Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon WorkSpaces Secure Browser

Amazon WorkSpaces Secure Browser (service prefix: workspaces-web) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon WorkSpaces Secure Browser
Actions defined by Amazon WorkSpaces Secure Browser
Resource types defined by Amazon WorkSpaces Secure Browser
Condition keys for Amazon WorkSpaces Secure Browser

API operations defined by Amazon WorkSpaces Secure Browser

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AssociateBrowserSettings	workspaces-web:AssociateBrowserSettings	Write
AssociateDataProtectionSettings	workspaces-web:AssociateDataProtectionSettings	Write
AssociateIpAccessSettings	workspaces-web:AssociateIpAccessSettings	Write
AssociateNetworkSettings	workspaces-web:AssociateNetworkSettings	Write
AssociateSessionLogger	workspaces-web:AssociateSessionLogger	Write
AssociateTrustStore	workspaces-web:AssociateTrustStore	Write
AssociateUserAccessLoggingSettings	workspaces-web:AssociateUserAccessLoggingSettings	Write
AssociateUserSettings	workspaces-web:AssociateUserSettings	Write
CreateBrowserSettings	workspaces-web:CreateBrowserSettings	Write
CreateBrowserSettings	workspaces-web:TagResource	Tagging, Write
CreateDataProtectionSettings	workspaces-web:CreateDataProtectionSettings	Write
CreateDataProtectionSettings	workspaces-web:TagResource	Tagging, Write
CreateIdentityProvider	workspaces-web:CreateIdentityProvider	Write
CreateIdentityProvider	workspaces-web:TagResource	Tagging, Write
CreateIpAccessSettings	workspaces-web:CreateIpAccessSettings	Write
CreateIpAccessSettings	workspaces-web:TagResource	Tagging, Write
CreateNetworkSettings	workspaces-web:CreateNetworkSettings	Write
CreateNetworkSettings	workspaces-web:TagResource	Tagging, Write
CreatePortal	workspaces-web:CreatePortal	Write
CreatePortal	workspaces-web:TagResource	Tagging, Write
CreateSessionLogger	workspaces-web:CreateSessionLogger	Write
CreateSessionLogger	workspaces-web:TagResource	Tagging, Write
CreateTrustStore	workspaces-web:CreateTrustStore	Write
CreateTrustStore	workspaces-web:TagResource	Tagging, Write
CreateUserAccessLoggingSettings	workspaces-web:CreateUserAccessLoggingSettings	Write
CreateUserAccessLoggingSettings	workspaces-web:TagResource	Tagging, Write
CreateUserSettings	workspaces-web:CreateUserSettings	Write
CreateUserSettings	workspaces-web:TagResource	Tagging, Write
DeleteBrowserSettings	workspaces-web:DeleteBrowserSettings	Write
DeleteDataProtectionSettings	workspaces-web:DeleteDataProtectionSettings	Write
DeleteIdentityProvider	workspaces-web:DeleteIdentityProvider	Write
DeleteIpAccessSettings	workspaces-web:DeleteIpAccessSettings	Write
DeleteNetworkSettings	workspaces-web:DeleteNetworkSettings	Write
DeletePortal	workspaces-web:DeletePortal	Write
DeleteSessionLogger	workspaces-web:DeleteSessionLogger	Write
DeleteTrustStore	workspaces-web:DeleteTrustStore	Write
DeleteUserAccessLoggingSettings	workspaces-web:DeleteUserAccessLoggingSettings	Write
DeleteUserSettings	workspaces-web:DeleteUserSettings	Write
DisassociateBrowserSettings	workspaces-web:DisassociateBrowserSettings	Write
DisassociateDataProtectionSettings	workspaces-web:DisassociateDataProtectionSettings	Write
DisassociateIpAccessSettings	workspaces-web:DisassociateIpAccessSettings	Write
DisassociateNetworkSettings	workspaces-web:DisassociateNetworkSettings	Write
DisassociateSessionLogger	workspaces-web:DisassociateSessionLogger	Write
DisassociateTrustStore	workspaces-web:DisassociateTrustStore	Write
DisassociateUserAccessLoggingSettings	workspaces-web:DisassociateUserAccessLoggingSettings	Write
DisassociateUserSettings	workspaces-web:DisassociateUserSettings	Write
ExpireSession	workspaces-web:ExpireSession	Write
GetBrowserSettings	workspaces-web:GetBrowserSettings	Read
GetDataProtectionSettings	workspaces-web:GetDataProtectionSettings	Read
GetIdentityProvider	workspaces-web:GetIdentityProvider	Read
GetIpAccessSettings	workspaces-web:GetIpAccessSettings	Read
GetNetworkSettings	workspaces-web:GetNetworkSettings	Read
GetPortal	workspaces-web:GetPortal	Read
GetPortalServiceProviderMetadata	workspaces-web:GetPortalServiceProviderMetadata	Read
GetSession	workspaces-web:GetSession	Read
GetSessionLogger	workspaces-web:GetSessionLogger	Read
GetTrustStore	workspaces-web:GetTrustStore	Read
GetTrustStoreCertificate	workspaces-web:GetTrustStoreCertificate	Read
GetUserAccessLoggingSettings	workspaces-web:GetUserAccessLoggingSettings	Read
GetUserSettings	workspaces-web:GetUserSettings	Read
ListBrowserSettings	workspaces-web:ListBrowserSettings	Read
ListDataProtectionSettings	workspaces-web:ListDataProtectionSettings	Read
ListIdentityProviders	workspaces-web:ListIdentityProviders	Read
ListIpAccessSettings	workspaces-web:ListIpAccessSettings	Read
ListNetworkSettings	workspaces-web:ListNetworkSettings	Read
ListPortals	workspaces-web:ListPortals	Read
ListSessionLoggers	workspaces-web:ListSessionLoggers	Read
ListSessions	workspaces-web:ListSessions	Read
ListTagsForResource	workspaces-web:ListTagsForResource	Read
ListTrustStoreCertificates	workspaces-web:ListTrustStoreCertificates	Read
ListTrustStores	workspaces-web:ListTrustStores	Read
ListUserAccessLoggingSettings	workspaces-web:ListUserAccessLoggingSettings	Read
ListUserSettings	workspaces-web:ListUserSettings	Read
TagResource	workspaces-web:TagResource	Tagging, Write
UntagResource	workspaces-web:UntagResource	Tagging, Write
UpdateBrowserSettings	workspaces-web:UpdateBrowserSettings	Write
UpdateDataProtectionSettings	workspaces-web:UpdateDataProtectionSettings	Write
UpdateIdentityProvider	workspaces-web:UpdateIdentityProvider	Write
UpdateIpAccessSettings	workspaces-web:UpdateIpAccessSettings	Write
UpdateNetworkSettings	workspaces-web:UpdateNetworkSettings	Write
UpdatePortal	workspaces-web:UpdatePortal	Write
UpdateSessionLogger	workspaces-web:UpdateSessionLogger	Write
UpdateTrustStore	workspaces-web:UpdateTrustStore	Write
UpdateUserAccessLoggingSettings	workspaces-web:UpdateUserAccessLoggingSettings	Write
UpdateUserSettings	workspaces-web:UpdateUserSettings	Write

Actions defined by Amazon WorkSpaces Secure Browser

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateBrowserSettings	Grants permission to associate browser settings to web portals	browserSettings*	aws:ResourceTag/${TagKey}	Write
AssociateBrowserSettings		portal*	aws:ResourceTag/${TagKey}	Write
AssociateDataProtectionSettings	Grants permission to associate data protection settings with web portals	dataProtectionSettings*	aws:ResourceTag/${TagKey}	Write
AssociateDataProtectionSettings		portal*	aws:ResourceTag/${TagKey}	Write
AssociateIpAccessSettings	Grants permission to associate ip access settings with web portals	ipAccessSettings*	aws:ResourceTag/${TagKey}	Write
AssociateIpAccessSettings		portal*	aws:ResourceTag/${TagKey}	Write
AssociateNetworkSettings	Grants permission to associate network settings to web portals	networkSettings*	aws:ResourceTag/${TagKey}	Write
AssociateNetworkSettings		portal*	aws:ResourceTag/${TagKey}	Write
AssociateSessionLogger	Grants permission to associate session logger with web portals	portal*	aws:ResourceTag/${TagKey}	Write
AssociateSessionLogger		sessionLogger*	aws:ResourceTag/${TagKey}	Write
AssociateTrustStore	Grants permission to associate trust stores with web portals	portal*	aws:ResourceTag/${TagKey}	Write
AssociateTrustStore		trustStore*	aws:ResourceTag/${TagKey}	Write
AssociateUserAccessLoggingSettings	Grants permission to associate user access logging settings with web portals	portal*	aws:ResourceTag/${TagKey}	Write
AssociateUserAccessLoggingSettings		userAccessLoggingSettings*	aws:ResourceTag/${TagKey}	Write
AssociateUserSettings	Grants permission to associate user settings with web portals	portal*	aws:ResourceTag/${TagKey}	Write
AssociateUserSettings		userSettings*	aws:ResourceTag/${TagKey}	Write
CreateBrowserSettings	Grants permission to create browser settings		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDataProtectionSettings	Grants permission to create data protection settings		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateIdentityProvider	Grants permission to create identity providers	identityProvider*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateIdentityProvider	Grants permission to create identity providers	portal*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateIpAccessSettings	Grants permission to create ip access settings		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateNetworkSettings	Grants permission to create network settings		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreatePortal	Grants permission to create web portals		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateSessionLogger	Grants permission to create session logger		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateTrustStore	Grants permission to create trust stores		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateUserAccessLoggingSettings	Grants permission to create user access logging settings		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateUserSettings	Grants permission to create user settings		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteBrowserSettings	Grants permission to delete browser settings	browserSettings*	aws:ResourceTag/${TagKey}	Write
DeleteDataProtectionSettings	Grants permission to delete data protection settings	dataProtectionSettings*	aws:ResourceTag/${TagKey}	Write
DeleteIdentityProvider	Grants permission to delete identity providers	identityProvider*	aws:ResourceTag/${TagKey}	Write
DeleteIdentityProvider	Grants permission to delete identity providers	portal*	aws:ResourceTag/${TagKey}	Write
DeleteIpAccessSettings	Grants permission to delete ip access settings	ipAccessSettings*	aws:ResourceTag/${TagKey}	Write
DeleteNetworkSettings	Grants permission to delete network settings	networkSettings*	aws:ResourceTag/${TagKey}	Write
DeletePortal	Grants permission to delete web portals	portal*	aws:ResourceTag/${TagKey}	Write
DeleteSessionLogger	Grants permission to delete session logger	sessionLogger*	aws:ResourceTag/${TagKey}	Write
DeleteTrustStore	Grants permission to delete trust stores	trustStore*	aws:ResourceTag/${TagKey}	Write
DeleteUserAccessLoggingSettings	Grants permission to delete user access logging settings	userAccessLoggingSettings*	aws:ResourceTag/${TagKey}	Write
DeleteUserSettings	Grants permission to delete user settings	userSettings*	aws:ResourceTag/${TagKey}	Write
DisassociateBrowserSettings	Grants permission to disassociate browser settings from web portals	portal*	aws:ResourceTag/${TagKey}	Write
DisassociateDataProtectionSettings	Grants permission to disassociate data protection logging from web portals	portal*	aws:ResourceTag/${TagKey}	Write
DisassociateIpAccessSettings	Grants permission to disassociate ip access logging from web portals	portal*	aws:ResourceTag/${TagKey}	Write
DisassociateNetworkSettings	Grants permission to disassociate network settings from web portals	portal*	aws:ResourceTag/${TagKey}	Write
DisassociateSessionLogger	Grants permission to disassociate session logger from web portals	portal*	aws:ResourceTag/${TagKey}	Write
DisassociateTrustStore	Grants permission to disassociate trust stores from web portals	portal*	aws:ResourceTag/${TagKey}	Write
DisassociateUserAccessLoggingSettings	Grants permission to disassociate user access logging settings from web portals	portal*	aws:ResourceTag/${TagKey}	Write
DisassociateUserSettings	Grants permission to disassociate user settings from web portals	portal*	aws:ResourceTag/${TagKey}	Write
ExpireSession	Grants permission to expire a session from a specific portal	portal*	aws:ResourceTag/${TagKey}	Write
GetBrowserSettings	Grants permission to get details on browser settings	browserSettings*	aws:ResourceTag/${TagKey}	Read
GetDataProtectionSettings	Grants permission to get details on data protection settings	dataProtectionSettings*	aws:ResourceTag/${TagKey}	Read
GetIdentityProvider	Grants permission to get details on identity providers	identityProvider*	aws:ResourceTag/${TagKey}	Read
GetIpAccessSettings	Grants permission to get details on ip access settings	ipAccessSettings*	aws:ResourceTag/${TagKey}	Read
GetNetworkSettings	Grants permission to get details on network settings	networkSettings*	aws:ResourceTag/${TagKey}	Read
GetPortal	Grants permission to get details on web portals	portal*	aws:ResourceTag/${TagKey}	Read
GetPortalServiceProviderMetadata	Grants permission to get service provider metadata information for web portals	portal*	aws:ResourceTag/${TagKey}	Read
GetSession	Grants permission to get information about a particular session for a portal	portal*	aws:ResourceTag/${TagKey}	Read
GetSessionLogger	Grants permission to get details on session logger	sessionLogger*	aws:ResourceTag/${TagKey}	Read
GetTrustStore	Grants permission to get details on trust stores	trustStore*	aws:ResourceTag/${TagKey}	Read
GetTrustStoreCertificate	Grants permission to get certificates from trust stores	trustStore*	aws:ResourceTag/${TagKey}	Read
GetUserAccessLoggingSettings	Grants permission to get details on user access logging settings	userAccessLoggingSettings*	aws:ResourceTag/${TagKey}	Read
GetUserSettings	Grants permission to get details on user settings	userSettings*	aws:ResourceTag/${TagKey}	Read
ListBrowserSettings	Grants permission to list browser settings			Read
ListDataProtectionSettings	Grants permission to list data protection settings			Read
ListIdentityProviders	Grants permission to list identity providers	identityProvider*	aws:ResourceTag/${TagKey}	Read
ListIpAccessSettings	Grants permission to list ip access settings			Read
ListNetworkSettings	Grants permission to list network settings			Read
ListPortals	Grants permission to list web portals			Read
ListSessionLoggers	Grants permission to list session loggers			Read
ListSessions	Grants permission to list sessions for a Portal using optional filters	portal*	aws:ResourceTag/${TagKey}	Read
ListTagsForResource	Grants permission to list tags for a resource			Read
ListTrustStoreCertificates	Grants permission to list certificates in a trust store			Read
ListTrustStores	Grants permission to list trust stores			Read
ListUserAccessLoggingSettings	Grants permission to list user access logging settings			Read
ListUserSettings	Grants permission to list user settings			Read
TagResource	Grants permission to add one or more tags to a resource	browserSettings	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		dataProtectionSettings	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		identityProvider	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		ipAccessSettings	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		networkSettings	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		portal	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		sessionLogger	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		trustStore	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		userAccessLoggingSettings	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		userSettings	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove one or more tags from a resource	browserSettings	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		dataProtectionSettings	aws:ResourceTag/${TagKey} aws:TagKeys
		identityProvider	aws:ResourceTag/${TagKey} aws:TagKeys
		ipAccessSettings	aws:ResourceTag/${TagKey} aws:TagKeys
		networkSettings	aws:ResourceTag/${TagKey} aws:TagKeys
		portal	aws:ResourceTag/${TagKey} aws:TagKeys
		sessionLogger	aws:ResourceTag/${TagKey} aws:TagKeys
		trustStore	aws:ResourceTag/${TagKey} aws:TagKeys
		userAccessLoggingSettings	aws:ResourceTag/${TagKey} aws:TagKeys
		userSettings	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateBrowserSettings	Grants permission to update browser settings	browserSettings*	aws:ResourceTag/${TagKey}	Write
UpdateDataProtectionSettings	Grants permission to update data protection settings	dataProtectionSettings*	aws:ResourceTag/${TagKey}	Write
UpdateIdentityProvider	Grants permission to update identity provider	identityProvider*	aws:ResourceTag/${TagKey}	Write
UpdateIdentityProvider	Grants permission to update identity provider	portal*	aws:ResourceTag/${TagKey}	Write
UpdateIpAccessSettings	Grants permission to update ip access settings	ipAccessSettings*	aws:ResourceTag/${TagKey}	Write
UpdateNetworkSettings	Grants permission to update network settings	networkSettings*	aws:ResourceTag/${TagKey}	Write
UpdatePortal	Grants permission to update web portals	portal*	aws:ResourceTag/${TagKey}	Write
UpdateSessionLogger	Grants permission to update session logger	sessionLogger*	aws:ResourceTag/${TagKey}	Write
UpdateTrustStore	Grants permission to update trust stores	trustStore*	aws:ResourceTag/${TagKey}	Write
UpdateUserAccessLoggingSettings	Grants permission to update user access logging settings	userAccessLoggingSettings*	aws:ResourceTag/${TagKey}	Write
UpdateUserSettings	Grants permission to update user settings	userSettings*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon WorkSpaces Secure Browser

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
browserSettings	arn:${Partition}:workspaces-web:${Region}:${Account}:browserSettings/${BrowserSettingsId}	aws:ResourceTag/${TagKey}
dataProtectionSettings	arn:${Partition}:workspaces-web:${Region}:${Account}:dataProtectionSettings/${DataProtectionSettingsId}	aws:ResourceTag/${TagKey}
identityProvider	arn:${Partition}:workspaces-web:${Region}:${Account}:identityProvider/${PortalId}/${IdentityProviderId}	aws:ResourceTag/${TagKey}
ipAccessSettings	arn:${Partition}:workspaces-web:${Region}:${Account}:ipAccessSettings/${IpAccessSettingsId}	aws:ResourceTag/${TagKey}
networkSettings	arn:${Partition}:workspaces-web:${Region}:${Account}:networkSettings/${NetworkSettingsId}	aws:ResourceTag/${TagKey}
portal	arn:${Partition}:workspaces-web:${Region}:${Account}:portal/${PortalId}	aws:ResourceTag/${TagKey}
sessionLogger	arn:${Partition}:workspaces-web:${Region}:${Account}:sessionLogger/${SessionLoggerId}	aws:ResourceTag/${TagKey}
trustStore	arn:${Partition}:workspaces-web:${Region}:${Account}:trustStore/${TrustStoreId}	aws:ResourceTag/${TagKey}
userAccessLoggingSettings	arn:${Partition}:workspaces-web:${Region}:${Account}:userAccessLoggingSettings/${UserAccessLoggingSettingsId}	aws:ResourceTag/${TagKey}
userSettings	arn:${Partition}:workspaces-web:${Region}:${Account}:userSettings/${UserSettingsId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon WorkSpaces Secure Browser

Amazon WorkSpaces Secure Browser defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon WorkSpaces Application Manager (wam)

Amazon WorkSpaces Thin Client (thinclient)