Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Detective

Amazon Detective (service prefix: detective) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Detective
Actions defined by Amazon Detective
Permission-only actions for Amazon Detective
Resource types defined by Amazon Detective
Condition keys for Amazon Detective

API operations defined by Amazon Detective

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AcceptInvitation	detective:AcceptInvitation	Write
BatchGetGraphMemberDatasources	detective:BatchGetGraphMemberDatasources	Read
BatchGetMembershipDatasources	detective:BatchGetMembershipDatasources	Read
CreateGraph	detective:CreateGraph	Write
CreateGraph	detective:TagResource	Tagging, Write
CreateMembers	detective:CreateMembers	Write
DeleteGraph	detective:DeleteGraph	Write
DeleteMembers	detective:DeleteMembers	Write
DescribeOrganizationConfiguration	detective:DescribeOrganizationConfiguration	Read
DisableOrganizationAdminAccount	detective:DisableOrganizationAdminAccount	Write
DisassociateMembership	detective:DisassociateMembership	Write
EnableOrganizationAdminAccount	detective:EnableOrganizationAdminAccount	Write
	iam:CreateServiceLinkedRole	Write
	organizations:EnableAWSServiceAccess	Write
	organizations:RegisterDelegatedAdministrator	Write
GetInvestigation	detective:GetInvestigation	Read
GetMembers	detective:GetMembers	Read
ListDatasourcePackages	detective:ListDatasourcePackages	List
ListGraphs	detective:ListGraphs	List
ListIndicators	detective:ListIndicators	List
ListInvestigations	detective:ListInvestigations	List
ListInvitations	detective:ListInvitations	List
ListMembers	detective:ListMembers	List
ListOrganizationAdminAccounts	detective:ListOrganizationAdminAccount	List
ListTagsForResource	detective:ListTagsForResource	List
RejectInvitation	detective:RejectInvitation	Write
StartInvestigation	detective:StartInvestigation	Write
StartMonitoringMember	detective:StartMonitoringMember	Write
TagResource	detective:TagResource	Tagging, Write
UntagResource	detective:UntagResource	Tagging, Write
UpdateDatasourcePackages	detective:UpdateDatasourcePackages	Write
UpdateInvestigationState	detective:UpdateInvestigationState	Write
UpdateOrganizationConfiguration	detective:UpdateOrganizationConfiguration	Write

Actions defined by Amazon Detective

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptInvitation	Grants permission to accept an invitation to become a member of a behavior graph	Graph*	aws:ResourceTag/${TagKey}	Write
BatchGetGraphMemberDatasources	Grants permission to retrieve the datasource package history for the specified member accounts in a behavior graph managed by this account	Graph*	aws:ResourceTag/${TagKey}	Read
BatchGetMembershipDatasources	Grants permission to retrieve the datasource package history of the caller account for the specified graphs			Read
CreateGraph	Grants permission to create a behavior graph and begin to aggregate security information		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateMembers	Grants permission to request the membership of one or more accounts in a behavior graph managed by this account	Graph*	aws:ResourceTag/${TagKey}	Write
DeleteGraph	Grants permission to delete a behavior graph and stop aggregating security information	Graph*	aws:ResourceTag/${TagKey}	Write
DeleteMembers	Grants permission to remove member accounts from a behavior graph managed by this account	Graph*	aws:ResourceTag/${TagKey}	Write
DescribeOrganizationConfiguration	Grants permission to view the current configuration related to the Amazon Detective integration with AWS Organizations	Graph*	aws:ResourceTag/${TagKey}	Read
DisableOrganizationAdminAccount	Grants permission to remove the Amazon Detective delegated administrator account for an organization			Write
DisassociateMembership	Grants permission to remove the association of this account with a behavior graph	Graph*	aws:ResourceTag/${TagKey}	Write
EnableOrganizationAdminAccount	Grants permission to designate the Amazon Detective delegated administrator account for an organization			Write
GetInvestigation	Grants permission to get an investigation's status and metadata	Graph*	aws:ResourceTag/${TagKey}	Read
GetMembers	Grants permission to retrieve details on specified members of a behavior graph	Graph*	aws:ResourceTag/${TagKey}	Read
ListDatasourcePackages	Grants permission to list a graph's datasource package ingest states and timestamps for the most recent state changes in a behavior graph managed by this account	Graph*	aws:ResourceTag/${TagKey}	List
ListGraphs	Grants permission to list behavior graphs managed by this account			List
ListIndicators	Grants permission to list the indicators of an investigation	Graph*	aws:ResourceTag/${TagKey}	List
ListInvestigations	Grants permission to list the investigations of a behavior graph	Graph*	aws:ResourceTag/${TagKey}	List
ListInvitations	Grants permission to retrieve details on the behavior graphs to which this account has been invited to join			List
ListMembers	Grants permission to retrieve details on all members of a behavior graph	Graph*	aws:ResourceTag/${TagKey}	List
ListOrganizationAdminAccount	Grants permission to view the current Amazon Detective delegated administrator account for an organization			List
ListTagsForResource	Grants permission to list the tag values that are assigned to a behavior graph	Graph*	aws:ResourceTag/${TagKey}	List
RejectInvitation	Grants permission to reject an invitation to become a member of a behavior graph	Graph*	aws:ResourceTag/${TagKey}	Write
StartInvestigation	Grants permission to start investigations	Graph*	aws:ResourceTag/${TagKey}	Write
StartMonitoringMember	Grants permission to start data ingest for a member account that has a status of ACCEPTED_BUT_DISABLED	Graph*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to assign tag values to a behavior graph	Graph*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tag values from a behavior graph	Graph*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateDatasourcePackages	Grants permission to enable or disable datasource package(s) in a behavior graph managed by this account	Graph*	aws:ResourceTag/${TagKey}	Write
UpdateInvestigationState	Grants permission to update an investigation's state and metadata	Graph*	aws:ResourceTag/${TagKey}	Write
UpdateOrganizationConfiguration	Grants permission to update the current configuration related to the Amazon Detective integration with AWS Organizations	Graph*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon Detective

The following actions are defined by Amazon Detective but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
GetFreeTrialEligibility	Grants permission to retrieve a behavior graph's eligibility for a free trial period	Graph*	aws:ResourceTag/${TagKey}	Read
GetGraphIngestState	Grants permission to retrieve the data ingestion state of a behavior graph	Graph*	aws:ResourceTag/${TagKey}	Read
GetPricingInformation	Grants permission to retrieve information about Amazon Detective's pricing			Read
GetUsageInformation	Grants permission to list usage information of a behavior graph	Graph*	aws:ResourceTag/${TagKey}	Read
InvokeAssistant	Grants permission to invoke Detective's Assistant	Graph*	aws:ResourceTag/${TagKey}	Read
ListHighDegreeEntities	Grants permission to retrieve high volume entities whose relationships cannot be stored by Detective	Graph*	aws:ResourceTag/${TagKey}	List
SearchGraph	Grants permission to search the data stored in a behavior graph	Graph*	aws:ResourceTag/${TagKey}	Read

Resource types defined by Amazon Detective

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
Graph	arn:${Partition}:detective:${Region}:${Account}:graph:${ResourceId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Detective

Amazon Detective defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by specifying the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by specifying the tags associated with the resource	String
aws:TagKeys	Filters access by specifying the tag keys that are passed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon DataZone (datazone)

Amazon DevOps Guru (devops-guru)