Operations Actions Resource types Condition keys

Actions, resources, and condition keys for AWS RTB Fabric

AWS RTB Fabric (service prefix: rtbfabric) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by AWS RTB Fabric

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AcceptLink	rtbfabric:AcceptLink	Write
AssociateCertificate	rtbfabric:AssociateCertificate	Write
CreateInboundExternalLink	rtbfabric:CreateInboundExternalLink	Write
CreateInboundExternalLink	rtbfabric:TagResource	Tagging, Write
CreateLink	rtbfabric:CreateLink	Write
CreateLink	rtbfabric:TagResource	Tagging, Write
CreateLinkRoutingRule	rtbfabric:CreateLinkRoutingRule	Write
CreateLinkRoutingRule	rtbfabric:TagResource	Tagging, Write
CreateOutboundExternalLink	rtbfabric:CreateOutboundExternalLink	Write
CreateOutboundExternalLink	rtbfabric:TagResource	Tagging, Write
CreateRequesterGateway	rtbfabric:CreateRequesterGateway	Write
CreateRequesterGateway	rtbfabric:TagResource	Tagging, Write
CreateResponderGateway	rtbfabric:CreateResponderGateway	Write
CreateResponderGateway	rtbfabric:TagResource	Tagging, Write
DeleteInboundExternalLink	rtbfabric:DeleteInboundExternalLink	Write
DeleteLink	rtbfabric:DeleteLink	Write
DeleteLinkRoutingRule	rtbfabric:DeleteLinkRoutingRule	Write
DeleteOutboundExternalLink	rtbfabric:DeleteOutboundExternalLink	Write
DeleteRequesterGateway	rtbfabric:DeleteRequesterGateway	Write
DeleteResponderGateway	rtbfabric:DeleteResponderGateway	Write
DisassociateCertificate	rtbfabric:DisassociateCertificate	Write
GetCertificateAssociation	rtbfabric:GetCertificateAssociation	Read
GetInboundExternalLink	rtbfabric:GetInboundExternalLink	Read
GetLink	rtbfabric:GetLink	Read
GetLinkRoutingRule	rtbfabric:GetLinkRoutingRule	Read
GetOutboundExternalLink	rtbfabric:GetOutboundExternalLink	Read
GetRequesterGateway	rtbfabric:GetRequesterGateway	Read
GetResponderGateway	rtbfabric:GetResponderGateway	Read
ListCertificateAssociations	rtbfabric:ListCertificateAssociations	List
ListLinkRoutingRules	rtbfabric:ListLinkRoutingRules	List
ListLinks	rtbfabric:ListLinks	List
ListRequesterGateways	rtbfabric:ListRequesterGateways	List
ListResponderGateways	rtbfabric:ListResponderGateways	List
ListTagsForResource	rtbfabric:ListTagsForResource	Read
RejectLink	rtbfabric:RejectLink	Write
TagResource	rtbfabric:TagResource	Tagging, Write
UntagResource	rtbfabric:UntagResource	Tagging, Write
UpdateLink	rtbfabric:UpdateLink	Write
UpdateLinkModuleFlow	rtbfabric:UpdateLinkModuleFlow	Write
UpdateLinkRoutingRule	rtbfabric:UpdateLinkRoutingRule	Write
UpdateRequesterGateway	rtbfabric:UpdateRequesterGateway	Write
UpdateResponderGateway	rtbfabric:UpdateResponderGateway	Write

Actions defined by AWS RTB Fabric

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptLink	Grants permission to accept a link invitation from another Gateway	Link*	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:RequesterGatewayGatewayId rtbfabric:ResponderGatewayGatewayId	Write
AssociateCertificate	Grants permission to associate an ACM certificate with a responder gateway	ResponderGateway*	aws:ResourceTag/${TagKey} rtbfabric:ResponderGatewayGatewayId	Write
CreateInboundExternalLink	Grants permission to create an inbound external link for a responder gateway	ResponderGateway*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rtbfabric:ResponderGatewayGatewayId	Write
CreateLink	Grants permission to create a new link between RTB applications		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLinkRoutingRule	Grants permission to create a routing rule for a link	Link*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rtbfabric:LinkLinkId rtbfabric:RequesterGatewayGatewayId rtbfabric:ResponderGatewayGatewayId	Write
CreateOutboundExternalLink	Grants permission to create an outbound external link for a requester gateway to connect to external public responder endpoints	RequesterGateway*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rtbfabric:RequesterGatewayGatewayId	Write
CreateRequesterGateway	Grants permission to create a requester gateway		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateResponderGateway	Grants permission to create a responder gateway		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteInboundExternalLink	Grants permission to delete an inbound external link	InboundExternalLink*	aws:ResourceTag/${TagKey} rtbfabric:InboundExternalLinkLinkId rtbfabric:ResponderGatewayGatewayId	Write
DeleteInboundExternalLink	Grants permission to delete an inbound external link	ResponderGateway*	aws:ResourceTag/${TagKey} rtbfabric:ResponderGatewayGatewayId	Write
DeleteLink	Grants permission to delete a link between RTB applications	Link*	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:RequesterGatewayGatewayId rtbfabric:ResponderGatewayGatewayId	Write
DeleteLinkRoutingRule	Grants permission to delete a routing rule from a link	Link*	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:RequesterGatewayGatewayId rtbfabric:ResponderGatewayGatewayId	Write
DeleteLinkRoutingRule	Grants permission to delete a routing rule from a link	LinkRoutingRule*	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:LinkRoutingRuleRuleId	Write
DeleteOutboundExternalLink	Grants permission to delete an outbound external link	OutboundExternalLink*	aws:ResourceTag/${TagKey} rtbfabric:OutboundExternalLinkLinkId rtbfabric:RequesterGatewayGatewayId	Write
DeleteOutboundExternalLink	Grants permission to delete an outbound external link	RequesterGateway*	aws:ResourceTag/${TagKey} rtbfabric:RequesterGatewayGatewayId	Write
DeleteRequesterGateway	Grants permission to delete a requester gateway	RequesterGateway*	aws:ResourceTag/${TagKey} rtbfabric:RequesterGatewayGatewayId	Write
DeleteResponderGateway	Grants permission to delete a responder gateway	ResponderGateway*	aws:ResourceTag/${TagKey} rtbfabric:ResponderGatewayGatewayId	Write
DisassociateCertificate	Grants permission to remove a certificate association from a responder gateway	ResponderGateway*	aws:ResourceTag/${TagKey} rtbfabric:ResponderGatewayGatewayId	Write
GetCertificateAssociation	Grants permission to retrieve details of a certificate association with a responder gateway	ResponderGateway*	aws:ResourceTag/${TagKey} rtbfabric:ResponderGatewayGatewayId	Read
GetInboundExternalLink	Grants permission to retrieve information about an inbound external link	InboundExternalLink*	aws:ResourceTag/${TagKey} rtbfabric:InboundExternalLinkLinkId rtbfabric:ResponderGatewayGatewayId	Read
GetInboundExternalLink		ResponderGateway*	aws:ResourceTag/${TagKey} rtbfabric:ResponderGatewayGatewayId	Read
GetLink	Grants permission to retrieve information about a link between RTB applications	Link*	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:RequesterGatewayGatewayId rtbfabric:ResponderGatewayGatewayId	Read
GetLinkRoutingRule	Grants permission to retrieve information about a routing rule for a link	Link*	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:RequesterGatewayGatewayId rtbfabric:ResponderGatewayGatewayId	Read
GetLinkRoutingRule		LinkRoutingRule*	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:LinkRoutingRuleRuleId	Read
GetOutboundExternalLink	Grants permission to retrieve information about an outbound external link	OutboundExternalLink*	aws:ResourceTag/${TagKey} rtbfabric:OutboundExternalLinkLinkId rtbfabric:RequesterGatewayGatewayId	Read
GetOutboundExternalLink		RequesterGateway*	aws:ResourceTag/${TagKey} rtbfabric:RequesterGatewayGatewayId	Read
GetRequesterGateway	Grants permission to retrieve information about a requester gateway	RequesterGateway*	aws:ResourceTag/${TagKey} rtbfabric:RequesterGatewayGatewayId	Read
GetResponderGateway	Grants permission to retrieve information about a responder gateway	ResponderGateway*	aws:ResourceTag/${TagKey} rtbfabric:ResponderGatewayGatewayId	Read
ListCertificateAssociations	Grants permission to list certificate associations for a responder gateway	ResponderGateway*	aws:ResourceTag/${TagKey} rtbfabric:ResponderGatewayGatewayId	List
ListLinkRoutingRules	Grants permission to list routing rules for a link	Link*	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:RequesterGatewayGatewayId rtbfabric:ResponderGatewayGatewayId	List
ListLinks	Grants permission to list links associated with an RTB application			List
ListRequesterGateways	Grants permission to list requester gateways with optional filtering and pagination			List
ListResponderGateways	Grants permission to list responder gateways with optional filtering and pagination			List
ListTagsForResource	Grants permission to list tags for a resource	InboundExternalLink	aws:ResourceTag/${TagKey} rtbfabric:InboundExternalLinkLinkId rtbfabric:ResponderGatewayGatewayId	Read
		Link	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:RequesterGatewayGatewayId rtbfabric:ResponderGatewayGatewayId
		LinkRoutingRule	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:LinkRoutingRuleRuleId
		OutboundExternalLink	aws:ResourceTag/${TagKey} rtbfabric:OutboundExternalLinkLinkId rtbfabric:RequesterGatewayGatewayId
		RequesterGateway	aws:ResourceTag/${TagKey} rtbfabric:RequesterGatewayGatewayId
		ResponderGateway	aws:ResourceTag/${TagKey} rtbfabric:ResponderGatewayGatewayId
RejectLink	Grants permission to reject a link request between RTB applications	Link*	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:RequesterGatewayGatewayId rtbfabric:ResponderGatewayGatewayId	Write
TagResource	Grants permission to assign one or more tags (key-value pairs) to the specified resource	InboundExternalLink	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rtbfabric:InboundExternalLinkLinkId rtbfabric:ResponderGatewayGatewayId	Tagging, Write
		Link	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rtbfabric:LinkLinkId rtbfabric:RequesterGatewayGatewayId rtbfabric:ResponderGatewayGatewayId
		LinkRoutingRule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rtbfabric:LinkLinkId rtbfabric:LinkRoutingRuleRuleId
		OutboundExternalLink	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rtbfabric:OutboundExternalLinkLinkId rtbfabric:RequesterGatewayGatewayId
		RequesterGateway	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rtbfabric:RequesterGatewayGatewayId
		ResponderGateway	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys rtbfabric:ResponderGatewayGatewayId
UntagResource	Grants permission to remove a tag or tags from a resource	InboundExternalLink	aws:ResourceTag/${TagKey} aws:TagKeys rtbfabric:InboundExternalLinkLinkId rtbfabric:ResponderGatewayGatewayId	Tagging, Write
		Link	aws:ResourceTag/${TagKey} aws:TagKeys rtbfabric:LinkLinkId rtbfabric:RequesterGatewayGatewayId rtbfabric:ResponderGatewayGatewayId
		LinkRoutingRule	aws:ResourceTag/${TagKey} aws:TagKeys rtbfabric:LinkLinkId rtbfabric:LinkRoutingRuleRuleId
		OutboundExternalLink	aws:ResourceTag/${TagKey} aws:TagKeys rtbfabric:OutboundExternalLinkLinkId rtbfabric:RequesterGatewayGatewayId
		RequesterGateway	aws:ResourceTag/${TagKey} aws:TagKeys rtbfabric:RequesterGatewayGatewayId
		ResponderGateway	aws:ResourceTag/${TagKey} aws:TagKeys rtbfabric:ResponderGatewayGatewayId
UpdateLink	Grants permission to update configuration settings for an existing link	Link*	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:RequesterGatewayGatewayId rtbfabric:ResponderGatewayGatewayId	Write
UpdateLinkModuleFlow	Grants permission to update a link module flow	Link*	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:RequesterGatewayGatewayId rtbfabric:ResponderGatewayGatewayId	Write
UpdateLinkRoutingRule	Grants permission to update a routing rule for a link	Link*	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:RequesterGatewayGatewayId rtbfabric:ResponderGatewayGatewayId	Write
UpdateLinkRoutingRule	Grants permission to update a routing rule for a link	LinkRoutingRule*	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:LinkRoutingRuleRuleId	Write
UpdateRequesterGateway	Grants permission to update a requester gateway	RequesterGateway*	aws:ResourceTag/${TagKey} rtbfabric:RequesterGatewayGatewayId	Write
UpdateResponderGateway	Grants permission to update a responder gateway	ResponderGateway*	aws:ResourceTag/${TagKey} rtbfabric:ResponderGatewayGatewayId	Write

Resource types defined by AWS RTB Fabric

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
InboundExternalLink	arn:${Partition}:rtbfabric:${Region}:${Account}:gateway/${GatewayId}/link/${LinkId}	aws:ResourceTag/${TagKey} rtbfabric:InboundExternalLinkLinkId rtbfabric:ResponderGatewayGatewayId
Link	arn:${Partition}:rtbfabric:${Region}:${Account}:gateway/${GatewayId}/link/${LinkId}	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:RequesterGatewayGatewayId rtbfabric:ResponderGatewayGatewayId
LinkRoutingRule	arn:${Partition}:rtbfabric:${Region}:${Account}:gateway/${GatewayId}/link/${LinkId}/routing-rule/${RuleId}	aws:ResourceTag/${TagKey} rtbfabric:LinkLinkId rtbfabric:LinkRoutingRuleRuleId
OutboundExternalLink	arn:${Partition}:rtbfabric:${Region}:${Account}:gateway/${GatewayId}/link/${LinkId}	aws:ResourceTag/${TagKey} rtbfabric:OutboundExternalLinkLinkId rtbfabric:RequesterGatewayGatewayId
RequesterGateway	arn:${Partition}:rtbfabric:${Region}:${Account}:gateway/${GatewayId}	aws:ResourceTag/${TagKey} rtbfabric:RequesterGatewayGatewayId
ResponderGateway	arn:${Partition}:rtbfabric:${Region}:${Account}:gateway/${GatewayId}	aws:ResourceTag/${TagKey} rtbfabric:ResponderGatewayGatewayId

Condition keys for AWS RTB Fabric

AWS RTB Fabric defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a tag key and value pair that is allowed in the request	String
aws:ResourceTag/${TagKey}	Filters access by a tag key and value pair of a resource	String
aws:TagKeys	Filters access by a list of tag keys that are allowed in the request	ArrayOfString
rtbfabric:InboundExternalLinkGatewayId	Filters access by gateway identifier supporting rtb-gw-* formats	String
rtbfabric:InboundExternalLinkLinkId	Filters access by InboundExternalLink resource linkId identifier	String
rtbfabric:LinkLinkId	Filters access by Link resource linkId identifier	String
rtbfabric:LinkRoutingRuleRuleId	Filters access by routing rule identifier supporting rule-* formats	String
rtbfabric:OutboundExternalLinkLinkId	Filters access by OutboundExternalLink resource linkId identifier	String
rtbfabric:RequesterGatewayGatewayId	Filters access by gateway identifier supporting rtb-gw-* formats	String
rtbfabric:ResponderGatewayGatewayId	Filters access by gateway identifier supporting rtb-gw-* formats	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS Route53 Global Resolver (route53globalresolver)

AWS Savings Plans (savingsplans)