UpdateRelatedItems	ssm-incidents:UpdateRelatedItems			Write
UpdateReplicationSet	ssm-incidents:UpdateReplicationSet			Write
UpdateResponsePlan	ssm-incidents:TagResource			Tagging, Write
	ssm-incidents:UpdateResponsePlan			Write
	iam:PassRole	iam:PassedToService	ssm-incidents.amazonaws.com	Write
UpdateTimelineEvent	ssm-incidents:UpdateTimelineEvent			Write

Actions defined by AWS Systems Manager Incident Manager

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchGetIncidentFindings	Grants permission to retrieve details about specified findings for an incident record	incident-record*	aws:ResourceTag/${TagKey}	Read
BatchGetIncidentFindings		response-plan*	aws:ResourceTag/${TagKey}	Read
CreateReplicationSet	Grants permission to create a replication set		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateResponsePlan	Grants permission to create a response plan		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateTimelineEvent	Grants permission to create a timeline event for an incident record	incident-record*	aws:ResourceTag/${TagKey}	Write
CreateTimelineEvent		response-plan*	aws:ResourceTag/${TagKey}	Write
DeleteIncidentRecord	Grants permission to delete an incident record	incident-record*	aws:ResourceTag/${TagKey}	Write
DeleteReplicationSet	Grants permission to delete a replication set	replication-set*	aws:ResourceTag/${TagKey}	Write
DeleteResourcePolicy	Grants permission to delete resource policy from a response plan	response-plan*	aws:ResourceTag/${TagKey}	Permissions management, Write
DeleteResponsePlan	Grants permission to delete a response plan	response-plan*	aws:ResourceTag/${TagKey}	Write
DeleteTimelineEvent	Grants permission to delete a timeline event	incident-record*	aws:ResourceTag/${TagKey}	Write
GetIncidentRecord	Grants permission to view the contents of an incident record	incident-record*	aws:ResourceTag/${TagKey}	Read
GetIncidentRecord		response-plan*	aws:ResourceTag/${TagKey}	Read
GetReplicationSet	Grants permission to view the replication set	replication-set*	aws:ResourceTag/${TagKey}	Read
GetResourcePolicies	Grants permission to view resource policies of a response plan	response-plan*	aws:ResourceTag/${TagKey}	Read
GetResponsePlan	Grants permission to view the contents of a specified response plan	response-plan*	aws:ResourceTag/${TagKey}	Read
GetTimelineEvent	Grants permission to view a timeline event	incident-record*	aws:ResourceTag/${TagKey}	Read
GetTimelineEvent	Grants permission to view a timeline event	response-plan*	aws:ResourceTag/${TagKey}	Read
ListIncidentFindings	Grants permission to list findings for an incident record	incident-record*	aws:ResourceTag/${TagKey}	List
ListIncidentFindings	Grants permission to list findings for an incident record	response-plan*	aws:ResourceTag/${TagKey}	List
ListIncidentRecords	Grants permission to list the contents of all incident records			List
ListRelatedItems	Grants permission to list related items of an incident record	incident-record*	aws:ResourceTag/${TagKey}	List
ListRelatedItems		response-plan*	aws:ResourceTag/${TagKey}	List
ListReplicationSets	Grants permission to list all replication sets			List
ListResponsePlans	Grants permission to list all response plans			List
ListTagsForResource	Grants permission to view a list of resource tags for a specified resource	incident-record	aws:ResourceTag/${TagKey}	Read
		replication-set	aws:ResourceTag/${TagKey}
		response-plan	aws:ResourceTag/${TagKey}
ListTimelineEvents	Grants permission to list all timeline events for an incident record	incident-record*	aws:ResourceTag/${TagKey}	List
ListTimelineEvents		response-plan*	aws:ResourceTag/${TagKey}	List
PutResourcePolicy	Grants permission to put resource policy on a response plan	response-plan*	aws:ResourceTag/${TagKey}	Permissions management, Write
StartIncident	Grants permission to start a new incident using a response plan	response-plan*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add tags to a response plan	incident-record	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		replication-set	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		response-plan	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from a response plan	incident-record	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		replication-set	aws:ResourceTag/${TagKey} aws:TagKeys
		response-plan	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateDeletionProtection	Grants permission to update replication set deletion protection	replication-set*	aws:ResourceTag/${TagKey}	Write
UpdateIncidentRecord	Grants permission to update the contents of an incident record	incident-record*	aws:ResourceTag/${TagKey}	Write
UpdateIncidentRecord		response-plan*	aws:ResourceTag/${TagKey}	Write
UpdateRelatedItems	Grants permission to update related items of an incident record	incident-record*	aws:ResourceTag/${TagKey}	Write
UpdateRelatedItems		response-plan*	aws:ResourceTag/${TagKey}	Write
UpdateReplicationSet	Grants permission to update a replication set	replication-set*	aws:ResourceTag/${TagKey}	Write
UpdateResponsePlan	Grants permission to update the contents of a response plan	response-plan*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
UpdateTimelineEvent	Grants permission to update a timeline event	incident-record*	aws:ResourceTag/${TagKey}	Write
UpdateTimelineEvent	Grants permission to update a timeline event	response-plan*	aws:ResourceTag/${TagKey}	Write

Resource types defined by AWS Systems Manager Incident Manager

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
incident-record	arn:${Partition}:ssm-incidents::${Account}:incident-record/${ResponsePlan}/${IncidentRecord}	aws:ResourceTag/${TagKey}
replication-set	arn:${Partition}:ssm-incidents::${Account}:replication-set/${ReplicationSet}	aws:ResourceTag/${TagKey}
response-plan	arn:${Partition}:ssm-incidents::${Account}:response-plan/${ResponsePlan}	aws:ResourceTag/${TagKey}

Condition keys for AWS Systems Manager Incident Manager

AWS Systems Manager Incident Manager defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Systems Manager GUI Connect (ssm-guiconnect)

AWS Systems Manager Incident Manager Contacts (ssm-contacts)