Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Lightsail

Amazon Lightsail (service prefix: lightsail) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Lightsail
Actions defined by Amazon Lightsail
Resource types defined by Amazon Lightsail
Condition keys for Amazon Lightsail

API operations defined by Amazon Lightsail

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AllocateStaticIp	lightsail:AllocateStaticIp	Write
AttachCertificateToDistribution	lightsail:AttachCertificateToDistribution	Write
AttachDisk	lightsail:AttachDisk	Write
AttachInstancesToLoadBalancer	lightsail:AttachInstancesToLoadBalancer	Write
AttachLoadBalancerTlsCertificate	lightsail:AttachLoadBalancerTlsCertificate	Write
AttachStaticIp	lightsail:AttachStaticIp	Write
CloseInstancePublicPorts	lightsail:CloseInstancePublicPorts	Write
CopySnapshot	lightsail:CopySnapshot	Write
CreateBucket	lightsail:CreateBucket	Write
CreateBucket	lightsail:TagResource	Tagging, Write
CreateBucketAccessKey	lightsail:CreateBucketAccessKey	Write
CreateCertificate	lightsail:CreateCertificate	Write
CreateCertificate	lightsail:TagResource	Tagging, Write
CreateCloudFormationStack	lightsail:CreateCloudFormationStack	Write
CreateContactMethod	lightsail:CreateContactMethod	Write
CreateContactMethod	lightsail:TagResource	Tagging, Write
CreateContainerService	lightsail:CreateContainerService	Write
CreateContainerService	lightsail:TagResource	Tagging, Write
CreateContainerServiceDeployment	lightsail:CreateContainerServiceDeployment	Write
CreateContainerServiceRegistryLogin	lightsail:CreateContainerServiceRegistryLogin	Write
CreateDisk	lightsail:CreateDisk	Write
CreateDisk	lightsail:TagResource	Tagging, Write
CreateDiskFromSnapshot	lightsail:CreateDiskFromSnapshot	Write
CreateDiskFromSnapshot	lightsail:TagResource	Tagging, Write
CreateDiskSnapshot	lightsail:CreateDiskSnapshot	Write
CreateDiskSnapshot	lightsail:TagResource	Tagging, Write
CreateDistribution	lightsail:CreateDistribution	Write
CreateDistribution	lightsail:TagResource	Tagging, Write
CreateDomain	lightsail:CreateDomain	Write
CreateDomain	lightsail:TagResource	Tagging, Write
CreateDomainEntry	lightsail:CreateDomainEntry	Write
CreateGUISessionAccessDetails	lightsail:CreateGUISessionAccessDetails	Write
CreateInstanceSnapshot	lightsail:CreateInstanceSnapshot	Write
CreateInstanceSnapshot	lightsail:TagResource	Tagging, Write
CreateInstances	lightsail:CreateInstances	Write
CreateInstances	lightsail:TagResource	Tagging, Write
CreateInstancesFromSnapshot	lightsail:CreateInstancesFromSnapshot	Write
CreateInstancesFromSnapshot	lightsail:TagResource	Tagging, Write
CreateKeyPair	lightsail:CreateKeyPair	Write
CreateKeyPair	lightsail:TagResource	Tagging, Write
CreateLoadBalancer	lightsail:CreateLoadBalancer	Write
CreateLoadBalancer	lightsail:TagResource	Tagging, Write
CreateLoadBalancerTlsCertificate	lightsail:CreateLoadBalancerTlsCertificate	Write
CreateRelationalDatabase	lightsail:CreateRelationalDatabase	Write
CreateRelationalDatabase	lightsail:TagResource	Tagging, Write
CreateRelationalDatabaseFromSnapshot	lightsail:CreateRelationalDatabaseFromSnapshot	Write
CreateRelationalDatabaseFromSnapshot	lightsail:TagResource	Tagging, Write
CreateRelationalDatabaseSnapshot	lightsail:CreateRelationalDatabaseSnapshot	Write
CreateRelationalDatabaseSnapshot	lightsail:TagResource	Tagging, Write
DeleteAlarm	lightsail:DeleteAlarm	Write
DeleteAutoSnapshot	lightsail:DeleteAutoSnapshot	Write
DeleteBucket	lightsail:DeleteBucket	Write
DeleteBucketAccessKey	lightsail:DeleteBucketAccessKey	Write
DeleteCertificate	lightsail:DeleteCertificate	Write
DeleteContactMethod	lightsail:DeleteContactMethod	Write
DeleteContainerImage	lightsail:DeleteContainerImage	Write
DeleteContainerService	lightsail:DeleteContainerService	Write
DeleteDisk	lightsail:DeleteDisk	Write
DeleteDiskSnapshot	lightsail:DeleteDiskSnapshot	Write
DeleteDistribution	lightsail:DeleteDistribution	Write
DeleteDomain	lightsail:DeleteDomain	Write
DeleteDomainEntry	lightsail:DeleteDomainEntry	Write
DeleteInstance	lightsail:DeleteInstance	Write
DeleteInstanceSnapshot	lightsail:DeleteInstanceSnapshot	Write
DeleteKeyPair	lightsail:DeleteKeyPair	Write
DeleteKnownHostKeys	lightsail:DeleteKnownHostKeys	Write
DeleteLoadBalancer	lightsail:DeleteLoadBalancer	Write
DeleteLoadBalancerTlsCertificate	lightsail:DeleteLoadBalancerTlsCertificate	Write
DeleteRelationalDatabase	lightsail:DeleteRelationalDatabase	Write
DeleteRelationalDatabaseSnapshot	lightsail:DeleteRelationalDatabaseSnapshot	Write
DetachCertificateFromDistribution	lightsail:DetachCertificateFromDistribution	Write
DetachDisk	lightsail:DetachDisk	Write
DetachInstancesFromLoadBalancer	lightsail:DetachInstancesFromLoadBalancer	Write
DetachStaticIp	lightsail:DetachStaticIp	Write
DisableAddOn	lightsail:DisableAddOn	Write
DownloadDefaultKeyPair	lightsail:DownloadDefaultKeyPair	Write
EnableAddOn	lightsail:EnableAddOn	Write
ExportSnapshot	lightsail:ExportSnapshot	Write
GetActiveNames	lightsail:GetActiveNames	Read
GetAlarms	lightsail:GetAlarms	Read
GetAutoSnapshots	lightsail:GetAutoSnapshots	Read
GetBlueprints	lightsail:GetBlueprints	Read
GetBucketAccessKeys	lightsail:GetBucketAccessKeys	Read
GetBucketBundles	lightsail:GetBucketBundles	Read
GetBucketMetricData	lightsail:GetBucketMetricData	Read
GetBuckets	lightsail:GetBuckets	Read
GetBundles	lightsail:GetBundles	Read
GetCertificates	lightsail:GetCertificates	Read
GetCloudFormationStackRecords	lightsail:GetCloudFormationStackRecords	Read
GetContactMethods	lightsail:GetContactMethods	Read
GetContainerAPIMetadata	lightsail:GetContainerAPIMetadata	Read
GetContainerImages	lightsail:GetContainerImages	Read
GetContainerLog	lightsail:GetContainerLog	Read
GetContainerServiceDeployments	lightsail:GetContainerServiceDeployments	Read
GetContainerServiceMetricData	lightsail:GetContainerServiceMetricData	Read
GetContainerServicePowers	lightsail:GetContainerServicePowers	Read
GetContainerServices	lightsail:GetContainerServices	Read
GetCostEstimate	lightsail:GetCostEstimate	Read
GetDisk	lightsail:GetDisk	Read
GetDiskSnapshot	lightsail:GetDiskSnapshot	Read
GetDiskSnapshots	lightsail:GetDiskSnapshots	Read
GetDisks	lightsail:GetDisks	Read
GetDistributionBundles	lightsail:GetDistributionBundles	Read
GetDistributionLatestCacheReset	lightsail:GetDistributionLatestCacheReset	Read
GetDistributionMetricData	lightsail:GetDistributionMetricData	Read
GetDistributions	lightsail:GetDistributions	Read
GetDomain	lightsail:GetDomain	Read
GetDomains	lightsail:GetDomains	Read
GetExportSnapshotRecords	lightsail:GetExportSnapshotRecords	Read
GetInstance	lightsail:GetInstance	Read
GetInstanceAccessDetails	lightsail:GetInstanceAccessDetails	Write
GetInstanceMetricData	lightsail:GetInstanceMetricData	Read
GetInstancePortStates	lightsail:GetInstancePortStates	Read
GetInstanceSnapshot	lightsail:GetInstanceSnapshot	Read
GetInstanceSnapshots	lightsail:GetInstanceSnapshots	Read
GetInstanceState	lightsail:GetInstanceState	Read
GetInstances	lightsail:GetInstances	Read
GetKeyPair	lightsail:GetKeyPair	Read
GetKeyPairs	lightsail:GetKeyPairs	Read
GetLoadBalancer	lightsail:GetLoadBalancer	Read
GetLoadBalancerMetricData	lightsail:GetLoadBalancerMetricData	Read
GetLoadBalancerTlsCertificates	lightsail:GetLoadBalancerTlsCertificates	Read
GetLoadBalancerTlsPolicies	lightsail:GetLoadBalancerTlsPolicies	Read
GetLoadBalancers	lightsail:GetLoadBalancers	Read
GetOperation	lightsail:GetOperation	Read
GetOperations	lightsail:GetOperations	Read
GetOperationsForResource	lightsail:GetOperationsForResource	Read
GetRegions	lightsail:GetRegions	Read
GetRelationalDatabase	lightsail:GetRelationalDatabase	Read
GetRelationalDatabaseBlueprints	lightsail:GetRelationalDatabaseBlueprints	Read
GetRelationalDatabaseBundles	lightsail:GetRelationalDatabaseBundles	Read
GetRelationalDatabaseEvents	lightsail:GetRelationalDatabaseEvents	Read
GetRelationalDatabaseLogEvents	lightsail:GetRelationalDatabaseLogEvents	Read
GetRelationalDatabaseLogStreams	lightsail:GetRelationalDatabaseLogStreams	Read
GetRelationalDatabaseMasterUserPassword	lightsail:GetRelationalDatabaseMasterUserPassword	Write
GetRelationalDatabaseMetricData	lightsail:GetRelationalDatabaseMetricData	Read
GetRelationalDatabaseParameters	lightsail:GetRelationalDatabaseParameters	Read
GetRelationalDatabaseSnapshot	lightsail:GetRelationalDatabaseSnapshot	Read
GetRelationalDatabaseSnapshots	lightsail:GetRelationalDatabaseSnapshots	Read
GetRelationalDatabases	lightsail:GetRelationalDatabases	Read
GetSetupHistory	lightsail:GetSetupHistory	Read
GetStaticIp	lightsail:GetStaticIp	Read
GetStaticIps	lightsail:GetStaticIps	Read
ImportKeyPair	lightsail:ImportKeyPair	Write
IsVpcPeered	lightsail:IsVpcPeered	Read
OpenInstancePublicPorts	lightsail:OpenInstancePublicPorts	Write
PeerVpc	lightsail:PeerVpc	Write
PutAlarm	lightsail:PutAlarm	Write
PutAlarm	lightsail:TagResource	Tagging, Write
PutInstancePublicPorts	lightsail:PutInstancePublicPorts	Write
RebootInstance	lightsail:RebootInstance	Write
RebootRelationalDatabase	lightsail:RebootRelationalDatabase	Write
RegisterContainerImage	lightsail:RegisterContainerImage	Write
ReleaseStaticIp	lightsail:ReleaseStaticIp	Write
ResetDistributionCache	lightsail:ResetDistributionCache	Write
SendContactMethodVerification	lightsail:SendContactMethodVerification	Write
SetIpAddressType	lightsail:SetIpAddressType	Write
SetResourceAccessForBucket	lightsail:SetResourceAccessForBucket	Write
SetupInstanceHttps	lightsail:SetupInstanceHttps	Write
StartGUISession	lightsail:StartGUISession	Write
StartInstance	lightsail:StartInstance	Write
StartRelationalDatabase	lightsail:StartRelationalDatabase	Write
StopGUISession	lightsail:StopGUISession	Write
StopInstance	lightsail:StopInstance	Write
StopRelationalDatabase	lightsail:StopRelationalDatabase	Write
TagResource	lightsail:TagResource	Tagging, Write
TestAlarm	lightsail:TestAlarm	Write
UnpeerVpc	lightsail:UnpeerVpc	Write
UntagResource	lightsail:UntagResource	Tagging, Write
UpdateBucket	lightsail:UpdateBucket	Write
UpdateBucketBundle	lightsail:UpdateBucketBundle	Write
UpdateContainerService	lightsail:UpdateContainerService	Write
UpdateDistribution	lightsail:UpdateDistribution	Write
UpdateDistributionBundle	lightsail:UpdateDistributionBundle	Write
UpdateDomainEntry	lightsail:UpdateDomainEntry	Write
UpdateInstanceMetadataOptions	lightsail:UpdateInstanceMetadataOptions	Write
UpdateLoadBalancerAttribute	lightsail:UpdateLoadBalancerAttribute	Write
UpdateRelationalDatabase	lightsail:UpdateRelationalDatabase	Write
UpdateRelationalDatabaseParameters	lightsail:UpdateRelationalDatabaseParameters	Write

Actions defined by Amazon Lightsail

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AllocateStaticIp	Grants permission to create a static IP address that can be attached to an instance			Write
AttachCertificateToDistribution	Grants permission to attach an SSL/TLS certificate to your Amazon Lightsail content delivery network (CDN) distribution	Certificate*	aws:ResourceTag/${TagKey}	Write
AttachCertificateToDistribution		Distribution*	aws:ResourceTag/${TagKey}	Write
AttachDisk	Grants permission to attach a disk to an instance	Disk*	aws:ResourceTag/${TagKey}	Write
AttachInstancesToLoadBalancer	Grants permission to attach one or more instances to a load balancer	LoadBalancer*	aws:ResourceTag/${TagKey}	Write
AttachLoadBalancerTlsCertificate	Grants permission to attach a TLS certificate to a load balancer	LoadBalancer*	aws:ResourceTag/${TagKey}	Write
AttachStaticIp	Grants permission to attach a static IP address to an instance	Instance*	aws:ResourceTag/${TagKey}	Write
AttachStaticIp		StaticIp*	aws:ResourceTag/${TagKey}	Write
CloseInstancePublicPorts	Grants permission to close a public port of an instance	Instance*	aws:ResourceTag/${TagKey}	Write
CopySnapshot	Grants permission to copy a snapshot from one AWS Region to another in Amazon Lightsail			Write
CreateBucket	Grants permission to create an Amazon Lightsail bucket		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateBucketAccessKey	Grants permission to create a new access key for the specified bucket	Bucket*	aws:ResourceTag/${TagKey}	Write
CreateCertificate	Grants permission to create an SSL/TLS certificate		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateCloudFormationStack	Grants permission to create a new Amazon EC2 instance from an exported Amazon Lightsail snapshot			Write
CreateContactMethod	Grants permission to create an email or SMS text message contact method		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateContainerService	Grants permission to create an Amazon Lightsail container service		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateContainerServiceDeployment	Grants permission to create a deployment for your Amazon Lightsail container service	ContainerService*	aws:ResourceTag/${TagKey}	Write
CreateContainerServiceRegistryLogin	Grants permission to create a temporary set of log in credentials that you can use to log in to the Docker process on your local machine			Write
CreateDisk	Grants permission to create a disk		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDiskFromSnapshot	Grants permission to create a disk from snapshot	DiskSnapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDiskSnapshot	Grants permission to create a disk snapshot	Disk	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDiskSnapshot	Grants permission to create a disk snapshot	Instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDistribution	Grants permission to create an Amazon Lightsail content delivery network (CDN) distribution		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDomain	Grants permission to create a domain resource for the specified domain name		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDomainEntry	Grants permission to create one or more DNS record entries for a domain resource: Address (A), canonical name (CNAME), mail exchanger (MX), name server (NS), start of authority (SOA), service locator (SRV), or text (TXT)	Domain*	aws:ResourceTag/${TagKey}	Write
CreateGUISessionAccessDetails	Grants permission to create URLs that are used to access an instance's graphical user interface (GUI) session	Instance*	aws:ResourceTag/${TagKey}	Write
CreateInstanceSnapshot	Grants permission to create an instance snapshot	Instance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateInstances	Grants permission to create one or more instances		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateInstancesFromSnapshot	Grants permission to create one or more instances based on an instance snapshot	InstanceSnapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateKeyPair	Grants permission to create a key pair used to authenticate and connect to an instance		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLoadBalancer	Grants permission to create a load balancer		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLoadBalancerTlsCertificate	Grants permission to create a load balancer TLS certificate	LoadBalancer*	aws:ResourceTag/${TagKey}	Write
CreateRelationalDatabase	Grants permission to create a new relational database		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateRelationalDatabaseFromSnapshot	Grants permission to create a new relational database from a snapshot	RelationalDatabaseSnapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRelationalDatabaseSnapshot	Grants permission to create a relational database snapshot		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteAlarm	Grants permission to delete an alarm	Alarm*	aws:ResourceTag/${TagKey}	Write
DeleteAutoSnapshot	Grants permission to delete an automatic snapshot of an instance or disk			Write
DeleteBucket	Grants permission to delete an Amazon Lightsail bucket	Bucket*	aws:ResourceTag/${TagKey}	Write
DeleteBucketAccessKey	Grants permission to delete an access key for the specified Amazon Lightsail bucket	Bucket*	aws:ResourceTag/${TagKey}	Write
DeleteCertificate	Grants permission to delete an SSL/TLS certificate	Certificate*	aws:ResourceTag/${TagKey}	Write
DeleteContactMethod	Grants permission to delete a contact method			Write
DeleteContainerImage	Grants permission to delete a container image that is registered to your Amazon Lightsail container service	ContainerService*	aws:ResourceTag/${TagKey}	Write
DeleteContainerService	Grants permission to delete your Amazon Lightsail container service	ContainerService*	aws:ResourceTag/${TagKey}	Write
DeleteDisk	Grants permission to delete a disk	Disk*	aws:ResourceTag/${TagKey}	Write
DeleteDiskSnapshot	Grants permission to delete a disk snapshot	DiskSnapshot*	aws:ResourceTag/${TagKey}	Write
DeleteDistribution	Grants permission to delete your Amazon Lightsail content delivery network (CDN) distribution	Distribution*	aws:ResourceTag/${TagKey}	Write
DeleteDomain	Grants permission to delete a domain resource and all of its DNS records	Domain*	aws:ResourceTag/${TagKey}	Write
DeleteDomainEntry	Grants permission to delete a DNS record entry for a domain resource	Domain*	aws:ResourceTag/${TagKey}	Write
DeleteInstance	Grants permission to delete an instance	Instance*	aws:ResourceTag/${TagKey}	Write
DeleteInstanceSnapshot	Grants permission to delete an instance snapshot	InstanceSnapshot*	aws:ResourceTag/${TagKey}	Write
DeleteKeyPair	Grants permission to delete a key pair used to authenticate and connect to an instance	KeyPair*	aws:ResourceTag/${TagKey}	Write
DeleteKnownHostKeys	Grants permission to delete the known host key or certificate used by the Amazon Lightsail browser-based SSH or RDP clients to authenticate an instance	Instance*	aws:ResourceTag/${TagKey}	Write
DeleteLoadBalancer	Grants permission to delete a load balancer	LoadBalancer*	aws:ResourceTag/${TagKey}	Write
DeleteLoadBalancerTlsCertificate	Grants permission to delete a load balancer TLS certificate	LoadBalancer*	aws:ResourceTag/${TagKey}	Write
DeleteRelationalDatabase	Grants permission to delete a relational database	RelationalDatabase*	aws:ResourceTag/${TagKey}	Write
DeleteRelationalDatabaseSnapshot	Grants permission to delete a relational database snapshot	RelationalDatabaseSnapshot*	aws:ResourceTag/${TagKey}	Write
DetachCertificateFromDistribution	Grants permission to detach an SSL/TLS certificate from your Amazon Lightsail content delivery network (CDN) distribution	Distribution*	aws:ResourceTag/${TagKey}	Write
DetachDisk	Grants permission to detach a disk from an instance	Disk*	aws:ResourceTag/${TagKey}	Write
DetachInstancesFromLoadBalancer	Grants permission to detach one or more instances from a load balancer	LoadBalancer*	aws:ResourceTag/${TagKey}	Write
DetachStaticIp	Grants permission to detach a static IP from an instance to which it is attached	StaticIp*	aws:ResourceTag/${TagKey}	Write
DisableAddOn	Grants permission to disable an add-on for an Amazon Lightsail resource			Write
DownloadDefaultKeyPair	Grants permission to download the default key pair used to authenticate and connect to instances in a specific AWS Region			Write
EnableAddOn	Grants permission to enable or modify an add-on for an Amazon Lightsail resource			Write
ExportSnapshot	Grants permission to export an Amazon Lightsail snapshot to Amazon EC2	DiskSnapshot	aws:ResourceTag/${TagKey}	Write
ExportSnapshot		InstanceSnapshot	aws:ResourceTag/${TagKey}	Write
GetActiveNames	Grants permission to get the names of all active (not deleted) resources			Read
GetAlarms	Grants permission to view information about the configured alarms			Read
GetAutoSnapshots	Grants permission to view the available automatic snapshots for an instance or disk			Read
GetBlueprints	Grants permission to get a list of instance images, or blueprints. You can use a blueprint to create a new instance already running a specific operating system, as well as a pre-installed application or development stack. The software that runs on your instance depends on the blueprint you define when creating the instance			Read
GetBucketAccessKeys	Grants permission to get the existing access key IDs for the specified Amazon Lightsail bucket			Read
GetBucketBundles	Grants permission to get the bundles that can be applied to an Amazon Lightsail bucket			Read
GetBucketMetricData	Grants permission to get the data points of a specific metric for an Amazon Lightsail bucket			Read
GetBuckets	Grants permission to get information about one or more Amazon Lightsail buckets			Read
GetBundles	Grants permission to get a list of instance bundles. You can use a bundle to create a new instance with a set of performance specifications, such as CPU count, disk size, RAM size, and network transfer allowance. The cost of your instance depends on the bundle you define when creating the instance			Read
GetCertificates	Grants permission to view information about one or more Amazon Lightsail SSL/TLS certificates			Read
GetCloudFormationStackRecords	Grants permission to get information about all CloudFormation stacks used to create Amazon EC2 resources from exported Amazon Lightsail snapshots			Read
GetContactMethods	Grants permission to view information about the configured contact methods			Read
GetContainerAPIMetadata	Grants permission to view information about Amazon Lightsail containers, such as the current version of the Lightsail Control (lightsailctl) plugin			Read
GetContainerImages	Grants permission to view the container images that are registered to your Amazon Lightsail container service			Read
GetContainerLog	Grants permission to view the log events of a container of your Amazon Lightsail container service			Read
GetContainerServiceDeployments	Grants permission to view the deployments for your Amazon Lightsail container service			Read
GetContainerServiceMetricData	Grants permission to view the data points of a specific metric of your Amazon Lightsail container service			Read
GetContainerServicePowers	Grants permission to view the list of powers that can be specified for your Amazon Lightsail container services			Read
GetContainerServices	Grants permission to view information about one or more of your Amazon Lightsail container services			Read
GetCostEstimate	Grants permission to get the information about the cost estimate for a specified resource	Disk	aws:ResourceTag/${TagKey}	Read
GetCostEstimate		Instance	aws:ResourceTag/${TagKey}	Read
GetDisk	Grants permission to get information about a disk			Read
GetDiskSnapshot	Grants permission to get information about a disk snapshot			Read
GetDiskSnapshots	Grants permission to get information about all disk snapshots			Read
GetDisks	Grants permission to get information about all disks			Read
GetDistributionBundles	Grants permission to view the list of bundles that can be applied to you Amazon Lightsail content delivery network (CDN) distributions			Read
GetDistributionLatestCacheReset	Grants permission to view the timestamp and status of the last cache reset of a specific Amazon Lightsail content delivery network (CDN) distribution			Read
GetDistributionMetricData	Grants permission to view the data points of a specific metric for an Amazon Lightsail content delivery network (CDN) distribution			Read
GetDistributions	Grants permission to view information about one or more of your Amazon Lightsail content delivery network (CDN) distributions			Read
GetDomain	Grants permission to get DNS records for a domain resource			Read
GetDomains	Grants permission to get DNS records for all domain resources			Read
GetExportSnapshotRecords	Grants permission to get information about all records of exported Amazon Lightsail snapshots to Amazon EC2			Read
GetInstance	Grants permission to get information about an instance			Read
GetInstanceAccessDetails	Grants permission to get temporary keys you can use to authenticate and connect to an instance	Instance*	aws:ResourceTag/${TagKey}	Write
GetInstanceMetricData	Grants permission to get the data points for the specified metric of an instance			Read
GetInstancePortStates	Grants permission to get the port states of an instance			Read
GetInstanceSnapshot	Grants permission to get information about an instance snapshot			Read
GetInstanceSnapshots	Grants permission to get information about all instance snapshots			Read
GetInstanceState	Grants permission to get the state of an instance			Read
GetInstances	Grants permission to get information about all instances			Read
GetKeyPair	Grants permission to get information about a key pair			Read
GetKeyPairs	Grants permission to get information about all key pairs			Read
GetLoadBalancer	Grants permission to get information about a load balancer			Read
GetLoadBalancerMetricData	Grants permission to get the data points for the specified metric of a load balancer			Read
GetLoadBalancerTlsCertificates	Grants permission to get information about a load balancer's TLS certificates			Read
GetLoadBalancerTlsPolicies	Grants permission to get a list of TLS security policies that you can apply to Lightsail load balancers			Read
GetLoadBalancers	Grants permission to get information about load balancers			Read
GetOperation	Grants permission to get information about an operation. Operations include events such as when you create an instance, allocate a static IP, attach a static IP, and so on			Read
GetOperations	Grants permission to get information about all operations. Operations include events such as when you create an instance, allocate a static IP, attach a static IP, and so on			Read
GetOperationsForResource	Grants permission to get operations for a resource			Read
GetRegions	Grants permission to get a list of all valid AWS Regions for Amazon Lightsail			Read
GetRelationalDatabase	Grants permission to get information about a relational database			Read
GetRelationalDatabaseBlueprints	Grants permission to get a list of relational database images, or blueprints. You can use a blueprint to create a new database running a specific database engine. The database engine that runs on your database depends on the blueprint you define when creating the relational database			Read
GetRelationalDatabaseBundles	Grants permission to get a list of relational database bundles. You can use a bundle to create a new database with a set of performance specifications, such as CPU count, disk size, RAM size, network transfer allowance, and standard of high availability. The cost of your database depends on the bundle you define when creating the relational database			Read
GetRelationalDatabaseEvents	Grants permission to get events for a relational database			Read
GetRelationalDatabaseLogEvents	Grants permission to get events for the specified log stream of a relational database			Read
GetRelationalDatabaseLogStreams	Grants permission to get the log streams available for a relational database			Read
GetRelationalDatabaseMasterUserPassword	Grants permission to get the master user password of a relational database	RelationalDatabase*	aws:ResourceTag/${TagKey}	Write
GetRelationalDatabaseMetricData	Grants permission to get the data points for the specified metric of a relational database			Read
GetRelationalDatabaseParameters	Grants permission to get the parameters of a relational database			Read
GetRelationalDatabaseSnapshot	Grants permission to get information about a relational database snapshot			Read
GetRelationalDatabaseSnapshots	Grants permission to get information about all relational database snapshots			Read
GetRelationalDatabases	Grants permission to get information about all relational databases			Read
GetSetupHistory	Grants permission to get detailed information for setup requests that were run on the specified resource	Instance	aws:ResourceTag/${TagKey}	Read
GetStaticIp	Grants permission to get information about a static IP			Read
GetStaticIps	Grants permission to get information about all static IPs			Read
ImportKeyPair	Grants permission to import a public key from a key pair			Write
IsVpcPeered	Grants permission to get a boolean value indicating whether the Amazon Lightsail virtual private cloud (VPC) is peered			Read
OpenInstancePublicPorts	Grants permission to add, or open a public port of an instance	Instance*	aws:ResourceTag/${TagKey}	Write
PeerVpc	Grants permission to try to peer the Amazon Lightsail virtual private cloud (VPC) with the default VPC			Write
PutAlarm	Grants permission to creates or update an alarm, and associate it with the specified metric	Alarm*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutInstancePublicPorts	Grants permission to set the specified open ports for an instance, and closes all ports for every protocol not included in the request	Instance*	aws:ResourceTag/${TagKey}	Write
RebootInstance	Grants permission to reboot an instance that is in a running state	Instance*	aws:ResourceTag/${TagKey}	Write
RebootRelationalDatabase	Grants permission to reboot a relational database that is in a running state	RelationalDatabase*	aws:ResourceTag/${TagKey}	Write
RegisterContainerImage	Grants permission to register a container image to your Amazon Lightsail container service	ContainerService*	aws:ResourceTag/${TagKey}	Write
ReleaseStaticIp	Grants permission to delete a static IP	StaticIp*	aws:ResourceTag/${TagKey}	Write
ResetDistributionCache	Grants permission to delete currently cached content from your Amazon Lightsail content delivery network (CDN) distribution	Distribution*	aws:ResourceTag/${TagKey}	Write
SendContactMethodVerification	Grants permission to send a verification request to an email contact method to ensure it's owned by the requester			Write
SetIpAddressType	Grants permission to set the IP address type for a Amazon Lightsail resource	Distribution	aws:ResourceTag/${TagKey}	Write
		Instance	aws:ResourceTag/${TagKey}
		LoadBalancer	aws:ResourceTag/${TagKey}
SetResourceAccessForBucket	Grants permission to set the Amazon Lightsail resources that can access the specified Amazon Lightsail bucket	Bucket*	aws:ResourceTag/${TagKey}	Write
SetResourceAccessForBucket		Instance*	aws:ResourceTag/${TagKey}	Write
SetupInstanceHttps	Grants permission to create an SSL/TLS certificate and install it on a specified instance	Instance*	aws:ResourceTag/${TagKey}	Write
StartGUISession	Grants permission to initiate a graphical user interface (GUI) session used to access an instance's operating system or application	Instance*	aws:ResourceTag/${TagKey}	Write
StartInstance	Grants permission to start an instance that is in a stopped state	Instance*	aws:ResourceTag/${TagKey}	Write
StartRelationalDatabase	Grants permission to start a relational database that is in a stopped state	RelationalDatabase*	aws:ResourceTag/${TagKey}	Write
StopGUISession	Grants permission to terminate a graphical user interface (GUI) session used to access an instance's operating system or application	Instance*	aws:ResourceTag/${TagKey}	Write
StopInstance	Grants permission to stop an instance that is in a running state	Instance*	aws:ResourceTag/${TagKey}	Write
StopRelationalDatabase	Grants permission to stop a relational database that is in a running state	RelationalDatabase*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag a resource	Alarm	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		Bucket	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Certificate	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		ContactMethod	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		ContainerService	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Disk	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		DiskSnapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Distribution	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Domain	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		InstanceSnapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		KeyPair	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		LoadBalancer	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		RelationalDatabase	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		RelationalDatabaseSnapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		StaticIp	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
TestAlarm	Grants permission to test an alarm by displaying a banner on the Amazon Lightsail console or if a notification trigger is configured for the specified alarm, by sending a notification to the notification protocol	Alarm*	aws:ResourceTag/${TagKey}	Write
UnpeerVpc	Grants permission to try to unpeer the Amazon Lightsail virtual private cloud (VPC) from the default VPC			Write
UntagResource	Grants permission to untag a resource	Alarm	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		Bucket	aws:ResourceTag/${TagKey} aws:TagKeys
		Certificate	aws:ResourceTag/${TagKey} aws:TagKeys
		ContactMethod	aws:ResourceTag/${TagKey} aws:TagKeys
		ContainerService	aws:ResourceTag/${TagKey} aws:TagKeys
		Disk	aws:ResourceTag/${TagKey} aws:TagKeys
		DiskSnapshot	aws:ResourceTag/${TagKey} aws:TagKeys
		Distribution	aws:ResourceTag/${TagKey} aws:TagKeys
		Domain	aws:ResourceTag/${TagKey} aws:TagKeys
		Instance	aws:ResourceTag/${TagKey} aws:TagKeys
		InstanceSnapshot	aws:ResourceTag/${TagKey} aws:TagKeys
		KeyPair	aws:ResourceTag/${TagKey} aws:TagKeys
		LoadBalancer	aws:ResourceTag/${TagKey} aws:TagKeys
		RelationalDatabase	aws:ResourceTag/${TagKey} aws:TagKeys
		RelationalDatabaseSnapshot	aws:ResourceTag/${TagKey} aws:TagKeys
		StaticIp	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateBucket	Grants permission to update an existing Amazon Lightsail bucket	Bucket*	aws:ResourceTag/${TagKey}	Write
UpdateBucketBundle	Grants permission to update the bundle, or storage plan, of an existing Amazon Lightsail bucket	Bucket*	aws:ResourceTag/${TagKey}	Write
UpdateContainerService	Grants permission to update the configuration of your Amazon Lightsail container service, such as its power, scale, and public domain names	ContainerService*	aws:ResourceTag/${TagKey}	Write
UpdateDistribution	Grants permission to update an existing Amazon Lightsail content delivery network (CDN) distribution or its configuration	Distribution*	aws:ResourceTag/${TagKey}	Write
UpdateDistributionBundle	Grants permission to update the bundle of your Amazon Lightsail content delivery network (CDN) distribution	Distribution*	aws:ResourceTag/${TagKey}	Write
UpdateDomainEntry	Grants permission to update a domain recordset after it is created	Domain*	aws:ResourceTag/${TagKey}	Write
UpdateInstanceMetadataOptions	Grants permission to update metadata options for an instance	Instance*	aws:ResourceTag/${TagKey}	Write
UpdateLoadBalancerAttribute	Grants permission to update a load balancer attribute, such as the health check path and session stickiness	LoadBalancer*	aws:ResourceTag/${TagKey}	Write
UpdateRelationalDatabase	Grants permission to update a relational database	RelationalDatabase*	aws:ResourceTag/${TagKey}	Write
UpdateRelationalDatabaseParameters	Grants permission to update the parameters of a relational database	RelationalDatabase*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Lightsail

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
Alarm	arn:${Partition}:lightsail:${Region}:${Account}:Alarm/${Id}	aws:ResourceTag/${TagKey}
Bucket	arn:${Partition}:lightsail:${Region}:${Account}:Bucket/${Id}	aws:ResourceTag/${TagKey}
Certificate	arn:${Partition}:lightsail:${Region}:${Account}:Certificate/${Id}	aws:ResourceTag/${TagKey}
CloudFormationStackRecord	arn:${Partition}:lightsail:${Region}:${Account}:CloudFormationStackRecord/${Id}
ContactMethod	arn:${Partition}:lightsail:${Region}:${Account}:ContactMethod/${Id}	aws:ResourceTag/${TagKey}
ContainerService	arn:${Partition}:lightsail:${Region}:${Account}:ContainerService/${Id}	aws:ResourceTag/${TagKey}
Disk	arn:${Partition}:lightsail:${Region}:${Account}:Disk/${Id}	aws:ResourceTag/${TagKey}
DiskSnapshot	arn:${Partition}:lightsail:${Region}:${Account}:DiskSnapshot/${Id}	aws:ResourceTag/${TagKey}
Distribution	arn:${Partition}:lightsail:${Region}:${Account}:Distribution/${Id}	aws:ResourceTag/${TagKey}
Domain	arn:${Partition}:lightsail:${Region}:${Account}:Domain/${Id}	aws:ResourceTag/${TagKey}
ExportSnapshotRecord	arn:${Partition}:lightsail:${Region}:${Account}:ExportSnapshotRecord/${Id}
Instance	arn:${Partition}:lightsail:${Region}:${Account}:Instance/${Id}	aws:ResourceTag/${TagKey}
InstanceSnapshot	arn:${Partition}:lightsail:${Region}:${Account}:InstanceSnapshot/${Id}	aws:ResourceTag/${TagKey}
KeyPair	arn:${Partition}:lightsail:${Region}:${Account}:KeyPair/${Id}	aws:ResourceTag/${TagKey}
LoadBalancer	arn:${Partition}:lightsail:${Region}:${Account}:LoadBalancer/${Id}	aws:ResourceTag/${TagKey}
LoadBalancerTlsCertificate	arn:${Partition}:lightsail:${Region}:${Account}:LoadBalancerTlsCertificate/${Id}
RelationalDatabase	arn:${Partition}:lightsail:${Region}:${Account}:RelationalDatabase/${Id}	aws:ResourceTag/${TagKey}
RelationalDatabaseSnapshot	arn:${Partition}:lightsail:${Region}:${Account}:RelationalDatabaseSnapshot/${Id}	aws:ResourceTag/${TagKey}
StaticIp	arn:${Partition}:lightsail:${Region}:${Account}:StaticIp/${Id}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Lightsail

Amazon Lightsail defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a tag key and value pair that is allowed in the request	String
aws:ResourceTag/${TagKey}	Filters access by a tag key and value pair of a resource	String
aws:TagKeys	Filters access by a list of tag keys that are allowed in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Lex V2 (lex)

Amazon Location (geo)