# Actions, resources, and condition keys for Amazon WorkMail Amazon WorkMail (service prefix: `workmail`) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies. References: + Learn how to [configure this service](https://docs.aws.amazon.com/workmail/latest/userguide/). + View a list of the [API operations available for this service](https://docs.aws.amazon.com/workmail/latest/APIReference/). + Learn how to secure this service and its resources by [using IAM](https://docs.aws.amazon.com/workmail/latest/adminguide/iam_users_groups.html) permission policies. + View the [programmatic service authorization reference](https://servicereference.us-east-1.amazonaws.com/v1/workmail/workmail.json) for this service. **Topics** + [API operations defined by Amazon WorkMail](#list_workmail-operations) + [Actions defined by Amazon WorkMail](#list_workmail-actions-as-permissions) + [Permission-only actions for Amazon WorkMail](#list_workmail-permission-only-actions) + [Resource types defined by Amazon WorkMail](#list_workmail-resources-for-iam-policies) + [Condition keys for Amazon WorkMail](#list_workmail-policy-keys) ## API operations defined by Amazon WorkMail The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the [Actions table](#list_workmail-actions-as-permissions). **** - ** AssociateDelegateToResource ** - **IAM action:** [workmail:AssociateDelegateToResource](#list_workmail-action-AssociateDelegateToResource) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** AssociateMemberToGroup ** - **IAM action:** [workmail:AssociateMemberToGroup](#list_workmail-action-AssociateMemberToGroup) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** AssumeImpersonationRole ** - **IAM action:** [workmail:AssumeImpersonationRole](#list_workmail-action-AssumeImpersonationRole) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** CancelMailboxExportJob ** - **IAM action:** [workmail:CancelMailboxExportJob](#list_workmail-action-CancelMailboxExportJob) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** CreateAlias ** - **IAM action:** [workmail:CreateAlias](#list_workmail-action-CreateAlias) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** CreateAvailabilityConfiguration ** - **IAM action:** [workmail:CreateAvailabilityConfiguration](#list_workmail-action-CreateAvailabilityConfiguration) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** CreateGroup ** - **IAM action:** [workmail:CreateGroup](#list_workmail-action-CreateGroup) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** CreateIdentityCenterApplication ** - **IAM action:** [workmail:CreateIdentityCenterApplication](#list_workmail-action-CreateIdentityCenterApplication) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** CreateImpersonationRole ** - **IAM action:** [workmail:CreateImpersonationRole](#list_workmail-action-CreateImpersonationRole) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** CreateMobileDeviceAccessRule ** - **IAM action:** [workmail:CreateMobileDeviceAccessRule](#list_workmail-action-CreateMobileDeviceAccessRule) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** CreateOrganization ** - **IAM action:** [workmail:CreateOrganization](#list_workmail-action-CreateOrganization) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** CreateResource ** - **IAM action:** [workmail:CreateResource](#list_workmail-action-CreateResource) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** CreateUser ** - **IAM action:** [workmail:CreateUser](#list_workmail-action-CreateUser) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeleteAccessControlRule ** - **IAM action:** [workmail:DeleteAccessControlRule](#list_workmail-action-DeleteAccessControlRule) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeleteAlias ** - **IAM action:** [workmail:DeleteAlias](#list_workmail-action-DeleteAlias) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeleteAvailabilityConfiguration ** - **IAM action:** [workmail:DeleteAvailabilityConfiguration](#list_workmail-action-DeleteAvailabilityConfiguration) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeleteEmailMonitoringConfiguration ** - **IAM action:** [workmail:DeleteEmailMonitoringConfiguration](#list_workmail-action-DeleteEmailMonitoringConfiguration) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeleteGroup ** - **IAM action:** [workmail:DeleteGroup](#list_workmail-action-DeleteGroup) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeleteIdentityCenterApplication ** - **IAM action:** [workmail:DeleteIdentityCenterApplication](#list_workmail-action-DeleteIdentityCenterApplication) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeleteIdentityProviderConfiguration ** - **IAM action:** [workmail:DeleteIdentityProviderConfiguration](#list_workmail-action-DeleteIdentityProviderConfiguration) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeleteImpersonationRole ** - **IAM action:** [workmail:DeleteImpersonationRole](#list_workmail-action-DeleteImpersonationRole) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeleteMailboxPermissions ** - **IAM action:** [workmail:DeleteMailboxPermissions](#list_workmail-action-DeleteMailboxPermissions) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeleteMobileDeviceAccessOverride ** - **IAM action:** [workmail:DeleteMobileDeviceAccessOverride](#list_workmail-action-DeleteMobileDeviceAccessOverride) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeleteMobileDeviceAccessRule ** - **IAM action:** [workmail:DeleteMobileDeviceAccessRule](#list_workmail-action-DeleteMobileDeviceAccessRule) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeleteOrganization ** - **IAM action:** [workmail:DeleteOrganization](#list_workmail-action-DeleteOrganization) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeletePersonalAccessToken ** - **IAM action:** [workmail:DeletePersonalAccessToken](#list_workmail-action-DeletePersonalAccessToken) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeleteResource ** - **IAM action:** [workmail:DeleteResource](#list_workmail-action-DeleteResource) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeleteRetentionPolicy ** - **IAM action:** [workmail:DeleteRetentionPolicy](#list_workmail-action-DeleteRetentionPolicy) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeleteUser ** - **IAM action:** [workmail:DeleteUser](#list_workmail-action-DeleteUser) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeregisterFromWorkMail ** - **IAM action:** [workmail:DeregisterFromWorkMail](#list_workmail-action-DeregisterFromWorkMail) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DeregisterMailDomain ** - **IAM action:** [workmail:DeregisterMailDomain](#list_workmail-action-DeregisterMailDomain) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DescribeEmailMonitoringConfiguration ** - **IAM action:** [workmail:DescribeEmailMonitoringConfiguration](#list_workmail-action-DescribeEmailMonitoringConfiguration) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** DescribeEntity ** - **IAM action:** [workmail:DescribeEntity](#list_workmail-action-DescribeEntity) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** DescribeGroup ** - **IAM action:** [workmail:DescribeGroup](#list_workmail-action-DescribeGroup) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** DescribeIdentityProviderConfiguration ** - **IAM action:** [workmail:DescribeIdentityProviderConfiguration](#list_workmail-action-DescribeIdentityProviderConfiguration) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** DescribeInboundDmarcSettings ** - **IAM action:** [workmail:DescribeInboundDmarcSettings](#list_workmail-action-DescribeInboundDmarcSettings) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** DescribeMailboxExportJob ** - **IAM action:** [workmail:DescribeMailboxExportJob](#list_workmail-action-DescribeMailboxExportJob) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** DescribeOrganization ** - **IAM action:** [workmail:DescribeOrganization](#list_workmail-action-DescribeOrganization) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** DescribeResource ** - **IAM action:** [workmail:DescribeResource](#list_workmail-action-DescribeResource) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** DescribeUser ** - **IAM action:** [workmail:DescribeUser](#list_workmail-action-DescribeUser) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** DisassociateDelegateFromResource ** - **IAM action:** [workmail:DisassociateDelegateFromResource](#list_workmail-action-DisassociateDelegateFromResource) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** DisassociateMemberFromGroup ** - **IAM action:** [workmail:DisassociateMemberFromGroup](#list_workmail-action-DisassociateMemberFromGroup) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** GetAccessControlEffect ** - **IAM action:** [workmail:GetAccessControlEffect](#list_workmail-action-GetAccessControlEffect) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** GetDefaultRetentionPolicy ** - **IAM action:** [workmail:GetDefaultRetentionPolicy](#list_workmail-action-GetDefaultRetentionPolicy) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** GetImpersonationRole ** - **IAM action:** [workmail:GetImpersonationRole](#list_workmail-action-GetImpersonationRole) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** GetImpersonationRoleEffect ** - **IAM action:** [workmail:GetImpersonationRoleEffect](#list_workmail-action-GetImpersonationRoleEffect) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** GetMailDomain ** - **IAM action:** [workmail:GetMailDomain](#list_workmail-action-GetMailDomain) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** GetMailboxDetails ** - **IAM action:** [workmail:GetMailboxDetails](#list_workmail-action-GetMailboxDetails) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** GetMobileDeviceAccessEffect ** - **IAM action:** [workmail:GetMobileDeviceAccessEffect](#list_workmail-action-GetMobileDeviceAccessEffect) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** GetMobileDeviceAccessOverride ** - **IAM action:** [workmail:GetMobileDeviceAccessOverride](#list_workmail-action-GetMobileDeviceAccessOverride) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** GetPersonalAccessTokenMetadata ** - **IAM action:** [workmail:GetPersonalAccessTokenMetadata](#list_workmail-action-GetPersonalAccessTokenMetadata) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** ListAccessControlRules ** - **IAM action:** [workmail:ListAccessControlRules](#list_workmail-action-ListAccessControlRules) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** ListAliases ** - **IAM action:** [workmail:ListAliases](#list_workmail-action-ListAliases) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** ListAvailabilityConfigurations ** - **IAM action:** [workmail:ListAvailabilityConfigurations](#list_workmail-action-ListAvailabilityConfigurations) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** ListGroupMembers ** - **IAM action:** [workmail:ListGroupMembers](#list_workmail-action-ListGroupMembers) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** ListGroups ** - **IAM action:** [workmail:ListGroups](#list_workmail-action-ListGroups) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** ListGroupsForEntity ** - **IAM action:** [workmail:ListGroupsForEntity](#list_workmail-action-ListGroupsForEntity) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** ListImpersonationRoles ** - **IAM action:** [workmail:ListImpersonationRoles](#list_workmail-action-ListImpersonationRoles) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** ListMailDomains ** - **IAM action:** [workmail:ListMailDomains](#list_workmail-action-ListMailDomains) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** ListMailboxExportJobs ** - **IAM action:** [workmail:ListMailboxExportJobs](#list_workmail-action-ListMailboxExportJobs) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** ListMailboxPermissions ** - **IAM action:** [workmail:ListMailboxPermissions](#list_workmail-action-ListMailboxPermissions) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** ListMobileDeviceAccessOverrides ** - **IAM action:** [workmail:ListMobileDeviceAccessOverrides](#list_workmail-action-ListMobileDeviceAccessOverrides) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** ListMobileDeviceAccessRules ** - **IAM action:** [workmail:ListMobileDeviceAccessRules](#list_workmail-action-ListMobileDeviceAccessRules) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** ListOrganizations ** - **IAM action:** [workmail:ListOrganizations](#list_workmail-action-ListOrganizations) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** ListPersonalAccessTokens ** - **IAM action:** [workmail:ListPersonalAccessTokens](#list_workmail-action-ListPersonalAccessTokens) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** ListResourceDelegates ** - **IAM action:** [workmail:ListResourceDelegates](#list_workmail-action-ListResourceDelegates) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** ListResources ** - **IAM action:** [workmail:ListResources](#list_workmail-action-ListResources) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** ListTagsForResource ** - **IAM action:** [workmail:ListTagsForResource](#list_workmail-action-ListTagsForResource) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** ListUsers ** - **IAM action:** [workmail:ListUsers](#list_workmail-action-ListUsers) - **Condition key:** - **Possible value(s):** - **Access level:** List - ** PutAccessControlRule ** - **IAM action:** [workmail:PutAccessControlRule](#list_workmail-action-PutAccessControlRule) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** PutEmailMonitoringConfiguration ** - **IAM action:** [workmail:PutEmailMonitoringConfiguration](#list_workmail-action-PutEmailMonitoringConfiguration) / **Condition key:** / **Possible value(s):** / **Access level:** Write - **IAM action:** [iam:PassRole](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html) / **Condition key:** iam:PassedToService / **Possible value(s):** events.workmail.amazonaws.com / **Access level:** Write - ** PutIdentityProviderConfiguration ** - **IAM action:** [workmail:PutIdentityProviderConfiguration](#list_workmail-action-PutIdentityProviderConfiguration) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** PutInboundDmarcSettings ** - **IAM action:** [workmail:PutInboundDmarcSettings](#list_workmail-action-PutInboundDmarcSettings) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** PutMailboxPermissions ** - **IAM action:** [workmail:PutMailboxPermissions](#list_workmail-action-PutMailboxPermissions) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** PutMobileDeviceAccessOverride ** - **IAM action:** [workmail:PutMobileDeviceAccessOverride](#list_workmail-action-PutMobileDeviceAccessOverride) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** PutRetentionPolicy ** - **IAM action:** [workmail:PutRetentionPolicy](#list_workmail-action-PutRetentionPolicy) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** RegisterMailDomain ** - **IAM action:** [workmail:RegisterMailDomain](#list_workmail-action-RegisterMailDomain) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** RegisterToWorkMail ** - **IAM action:** [workmail:RegisterToWorkMail](#list_workmail-action-RegisterToWorkMail) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** ResetPassword ** - **IAM action:** [workmail:ResetPassword](#list_workmail-action-ResetPassword) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** StartMailboxExportJob ** - **IAM action:** [workmail:StartMailboxExportJob](#list_workmail-action-StartMailboxExportJob) / **Condition key:** / **Possible value(s):** / **Access level:** Write - **IAM action:** [iam:PassRole](https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_passrole.html) / **Condition key:** iam:PassedToService / **Possible value(s):** workmail.amazonaws.com / **Access level:** Write - ** TagResource ** - **IAM action:** [workmail:TagResource](#list_workmail-action-TagResource) - **Condition key:** - **Possible value(s):** - **Access level:** Tagging, Write - ** TestAvailabilityConfiguration ** - **IAM action:** [workmail:TestAvailabilityConfiguration](#list_workmail-action-TestAvailabilityConfiguration) - **Condition key:** - **Possible value(s):** - **Access level:** Read - ** UntagResource ** - **IAM action:** [workmail:UntagResource](#list_workmail-action-UntagResource) - **Condition key:** - **Possible value(s):** - **Access level:** Tagging, Write - ** UpdateAvailabilityConfiguration ** - **IAM action:** [workmail:UpdateAvailabilityConfiguration](#list_workmail-action-UpdateAvailabilityConfiguration) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** UpdateDefaultMailDomain ** - **IAM action:** [workmail:UpdateDefaultMailDomain](#list_workmail-action-UpdateDefaultMailDomain) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** UpdateGroup ** - **IAM action:** [workmail:UpdateGroup](#list_workmail-action-UpdateGroup) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** UpdateImpersonationRole ** - **IAM action:** [workmail:UpdateImpersonationRole](#list_workmail-action-UpdateImpersonationRole) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** UpdateMailboxQuota ** - **IAM action:** [workmail:UpdateMailboxQuota](#list_workmail-action-UpdateMailboxQuota) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** UpdateMobileDeviceAccessRule ** - **IAM action:** [workmail:UpdateMobileDeviceAccessRule](#list_workmail-action-UpdateMobileDeviceAccessRule) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** UpdatePrimaryEmailAddress ** - **IAM action:** [workmail:UpdatePrimaryEmailAddress](#list_workmail-action-UpdatePrimaryEmailAddress) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** UpdateResource ** - **IAM action:** [workmail:UpdateResource](#list_workmail-action-UpdateResource) - **Condition key:** - **Possible value(s):** - **Access level:** Write - ** UpdateUser ** - **IAM action:** [workmail:UpdateUser](#list_workmail-action-UpdateUser) - **Condition key:** - **Possible value(s):** - **Access level:** Write ## Actions defined by Amazon WorkMail You can specify the following actions in the `Action` element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions. **** - ** [AssociateDelegateToResource](https://docs.aws.amazon.com/workmail/latest/APIReference/API_AssociateDelegateToResource.html) ** - **Description:** Grants permission to add a member (user or group) to the resource's set of delegates - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [AssociateMemberToGroup](https://docs.aws.amazon.com/workmail/latest/APIReference/API_AssociateMemberToGroup.html) ** - **Description:** Grants permission to add a member (user or group) to the group's set - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [AssumeImpersonationRole](https://docs.aws.amazon.com/workmail/latest/APIReference/API_AssumeImpersonationRole.html) ** - **Description:** Grants permission to assume an impersonation role for the given Amazon WorkMail organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_)
[workmail:ImpersonationRoleId](#list_workmail-workmail_ImpersonationRoleId) - **Access level:** Write - ** [CancelMailboxExportJob](https://docs.aws.amazon.com/workmail/latest/APIReference/API_CancelMailboxExportJob.html) ** - **Description:** Grants permission to cancel a currently running mailbox export job - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [CreateAlias](https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateAlias.html) ** - **Description:** Grants permission to add an alias to the set of a given member (user or group) of WorkMail - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [CreateAvailabilityConfiguration](https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateAvailabilityConfiguration.html) ** - **Description:** Grants permission to create an AvailabilityConfiguration for the given Amazon WorkMail organization and domain - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [CreateGroup](https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateGroup.html) ** - **Description:** Grants permission to create a group that can be used in WorkMail by calling the RegisterToWorkMail operation - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [CreateIdentityCenterApplication](https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateIdentityCenterApplication.html) ** - **Description:** Grants permission to create an Identity Center application for WorkMail - **Resource types (\*required):** - **Condition keys:** - **Access level:** Write - ** [CreateImpersonationRole](https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateImpersonationRole.html) ** - **Description:** Grants permission to create an impersonation role for the given Amazon WorkMail organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [CreateMobileDeviceAccessRule](https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateMobileDeviceAccessRule.html) ** - **Description:** Grants permission to create a new mobile device access rule - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [CreateOrganization](https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateOrganization.html) ** - **Description:** Grants permission to create a new Amazon WorkMail organization - **Resource types (\*required):** - **Condition keys:** - **Access level:** Write - ** [CreateResource](https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateResource.html) ** - **Description:** Grants permission to create a new WorkMail resource - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [CreateUser](https://docs.aws.amazon.com/workmail/latest/APIReference/API_CreateUser.html) ** - **Description:** Grants permission to create a user, which can be enabled afterwards by calling the RegisterToWorkMail operation - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteAccessControlRule](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteAccessControlRule.html) ** - **Description:** Grants permission to delete an access control rule - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteAlias](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteAlias.html) ** - **Description:** Grants permission to remove one or more specified aliases from a set of aliases for a given user - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteAvailabilityConfiguration](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteAvailabilityConfiguration.html) ** - **Description:** Grants permission to delete the AvailabilityConfiguration for the given Amazon WorkMail organization and domain - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteEmailMonitoringConfiguration](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteEmailMonitoringConfiguration.html) ** - **Description:** Grants permission to delete the email monitoring configuration for an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteGroup](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteGroup.html) ** - **Description:** Grants permission to delete a group from WorkMail - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteIdentityCenterApplication](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteIdentityCenterApplication.html) ** - **Description:** Grants permission to delete an Identity Center application for WorkMail - **Resource types (\*required):** - **Condition keys:** - **Access level:** Write - ** [DeleteIdentityProviderConfiguration](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteIdentityProviderConfiguration.html) ** - **Description:** Grants permission to delete the identity provider configuration for the organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteImpersonationRole](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteImpersonationRole.html) ** - **Description:** Grants permission to delete an impersonation role for the given Amazon WorkMail organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteMailboxPermissions](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteMailboxPermissions.html) ** - **Description:** Grants permission to delete permissions granted to a member (user or group) - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteMobileDeviceAccessOverride](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteMobileDeviceAccessOverride.html) ** - **Description:** Grants permission to delete a mobile device access override - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteMobileDeviceAccessRule](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteMobileDeviceAccessRule.html) ** - **Description:** Grants permission to delete a mobile device access rule - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteOrganization](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteOrganization.html) ** - **Description:** Grants permission to delete an Amazon WorkMail organization and all underlying AWS resources managed by Amazon WorkMail as part of the organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeletePersonalAccessToken](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeletePersonalAccessToken.html) ** - **Description:** Grants permission to delete a personal access token - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteResource](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteResource.html) ** - **Description:** Grants permission to delete the specified resource - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteRetentionPolicy](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteRetentionPolicy.html) ** - **Description:** Grants permission to delete the retention policy based on the supplied organization and policy identifiers - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteUser](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeleteUser.html) ** - **Description:** Grants permission to delete a user from WorkMail and all subsequent systems - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeregisterFromWorkMail](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeregisterFromWorkMail.html) ** - **Description:** Grants permission to mark a user, group, or resource as no longer used in WorkMail - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeregisterMailDomain](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DeregisterMailDomain.html) ** - **Description:** Grants permission to deregister a mail domain from an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DescribeEmailMonitoringConfiguration](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeEmailMonitoringConfiguration.html) ** - **Description:** Grants permission to retrieve the email monitoring configuration for an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [DescribeEntity](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeEntity.html) ** - **Description:** Grants permission to read details of an entity - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [DescribeGroup](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeGroup.html) ** - **Description:** Grants permission to read the details for a group - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [DescribeIdentityProviderConfiguration](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeIdentityProviderConfiguration.html) ** - **Description:** Grants permission to read the identity provider configuration for the organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [DescribeInboundDmarcSettings](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeInboundDmarcSettings.html) ** - **Description:** Grants permission to read the settings in a DMARC policy for a specified organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [DescribeMailboxExportJob](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeMailboxExportJob.html) ** - **Description:** Grants permission to retrieve details of a mailbox export job - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [DescribeOrganization](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeOrganization.html) ** - **Description:** Grants permission to read details of an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [DescribeResource](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeResource.html) ** - **Description:** Grants permission to read the details for a resource - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [DescribeUser](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DescribeUser.html) ** - **Description:** Grants permission to read details for a user - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [DisassociateDelegateFromResource](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DisassociateDelegateFromResource.html) ** - **Description:** Grants permission to remove a member from the resource's set of delegates - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DisassociateMemberFromGroup](https://docs.aws.amazon.com/workmail/latest/APIReference/API_DisassociateMemberFromGroup.html) ** - **Description:** Grants permission to remove a member from a group - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [GetAccessControlEffect](https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetAccessControlEffect.html) ** - **Description:** Grants permission to get the effects of access control rules as they apply to a specified IPv4 address, access protocol action, or user ID - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [GetDefaultRetentionPolicy](https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetDefaultRetentionPolicy.html) ** - **Description:** Grants permission to retrieve the retention policy associated at an organizational level - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [GetImpersonationRole](https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetImpersonationRole.html) ** - **Description:** Grants permission to retrieve an impersonation role for the given Amazon WorkMail organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [GetImpersonationRoleEffect](https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetImpersonationRoleEffect.html) ** - **Description:** Grants permission to get the effect of the rules associated to an impersonation role for a specific user - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [GetMailDomain](https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetMailDomain.html) ** - **Description:** Grants permission to retrieve details of a given mail domain in an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [GetMailboxDetails](https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetMailboxDetails.html) ** - **Description:** Grants permission to read the details of the user's mailbox - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [GetMobileDeviceAccessEffect](https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetMobileDeviceAccessEffect.html) ** - **Description:** Grants permission to simulate the effect of the mobile device access rules for the given attributes of a sample access event - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [GetMobileDeviceAccessOverride](https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetMobileDeviceAccessOverride.html) ** - **Description:** Grants permission to retrieve a mobile device access override - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [GetPersonalAccessTokenMetadata](https://docs.aws.amazon.com/workmail/latest/APIReference/API_GetPersonalAccessTokenMetadata.html) ** - **Description:** Grants permission to read metadata for a personal access token - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [ListAccessControlRules](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListAccessControlRules.html) ** - **Description:** Grants permission to list the access control rules - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [ListAliases](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListAliases.html) ** - **Description:** Grants permission to list the aliases associated with a given entity - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [ListAvailabilityConfigurations](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListAvailabilityConfigurations.html) ** - **Description:** Grants permission to list all the AvailabilityConfiguration's for the given Amazon WorkMail organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [ListGroupMembers](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListGroupMembers.html) ** - **Description:** Grants permission to read an overview of the members of a group. Users and groups can be members of a group - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [ListGroups](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListGroups.html) ** - **Description:** Grants permission to list summaries of the organization's groups - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [ListGroupsForEntity](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListGroupsForEntity.html) ** - **Description:** Grants permission to list the groups to which an entity belongs - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [ListImpersonationRoles](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListImpersonationRoles.html) ** - **Description:** Grants permission to list the impersonation roles for the given Amazon WorkMail organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [ListMailDomains](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListMailDomains.html) ** - **Description:** Grants permission to list the mail domains for a given organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [ListMailboxExportJobs](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListMailboxExportJobs.html) ** - **Description:** Grants permission to list mailbox export jobs - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [ListMailboxPermissions](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListMailboxPermissions.html) ** - **Description:** Grants permission to list the mailbox permissions associated with a user, group, or resource mailbox - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [ListMobileDeviceAccessOverrides](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListMobileDeviceAccessOverrides.html) ** - **Description:** Grants permission to list the mobile device access overrides - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [ListMobileDeviceAccessRules](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListMobileDeviceAccessRules.html) ** - **Description:** Grants permission to list the mobile device access rules - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [ListOrganizations](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListOrganizations.html) ** - **Description:** Grants permission to list the non-deleted organizations - **Resource types (\*required):** - **Condition keys:** - **Access level:** List - ** [ListPersonalAccessTokens](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListPersonalAccessTokens.html) ** - **Description:** Grants permission to list metadata for personal access tokens - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [ListResourceDelegates](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListResourceDelegates.html) ** - **Description:** Grants permission to list the delegates associated with a resource - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [ListResources](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListResources.html) ** - **Description:** Grants permission to list the organization's resources - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [ListTagsForResource](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListTagsForResource.html) ** - **Description:** Grants permission to list the tags applied to an Amazon WorkMail organization resource - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:RequestTag/${TagKey}](#list_workmail-aws_RequestTag___TagKey_)
[aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_)
[aws:TagKeys](#list_workmail-aws_TagKeys) - **Access level:** List - ** [ListUsers](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ListUsers.html) ** - **Description:** Grants permission to list the organization's users - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [PutAccessControlRule](https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutAccessControlRule.html) ** - **Description:** Grants permission to add a new access control rule - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [PutEmailMonitoringConfiguration](https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutEmailMonitoringConfiguration.html) ** - **Description:** Grants permission to add or update the email monitoring configuration for an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [PutIdentityProviderConfiguration](https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutIdentityProviderConfiguration.html) ** - **Description:** Grants permission to add or update the identity provider configuration for the organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [PutInboundDmarcSettings](https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutInboundDmarcSettings.html) ** - **Description:** Grants permission to enable or disable a DMARC policy for a given organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [PutMailboxPermissions](https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutMailboxPermissions.html) ** - **Description:** Grants permission to set permissions for a user, group, or resource, replacing any existing permissions - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [PutMobileDeviceAccessOverride](https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutMobileDeviceAccessOverride.html) ** - **Description:** Grants permission to add or update a mobile device access override - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [PutRetentionPolicy](https://docs.aws.amazon.com/workmail/latest/APIReference/API_PutRetentionPolicy.html) ** - **Description:** Grants permission to add or update the retention policy - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [RegisterMailDomain](https://docs.aws.amazon.com/workmail/latest/APIReference/API_RegisterMailDomain.html) ** - **Description:** Grants permission to register a new mail domain in an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [RegisterToWorkMail](https://docs.aws.amazon.com/workmail/latest/APIReference/API_RegisterToWorkMail.html) ** - **Description:** Grants permission to register an existing and disabled user, group, or resource for use by associating a mailbox and calendaring capabilities - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [ResetPassword](https://docs.aws.amazon.com/workmail/latest/APIReference/API_ResetPassword.html) ** - **Description:** Grants permission to allow the administrator to reset the password for a user - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [StartMailboxExportJob](https://docs.aws.amazon.com/workmail/latest/APIReference/API_StartMailboxExportJob.html) ** - **Description:** Grants permission to start a new mailbox export job - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [TagResource](https://docs.aws.amazon.com/workmail/latest/APIReference/API_TagResource.html) ** - **Description:** Grants permission to tag the specified Amazon WorkMail organization resource - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:RequestTag/${TagKey}](#list_workmail-aws_RequestTag___TagKey_)
[aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_)
[aws:TagKeys](#list_workmail-aws_TagKeys) - **Access level:** Tagging, Write - ** [TestAvailabilityConfiguration](https://docs.aws.amazon.com/workmail/latest/APIReference/API_TestAvailabilityConfiguration.html) ** - **Description:** Grants permission to performs a test on an availability provider to ensure that access is allowed - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [UntagResource](https://docs.aws.amazon.com/workmail/latest/APIReference/API_UntagResource.html) ** - **Description:** Grants permission to untag the specified Amazon WorkMail organization resource - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_)
[aws:TagKeys](#list_workmail-aws_TagKeys) - **Access level:** Tagging, Write - ** [UpdateAvailabilityConfiguration](https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateAvailabilityConfiguration.html) ** - **Description:** Grants permission to update an existing AvailabilityConfiguration for the given Amazon WorkMail organization and domain - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [UpdateDefaultMailDomain](https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateDefaultMailDomain.html) ** - **Description:** Grants permission to update which domain is the default domain for an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [UpdateGroup](https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateGroup.html) ** - **Description:** Grants permission to update details of a group - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [UpdateImpersonationRole](https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateImpersonationRole.html) ** - **Description:** Grants permission to update an existing impersonation role for the given Amazon WorkMail organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [UpdateMailboxQuota](https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateMailboxQuota.html) ** - **Description:** Grants permission to update the maximum size (in MB) of the user's mailbox - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [UpdateMobileDeviceAccessRule](https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateMobileDeviceAccessRule.html) ** - **Description:** Grants permission to update a mobile device access rule - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [UpdatePrimaryEmailAddress](https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdatePrimaryEmailAddress.html) ** - **Description:** Grants permission to update the primary email for a user, group, or resource - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [UpdateResource](https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateResource.html) ** - **Description:** Grants permission to update details for the resource - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [UpdateUser](https://docs.aws.amazon.com/workmail/latest/APIReference/API_UpdateUser.html) ** - **Description:** Grants permission to update details of a user - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write ## Permission-only actions for Amazon WorkMail The following actions are defined by Amazon WorkMail but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions. **** - ** [AllowVendedLogDeliveryForResource](https://docs.aws.amazon.com/workmail/latest/adminguide/audit-logging.html) ** - **Description:** Grants permission to configure vended log delivery for WorkMail audit logs - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [CreateInboundMailFlowRule](https://docs.aws.amazon.com/workmail/latest/adminguide/create-email-rules.html) ** - **Description:** Grants permission to create an inbound email flow rule which will apply to all email sent to an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [CreateMailDomain](https://docs.aws.amazon.com/workmail/latest/adminguide/add_domain.html) ** - **Description:** Grants permission to create a mail domain - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [CreateOutboundMailFlowRule](https://docs.aws.amazon.com/workmail/latest/adminguide/create-email-rules.html) ** - **Description:** Grants permission to create an outbound email flow rule which will apply to all email sent from an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [CreateSmtpGateway](https://docs.aws.amazon.com/workmail/latest/adminguide/smtp-gateway.html) ** - **Description:** Grants permission to register an SMTP gateway to a WorkMail organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteInboundMailFlowRule](https://docs.aws.amazon.com/workmail/latest/adminguide/remove-email-flow-rule.html) ** - **Description:** Grants permission to remove an inbound email flow rule to no longer apply to emails sent to an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteMailDomain](https://docs.aws.amazon.com/workmail/latest/adminguide/remove_domain.html) ** - **Description:** Grants permission to remove an unused mail domain from an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteMobileDevice](https://docs.aws.amazon.com/workmail/latest/adminguide/manage-devices.html#remove_mobile_device) ** - **Description:** Grants permission to remove a mobile device from a user - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteOutboundMailFlowRule](https://docs.aws.amazon.com/workmail/latest/adminguide/remove-email-flow-rule.html) ** - **Description:** Grants permission to remove an outbound email flow rule so that it no longer applies to emails sent from an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeleteSmtpGateway](https://docs.aws.amazon.com/workmail/latest/adminguide/smtp-gateway.html) ** - **Description:** Grants permission to remove an SMTP gateway from an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DeliverToMailbox](https://docs.aws.amazon.com/sesmailmanager/latest/APIReference/API_DeliverToMailboxAction.html) ** - **Description:** Grants permission to deliver emails to a WorkMail organization via the SES MailManager DeliverToMailbox action - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [DescribeInboundMailFlowRule](https://docs.aws.amazon.com/workmail/latest/adminguide/email-flows.html#email-flows-rule-actions) ** - **Description:** Grants permission to read the details of an inbound mail flow rule configured for an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [DescribeMailDomains](https://docs.aws.amazon.com/workmail/latest/adminguide/domains_overview.html) ** - **Description:** Grants permission to show the details of all mail domains associated with the organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [DescribeOutboundMailFlowRule](https://docs.aws.amazon.com/workmail/latest/adminguide/email-flows.html#email-flows-rule-outbound) ** - **Description:** Grants permission to read the details of an outbound mail flow rule configured for an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [DescribeSmtpGateway](https://docs.aws.amazon.com/workmail/latest/adminguide/smtp-gateway.html) ** - **Description:** Grants permission to read the details of an SMTP gateway registered to an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [EnableMailDomain](https://docs.aws.amazon.com/workmail/latest/adminguide/add_domain.html) ** - **Description:** Grants permission to enable a mail domain in the organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [GetJournalingRules](https://docs.aws.amazon.com/workmail/latest/adminguide/journaling_overview.html) ** - **Description:** Grants permission to read the configured journaling and fallback email addresses for email journaling - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [GetMailDomainDetails](https://docs.aws.amazon.com/workmail/latest/adminguide/domains_overview.html) ** - **Description:** Grants permission to get the details of the mail domain - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [GetMobileDeviceDetails](https://docs.aws.amazon.com/workmail/latest/adminguide/manage-devices.html) ** - **Description:** Grants permission to get the details of the mobile device - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [GetMobileDevicesForUser](https://docs.aws.amazon.com/workmail/latest/adminguide/manage-devices.html) ** - **Description:** Grants permission to get a list of the mobile devices associated with the user - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [GetMobilePolicyDetails](https://docs.aws.amazon.com/workmail/latest/adminguide/edit_organization_mobile_policy.html) ** - **Description:** Grants permission to get the details of the mobile device policy associated with the organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [ListInboundMailFlowRules](https://docs.aws.amazon.com/workmail/latest/adminguide/email-flows.html#email-flows-rule-actions) ** - **Description:** Grants permission to list inbound mail flow rules configured for an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [ListOutboundMailFlowRules](https://docs.aws.amazon.com/workmail/latest/adminguide/email-flows.html#email-flows-rule-outbound) ** - **Description:** Grants permission to list outbound mail flow rules configured for an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [ListSmtpGateways](https://docs.aws.amazon.com/workmail/latest/adminguide/smtp-gateway.html) ** - **Description:** Grants permission to list SMTP gateways registered to the organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** List - ** [SearchMembers](https://docs.aws.amazon.com/workmail/latest/adminguide/groups_overview.html) ** - **Description:** Grants permission to perform a prefix search to find a specific user in a mail group - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Read - ** [SetDefaultMailDomain](https://docs.aws.amazon.com/workmail/latest/adminguide/default_domain.html) ** - **Description:** Grants permission to set the default mail domain for the organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [SetJournalingRules](https://docs.aws.amazon.com/workmail/latest/adminguide/journaling_overview.html) ** - **Description:** Grants permission to set journaling and fallback email addresses for email journaling - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [SetMobilePolicyDetails](https://docs.aws.amazon.com/workmail/latest/adminguide/edit_organization_mobile_policy.html) ** - **Description:** Grants permission to set the details of a mobile policy associated with the organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [TestInboundMailFlowRules](https://docs.aws.amazon.com/workmail/latest/adminguide/test-email-flow-rule.html) ** - **Description:** Grants permission to test what inbound rules will apply to an email with a given sender and recipient - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [TestOutboundMailFlowRules](https://docs.aws.amazon.com/workmail/latest/adminguide/test-email-flow-rule.html) ** - **Description:** Grants permission to test what outbound rules will apply to an email with a given sender and recipient - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [UpdateInboundMailFlowRule](https://docs.aws.amazon.com/workmail/latest/adminguide/modify-email-flow-rule.html) ** - **Description:** Grants permission to update the details of an inbound email flow rule which will apply to all email sent to an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [UpdateOutboundMailFlowRule](https://docs.aws.amazon.com/workmail/latest/adminguide/modify-email-flow-rule.html) ** - **Description:** Grants permission to update the details of an outbound email flow rule which will apply to all email sent from an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [UpdateSmtpGateway](https://docs.aws.amazon.com/workmail/latest/adminguide/smtp-gateway.html) ** - **Description:** Grants permission to update the details of an existing SMTP gateway registered to an organization - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write - ** [WipeMobileDevice](https://docs.aws.amazon.com/workmail/latest/adminguide/manage-devices.html#remote_wipe_device) ** - **Description:** Grants permission to remotely wipe the mobile device associated with a user's account - **Resource types (\*required):** [organization\*](#list_workmail-resource-organization) - **Condition keys:** [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) - **Access level:** Write ## Resource types defined by Amazon WorkMail The following resource types are defined by this service and can be used in the `Resource` element of IAM permission policy statements. **** | Resource types | ARN | Condition keys | | --- | --- | --- | | [organization](https://docs.aws.amazon.com/workmail/latest/adminguide/organizations_overview.html) | arn:${Partition}:workmail:${Region}:${Account}:organization/${ResourceId} | [aws:ResourceTag/${TagKey}](#list_workmail-aws_ResourceTag___TagKey_) | ## Condition keys for Amazon WorkMail Amazon WorkMail defines the following condition keys that can be used in the `Condition` element of an IAM policy. **** | Condition keys | Description | Type | | --- | --- | --- | | [aws:RequestTag/${TagKey}](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-requesttag) | Filters access by the tag key-value pairs that are passed in the request | String | | [aws:ResourceTag/${TagKey}](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-resourcetag) | Filters access by the tag key-value pairs attached to the resource | String | | [aws:TagKeys](https://docs.aws.amazon.com/IAM/latest/UserGuide/reference_policies_condition-keys.html#condition-keys-tagkeys) | Filters access by the tag keys that are passed in the request | ArrayOfString | | [workmail:ImpersonationRoleId](https://docs.aws.amazon.com/IAM/latest/UserGuide/list_amazonworkmail.html#amazonworkmail-policy-keys) | Filters access by the ImpersonationRoleId that is passed in the request | String |