Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for AWS Data Pipeline

AWS Data Pipeline (service prefix: datapipeline) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by AWS Data Pipeline
Actions defined by AWS Data Pipeline
Permission-only actions for AWS Data Pipeline
Resource types defined by AWS Data Pipeline
Condition keys for AWS Data Pipeline

API operations defined by AWS Data Pipeline

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
ActivatePipeline	datapipeline:ActivatePipeline			Write
ActivatePipeline	iam:PassRole	iam:PassedToService	datapipeline.amazonaws.com, ec2.amazonaws.com, elasticmapreduce.amazonaws.com	Write
AddTags	datapipeline:AddTags			Tagging, Write
CreatePipeline	datapipeline:AddTags			Tagging, Write
CreatePipeline	datapipeline:CreatePipeline			Write
DeactivatePipeline	datapipeline:DeactivatePipeline			Write
DeletePipeline	datapipeline:DeletePipeline			Write
DescribeObjects	datapipeline:DescribeObjects			Read
DescribePipelines	datapipeline:DescribePipelines			Read
EvaluateExpression	datapipeline:EvaluateExpression			Read
GetPipelineDefinition	datapipeline:GetPipelineDefinition			Read
ListPipelines	datapipeline:ListPipelines			List
PollForTask	datapipeline:PollForTask			Write
PutPipelineDefinition	datapipeline:PutPipelineDefinition			Write
PutPipelineDefinition	iam:PassRole	iam:PassedToService	datapipeline.amazonaws.com, ec2.amazonaws.com, elasticmapreduce.amazonaws.com	Write
QueryObjects	datapipeline:QueryObjects			Read
RemoveTags	datapipeline:RemoveTags			Tagging, Write
ReportTaskProgress	datapipeline:ReportTaskProgress			Write
ReportTaskRunnerHeartbeat	datapipeline:ReportTaskRunnerHeartbeat			Write
SetStatus	datapipeline:SetStatus			Write
SetTaskStatus	datapipeline:SetTaskStatus			Write
ValidatePipelineDefinition	datapipeline:ValidatePipelineDefinition			Read
ValidatePipelineDefinition	iam:PassRole	iam:PassedToService	datapipeline.amazonaws.com, ec2.amazonaws.com, elasticmapreduce.amazonaws.com	Write

Actions defined by AWS Data Pipeline

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
ActivatePipeline	Grants permission to validate the specified pipeline and starts processing pipeline tasks. If the pipeline does not pass validation, activation fails	pipeline*	aws:ResourceTag/${TagKey} datapipeline:PipelineCreator datapipeline:Tag/${TagKey} datapipeline:workerGroup	Write
AddTags	Grants permission to add or modify tags for the specified pipeline	pipeline*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys datapipeline:PipelineCreator datapipeline:Tag/${TagKey}	Tagging, Write
CreatePipeline	Grants permission to create a new, empty pipeline		aws:RequestTag/${TagKey} aws:TagKeys datapipeline:Tag/${TagKey}	Write
DeactivatePipeline	Grants permission to Deactivate the specified running pipeline	pipeline*	aws:ResourceTag/${TagKey} datapipeline:PipelineCreator datapipeline:Tag/${TagKey} datapipeline:workerGroup	Write
DeletePipeline	Grants permission to delete a pipeline, its pipeline definition, and its run history	pipeline*	aws:ResourceTag/${TagKey} datapipeline:PipelineCreator datapipeline:Tag/${TagKey}	Write
DescribeObjects	Grants permission to get the object definitions for a set of objects associated with the pipeline	pipeline*	aws:ResourceTag/${TagKey} datapipeline:PipelineCreator datapipeline:Tag/${TagKey}	Read
DescribePipelines	Grants permission to retrieves metadata about one or more pipelines	pipeline*	aws:ResourceTag/${TagKey} datapipeline:PipelineCreator datapipeline:Tag/${TagKey}	Read
EvaluateExpression	Grants permission to task runners to call EvaluateExpression, to evaluate a string in the context of the specified object	pipeline*	aws:ResourceTag/${TagKey} datapipeline:PipelineCreator datapipeline:Tag/${TagKey}	Read
GetPipelineDefinition	Grants permission to gets the definition of the specified pipeline	pipeline*	aws:ResourceTag/${TagKey} datapipeline:PipelineCreator datapipeline:Tag/${TagKey} datapipeline:workerGroup	Read
ListPipelines	Grants permission to list the pipeline identifiers for all active pipelines that you have permission to access			List
PollForTask	Grants permission to task runners to call PollForTask, to receive a task to perform from AWS Data Pipeline		datapipeline:workerGroup	Write
PutPipelineDefinition	Grants permission to add tasks, schedules, and preconditions to the specified pipeline	pipeline*	aws:ResourceTag/${TagKey} datapipeline:PipelineCreator datapipeline:Tag/${TagKey} datapipeline:workerGroup	Write
QueryObjects	Grants permission to query the specified pipeline for the names of objects that match the specified set of conditions	pipeline*	aws:ResourceTag/${TagKey} datapipeline:PipelineCreator datapipeline:Tag/${TagKey}	Read
RemoveTags	Grants permission to remove existing tags from the specified pipeline	pipeline*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys datapipeline:PipelineCreator datapipeline:Tag/${TagKey}	Tagging, Write
ReportTaskProgress	Grants permission to task runners to call ReportTaskProgress, when they are assigned a task to acknowledge that it has the task	pipeline*	aws:ResourceTag/${TagKey}	Write
ReportTaskRunnerHeartbeat	Grants permission to task runners to call ReportTaskRunnerHeartbeat every 15 minutes to indicate that they are operational			Write
SetStatus	Grants permission to requests that the status of the specified physical or logical pipeline objects be updated in the specified pipeline	pipeline*	aws:ResourceTag/${TagKey} datapipeline:PipelineCreator datapipeline:Tag/${TagKey}	Write
SetTaskStatus	Grants permission to task runners to call SetTaskStatus to notify AWS Data Pipeline that a task is completed and provide information about the final status	pipeline*	aws:ResourceTag/${TagKey}	Write
ValidatePipelineDefinition	Grants permission to validate the specified pipeline definition to ensure that it is well formed and can be run without error	pipeline*	aws:ResourceTag/${TagKey} datapipeline:PipelineCreator datapipeline:Tag/${TagKey} datapipeline:workerGroup	Read

Permission-only actions for AWS Data Pipeline

The following actions are defined by AWS Data Pipeline but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
GetAccountLimits	Grants permission to call GetAccountLimits			List
PutAccountLimits	Grants permission to call PutAccountLimits			Write

Resource types defined by AWS Data Pipeline

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
pipeline	arn:${Partition}:datapipeline:${Region}:${Account}:pipeline/${PipelineId}	aws:ResourceTag/${TagKey}

Condition keys for AWS Data Pipeline

AWS Data Pipeline defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString
datapipeline:PipelineCreator	Filters access by the IAM user that created the pipeline	ArrayOfString
datapipeline:Tag/${TagKey}	Filters access by customer-specified key/value pair that can be attached to a resource	String
datapipeline:workerGroup	Filters access by the name of a worker group for which a Task Runner retrieves work	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Data Exchange (dataexchange)

AWS Database Migration Service (dms)