DataSync API permissions: Actions and resources
When creating Amazon Identity and Access Management (IAM) policies, this page can help you understand the relationship between Amazon DataSync API operations, the corresponding actions that you can grant permissions to perform, and the Amazon resources for which you can grant the permissions.
In general, here's how you add DataSync permissions to your policy:
-
Specify an action in the
Action
element. The value includes adatasync:
prefix and the API operation name. For example,datasync:CreateTask
. -
Specify an Amazon resource related to the action in the
Resource
element.
You can also use Amazon condition keys in your DataSync policies. For a complete list of Amazon keys, see Available keys in the IAM User Guide.
For a list of DataSync resources and their Amazon Resource Name (ARN) formats, see DataSync resources and operations.
DataSync API operations and corresponding actions
- CancelTaskExecution
-
Action:
datasync:CancelTaskExecution
Resource:
arn:aws-cn:datasync:
region
:account-id
:task/task-id
/execution/exec-id
- CreateAgent
-
Action:
datasync:CreateAgent
Resource: None
- CreateLocationEfs
-
Action:
datasync:CreateLocationEfs
Resource: None
- CreateLocationFsxLustre
-
Action:
datasync:CreateLocationFsxLustre
Resource: None
- CreateLocationFsxOntap
-
Action:
datasync:CreateLocationFsxOntap
Resource: None
- CreateLocationFsxOpenZfs
-
Action:
datasync:CreateLocationFsxOpenZfs
Resource: None
- CreateLocationFsxWindows
-
Action:
datasync:CreateLocationFsxWindows
Resource: None
- CreateLocationHdfs
-
Action:
dataSync:CreateLocationHdfs
Resource:
arn:aws-cn:datasync:
region
:account-id
:agent/agent-id
- CreateLocationNfs
-
Action:
datasync:CreateLocationNfs
Resource:
arn:aws-cn:datasync:
region
:account-id
:agent/agent-id
- CreateLocationObjectStorage
-
Action:
dataSync:CreateLocationObjectStorage
Resource:
arn:aws-cn:datasync:
region
:account-id
:agent/agent-id
- CreateLocationS3
-
Action:
datasync:CreateLocationS3
Resource:
arn:aws-cn:datasync:
(only for Amazon S3 on Outposts)region
:account-id
:agent/agent-id
- CreateLocationSmb
-
Action:
datasync:CreateLocationSmb
Resource:
arn:aws-cn:datasync:
region
:account-id
:agent/agent-id
- CreateTask
-
Action:
datasync:CreateTask
Resources:
-
arn:aws-cn:datasync:
region
:account-id
:location/source-location-id
-
arn:aws-cn:datasync:
region
:account-id
:location/destination-location-id
-
- DeleteAgent
-
Action:
datasync:DeleteAgent
Resource:
arn:aws-cn:datasync:
region
:account-id
:agent/agent-id
- DeleteLocation
-
Action:
datasync:DeleteLocation
Resource:
arn:aws-cn:datasync:
region
:account-id
:location/location-id
- DeleteTask
-
Action:
datasync:DeleteTask
Resource:
arn:aws-cn:datasync:
region
:account-id
:task/task-id
- DescribeAgent
-
Action:
datasync:DescribeAgent
Resource:
arn:aws-cn:datasync:
region
:account-id
:agent/agent-id
- DescribeLocationEfs
-
Action:
datasync:DescribeLocationEfs
Resource:
arn:aws-cn:datasync:
region
:account-id
:location/location-id
- DescribeLocationFsxLustre
-
Action:
datasync:DescribeLocationFsxLustre
Resource:
arn:aws-cn:datasync:
region
:account-id
:location/location-id
- DescribeLocationFsxOntap
-
Action:
datasync:DescribeLocationFsxOntap
Resource:
arn:aws-cn:datasync:
region
:account-id
:location/location-id
- DescribeLocationFsxOpenZfs
-
Action:
datasync:DescribeLocationFsxOpenZfs
Resource:
arn:aws-cn:datasync:
region
:account-id
:location/location-id
- DescribeLocationFsxWindows
-
Action:
datasync:DescribeLocationFsxWindows
Resource:
arn:aws-cn:datasync:
region
:account-id
:location/location-id
- DescribeLocationHdfs
-
Action:
datasync:DescribeLocationHdfs
Resource:
arn:aws-cn:datasync:
region
:account-id
:location/location-id
- DescribeLocationNfs
-
Action:
datasync:DescribeLocationNfs
Resource:
arn:aws-cn:datasync:
region
:account-id
:location/location-id
- DescribeLocationObjectStorage
-
Action:
datasync:DescribeLocationObjectStorage
Resource:
arn:aws-cn:datasync:
region
:account-id
:location/location-id
- DescribeLocationS3
-
Action:
datasync:DescribeLocationS3
Resource:
arn:aws-cn:datasync:
region
:account-id
:location/location-id
- DescribeLocationSmb
-
Action:
datasync:DescribeLocationSmb
Resource:
arn:aws-cn:datasync:
region
:account-id
:location/location-id
- DescribeTask
-
Action:
datasync:DescribeTask
Resource:
arn:aws-cn:datasync:
region
:account-id
:task/task-id
- DescribeTaskExecution
-
Action:
datasync:DescribeTaskExecution
Resource:
arn:aws-cn:datasync:
region
:account-id
:task/task-id
/execution/exec-id
- ListAgents
-
Action:
datasync:ListAgents
Resource: None
- ListLocations
-
Action:
datasync:ListLocations
Resource: None
- ListTagsForResource
-
Action:
datasync:ListTagsForResource
Resources:
-
arn:aws-cn:datasync:
region
:account-id
:agent/agent-id
-
arn:aws-cn:datasync:
region
:account-id
:task/task-id
-
arn:aws-cn:datasync:
region
:account-id
:location/location-id
-
- ListTaskExecutions
-
Action:
datasync:ListTaskExecutions
Resource:
arn:aws-cn:datasync:
region
:account-id
:task/task-id
- ListTasks
-
Action:
datasync:ListTasks
Resource: None
- StartTaskExecution
-
Action:
datasync:StartTaskExecution
Resource:
arn:aws-cn:datasync:
region
:account-id
:task/task-id
- TagResource
-
Action:
datasync:TagResource
Resources:
-
arn:aws-cn:datasync:
region
:account-id
:agent/agent-id
-
arn:aws-cn:datasync:
region
:account-id
:task/task-id
-
arn:aws-cn:datasync:
region
:account-id
:location/location-id
-
- UntagResource
-
Action:
datasync:UntagResource
Resources:
-
arn:aws-cn:datasync:
region
:account-id
:agent/agent-id
-
arn:aws-cn:datasync:
region
:account-id
:task/task-id
-
arn:aws-cn:datasync:
region
:account-id
:location/location-id
-
- UpdateAgent
-
Action:
datasync:UpdateAgent
Resource:
arn:aws-cn:datasync:
region
:account-id
:agent/agent-id
- UpdateLocationHdfs
-
Action:
datasync:UpdateLocationHdfs
Resources:
-
arn:aws-cn:datasync:
region
:account-id
:agent/agent-id
-
arn:aws-cn:datasync:
region
:account-id
:location/location-id
-
- UpdateLocationNfs
-
Action:
datasync:UpdateLocationNfs
Resource:
arn:aws-cn:datasync:
region
:account-id
:location/location-id
- UpdateLocationObjectStorage
-
Action:
datasync:UpdateLocationObjectStorage
Resources:
-
arn:aws-cn:datasync:
region
:account-id
:agent/agent-id
-
arn:aws-cn:datasync:
region
:account-id
:location/location-id
-
- UpdateLocationSmb
-
Action:
datasync:UpdateLocationSmb
Resources:
-
arn:aws-cn:datasync:
region
:account-id
:agent/agent-id
-
arn:aws-cn:datasync:
region
:account-id
:location/location-id
-
- UpdateTask
-
Action:
datasync:UpdateTask
Resource:
arn:aws-cn:datasync:
region
:account-id
:task/task-id
- UpdateTaskExecution
-
Action:
datasync:UpdateTaskExecution
Resource:
arn:aws-cn:datasync:
region
:account-id
:task/task-id
/execution/exec-id