Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS Systems Manager for SAP

AWS Systems Manager for SAP (service prefix: ssm-sap) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Systems Manager for SAP
Actions defined by AWS Systems Manager for SAP
Resource types defined by AWS Systems Manager for SAP
Condition keys for AWS Systems Manager for SAP

API operations defined by AWS Systems Manager for SAP

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
DeleteResourcePermission	ssm-sap:DeleteResourcePermission	Permissions management, Write
DeregisterApplication	ssm-sap:DeregisterApplication	Write
GetApplication	ssm-sap:GetApplication	Read
GetComponent	ssm-sap:GetComponent	Read
GetConfigurationCheckOperation	ssm-sap:GetConfigurationCheckOperation	Read
GetDatabase	ssm-sap:GetDatabase	Read
GetOperation	ssm-sap:GetOperation	Read
GetResourcePermission	ssm-sap:GetResourcePermission	Permissions management, Write
ListApplications	ssm-sap:ListApplications	List
ListComponents	ssm-sap:ListComponents	List
ListConfigurationCheckDefinitions	ssm-sap:ListConfigurationCheckDefinitions	List
ListConfigurationCheckOperations	ssm-sap:ListConfigurationCheckOperations	List
ListDatabases	ssm-sap:ListDatabases	List
ListOperationEvents	ssm-sap:ListOperationEvents	List
ListOperations	ssm-sap:ListOperations	List
ListSubCheckResults	ssm-sap:ListSubCheckResults	List
ListSubCheckRuleResults	ssm-sap:ListSubCheckRuleResults	List
ListTagsForResource	ssm-sap:ListTagsForResource	Read
PutResourcePermission	ssm-sap:PutResourcePermission	Permissions management, Write
RegisterApplication	ssm-sap:RegisterApplication	Write
RegisterApplication	ssm-sap:TagResource	Tagging, Write
StartApplication	ssm-sap:StartApplication	Write
StartApplicationRefresh	ssm-sap:StartApplicationRefresh	Write
StartConfigurationChecks	ssm-sap:StartConfigurationChecks	Write
StopApplication	ssm-sap:StopApplication	Write
TagResource	ssm-sap:TagResource	Tagging, Write
UntagResource	ssm-sap:UntagResource	Tagging, Write
UpdateApplicationSettings	ssm-sap:UpdateApplicationSettings	Write

Actions defined by AWS Systems Manager for SAP

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BackupDatabase	Grants permission to perform backup operation on a specified database			Write
DeleteResourcePermission	Grants permission to delete the SSM for SAP level resource permissions associated with a SSM for SAP database resource			Permissions management, Write
DeregisterApplication	Grants permission to deregister an SAP application with SSM for SAP	application	aws:ResourceTag/${TagKey}	Write
GetApplication	Grants permission to access information about an application registered with SSM for SAP by providing the application ID or application ARN			Read
GetComponent	Grants permission to access information about a component registered with SSM for SAP by providing the application ID and component ID	component	aws:ResourceTag/${TagKey}	Read
GetConfigurationCheckOperation	Grants permission to get the details of a configuration check operation by specifying the operation ID			Read
GetDatabase	Grants permission to access information about a database registered with SSM for SAP by providing the application ID, component ID, and database ID			Read
GetOperation	Grants permission to access information about an operation by providing its operation ID			Read
GetResourcePermission	Grants permission to get the SSM for SAP level resource permissions associated with a SSM for SAP database resource			Permissions management, Write
ListApplications	Grants permission to retrieve a list of all applications registered with SSM for SAP under the customer AWS account			List
ListComponents	Grants permission to retrieve a list of all components in the account of customer, or a specific application	application	aws:ResourceTag/${TagKey}	List
ListConfigurationCheckDefinitions	Grants permission to list all configuration check types supported by AWS Systems Manager for SAP			List
ListConfigurationCheckOperations	Grants permission to list past configuration check operations			List
ListDatabases	Grants permission to retrieve a list of all databases in the account of customer, or a specific application			List
ListOperationEvents	Grants permission to retrieve a list of all operation events in a specified operation			List
ListOperations	Grants permission to retrieve a list of all operations in the account of customer, additional filters can be applied			List
ListSubCheckResults	Grants permission to list the sub-check results of a specified configuration check operation			List
ListSubCheckRuleResults	Grants permission to list the rules of a specified sub-check belonging to a configuration check operation			List
ListTagsForResource	Grants permission to list the tags on a specified resource ARN			Read
PutResourcePermission	Grants permission to add the SSM for SAP level resource permissions associated with a SSM for SAP database resource			Permissions management, Write
RegisterApplication	Grants permission to registers an SAP application with SSM for SAP		aws:RequestTag/${TagKey} aws:TagKeys	Write
RestoreDatabase	Grants permission to restore a database from another database			Write
StartApplication	Grants permission to start a registered SSM for SAP application	application	aws:ResourceTag/${TagKey}	Write
StartApplicationRefresh	Grants permission to start an on-demand discovery of a registered SSM for SAP application	application	aws:ResourceTag/${TagKey}	Write
StartConfigurationChecks	Grants permission to iniitiate configuration check operations against a specified application			Write
StopApplication	Grants permission to stop a registered SSM for SAP application	application	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag a specified resource ARN	application	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		component	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		database	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from a specified resource ARN	application	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		component	aws:ResourceTag/${TagKey} aws:TagKeys
		database	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateApplicationSettings	Grants permission to update settings of a registered SSM for SAP application	application	aws:ResourceTag/${TagKey}	Write
UpdateHANABackupSettings	Grants permission to update the HANA backup settings of a specified database			Write

Resource types defined by AWS Systems Manager for SAP

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
application	arn:${Partition}:ssm-sap:${Region}:${Account}:${ApplicationType}/${ApplicationId}	aws:ResourceTag/${TagKey}
component	arn:${Partition}:ssm-sap:${Region}:${Account}:${ApplicationType}/${ApplicationId}/COMPONENT/${ComponentId}	aws:ResourceTag/${TagKey}
database	arn:${Partition}:ssm-sap:${Region}:${Account}:${ApplicationType}/${ApplicationId}/DB/${DatabaseId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Systems Manager for SAP

AWS Systems Manager for SAP defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Systems Manager (ssm)

AWS Systems Manager GUI Connect (ssm-guiconnect)