Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Amazon SWF IAM Policies

An IAM policy contains one or more Statement elements, each of which contains a set of elements that define the policy. For a complete list of elements and a general discussion of how to construct policies, see The Access Policy Language. Amazon SWF access control is based on the following elements:

The following section provides examples of how to construct Amazon SWF policies. For details, see String Conditions.

Writing policies for Amazon SWF

A workflow consists of multiple actors—activities, deciders, and so on. You can control access for each actor by attaching an appropriate IAM policy.

With the following action, the actor will be granted full account access across all regions:

You can use wildcards to have a single value represent multiple resources, actions, or regions.

For details on how to use wildcards, see Element Descriptions

Domain Permissions

To restrict a department's workflows to a particular domain, you could grant permission that allows an actor to call any action, but only for a specific department.

To gran an actor access to more than one domain, express permission for each domain as a list of Statements:

You can allow an actor to use any Amazon SWF action in the department1 and department2 domains. You can also sometimes use wildcards to represent multiple domains.

API Permissions and Constraints

You control which actions an actor can use by specifying the action in the Action element.

With the following action, an actor can only call StartWorkflowExecution to start workflows. It can't use any other actions.

Conditions

You can optionally constrain the action's allowable parameter values by using a Condition element.

To restrict which workflows an actor can start, constrain one or more of the StartWorkflowExecution parameter values, as follows:

"Condition" : {
   "StringEquals" : { 
      "swf:workflowType.name" : "workflow1",
      "swf:workflowType.version" : "version2" 
    }
}

An actor with the previous constraints can run only version2 of workflow1 and both parameters must be included in the request.

You can constrain a parameter without requiring it to be included in a request by using a StringEqualsIfExists operator, as follows:

"Condition" : {
   "StringEqualsIfExists" : { "swf:taskList.name" : "task_list_name" }
}

An actor with the previous policy can optionally specify a task list when starting a workflow execution.

You can constrain a list of tags for some actions. Each tag has a separate key, so you use swf:tagList.member.0 to constrain the first tag in the list, swf:tagList.member.1 to constrain the second tag in the list, and so on, up to a maximum of 5.

You must be careful how you constrain tag lists. For instance, the following condition is not recommended.

The following Condition is not recommended because it allows you to optionally specify either some_ok_tag or another_ok_tag. However, the Condition constrains only the first element of the tag list. The list could have additional elements with arbitrary values that would all be allowed because the condition doesn't apply any conditions to swf:tagList.member.1, swf:tagList.member.2, and so on.

// Example to illustrate an insecure Condition
"Condition" : {
   "StringEqualsIfExists" : {
      "swf:tagList.member.0" : "some_ok_tag", "another_ok_tag"
   }
}

One way to address the previous issue is to disallow the use of tag lists.

The following policy ensures that only some_ok_tag or another_ok_tag are allowed by requiring the list to have only one element.

"Condition" : {
   "StringEqualsIfExists" : {
      "swf:tagList.member.0" : "some_ok_tag", "another_ok_tag"
    },
    "Null" : { "swf:tagList.member.1" : "true" }
}          

Pseudo API Permissions and Constraints

To restrict the decisions available to RespondDecisionTaskCompleted, you must first allow the actor to call RespondDecisionTaskCompleted. You then express permissions for the appropriate pseudo API members using the same syntax as for the regular API, as follows:

The first Statement allows the actor to call RespondDecisionTaskCompleted. The second statement allows the actor to use the ScheduleActivityTask decision to direct Amazon SWF to schedule an activity task. To allow all decisions, replace "swf:ScheduleActivityTask" with "swf:*".

You can use Condition operators to constrain parameters just as with the regular API. The StringEquals operator in the previous example Condition allows RespondDecisionTaskCompleted to schedule an activity task for the SomeActivityType activity, and it must schedule that task. If you want to allow RespondDecisionTaskCompleted to use a parameter value but not require it to do so, you can instead use the StringEqualsIfExists operator.

Amazon managed policy: SimpleWorkflowFullAccess

You can attach the SimpleWorkflowFullAccess policy to your IAM identities.

This policy provides full access to the Amazon SWF configuration service.

Service Model Limitations on IAM Policies

You must consider service model constraints when creating IAM policies. It is possible to create a syntactically valid IAM policy that represents an invalid Amazon SWF request; a request that is allowed in terms of access control can still fail because it is an invalid request.

For example, the Amazon SWF service model does not allow the typeFilter and tagFilter parameters to be used in the same ListOpenWorkflowExecutions request. The following condition would allow calls that the service will reject—by throwing ValidationException—as an invalid request:

"Condition" : {
   "StringEquals" : { 
      "swf:typeFilter.name" : "workflow_name",
      "swf:typeFilter.version" : "workflow_version",
      "swf:tagFilter.tag" : "some_tag" 
    }
}