Access management for Amazon DataSync - Amazon DataSync
DataSync resources and operationsUnderstanding resource ownershipManaging access to resourcesSpecifying policy elements: Actions, effects, resources, and principalsSpecifying conditions in a policy
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Access management for Amazon DataSync

Every Amazon resource is owned by an Amazon Web Services account. Permissions to create or access a resource are governed by permissions policies. An account administrator can attach permissions policies to Amazon Identity and Access Management (IAM) identities. Some services (such as Amazon Lambda) also support attaching permissions policies to resources.

Note

An account administrator is a user with administrator privileges in an Amazon Web Services account. For more information, see IAM best practices in the IAM User Guide.

DataSync resources and operations

In DataSync, the primary resources are agent, location, task, and task execution.

These resources have unique Amazon Resource Names (ARNs) associated with them, as shown in the following table.

Resource type ARN format

Agent ARN

arn:aws-cn:datasync:region:account-id:agent/agent-id
Location ARN

arn:aws-cn:datasync:region:account-id:location/location-id
Task ARN

arn:aws-cn:datasync:region:account-id:task/task-id

Task execution ARN

arn:aws-cn:datasync:region:account-id:task/task-id/execution/exec-id

To grant permissions for specific API operations, such as creating a task, DataSync defines a set of actions that you can specify in a permissions policy. An API operation can require permissions for more than one action. For a list of all the DataSync API actions and the resources that they apply to, see DataSync API permissions: Actions and resources.

Understanding resource ownership

A resource owner is the Amazon Web Services account that created the resource. That is, the resource owner is the Amazon Web Services account of the principal entity (for example, an IAM role) which authenticates the request that creates the resource. The following examples illustrate how this behavior works:

  • If you use the root account credentials of your Amazon Web Services account to create a task, your Amazon Web Services account is the owner of the resource (in DataSync, the resource is the task).

  • If you create an IAM roles in your Amazon Web Services account and grant permissions to the CreateTask action to that user, the user can create a task. However, your Amazon Web Services account, to which the user belongs, owns the task resource.

  • If you create an IAM role in your Amazon Web Services account with permissions to create a task, anyone who can assume the role can create a task. Your Amazon Web Services account, to which the role belongs, owns the task resource.

Managing access to resources

A permissions policy describes who has access to what. The following section explains the available options for creating permissions policies.

Note

This section discusses using IAM in the context of DataSync. It doesn't provide detailed information about the IAM service. For complete IAM documentation, see What is IAM? in the IAM User Guide. For information about IAM policy syntax and descriptions, see Amazon Identity and Access Management policy reference in the IAM User Guide.

Policies attached to an IAM identity are referred to as identity-based policies (IAM policies) and policies attached to a resource are referred to as resource-based policies. DataSync supports only identity-based policies (IAM policies).

Identity-based policies

You can manage DataSync resource access with IAM policies. These policies can help an Amazon Web Services account administrator do the following with DataSync:

  • Grant permissions to create and manage DataSync resources – Create an IAM policy that allows an IAM role in your Amazon Web Services account to create and manage DataSync resources, such as agents, locations, and tasks.

The following example policy grants permissions to all List* actions on all resources. This action is a read-only action and doesn't allow resource modification.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAllListActionsOnAllResources",
            "Effect": "Allow",
            "Action": [
                "datasync:List*"
            ],
            "Resource": "*"
        }
    ]
}

For more information about using identity-based policies with DataSync, see Amazon managed policies and customer managed policies. For more information about IAM identities, see the IAM User Guide .

Resource-based policies

Other services, such as Amazon S3, support resource-based permissions policies. For example, you can attach a policy to an Amazon S3 bucket to manage access permissions to that bucket. However, DataSync doesn't support resource-based policies.

Specifying policy elements: Actions, effects, resources, and principals

For each DataSync resource (see DataSync API permissions: Actions and resources), the service defines a set of API operations (see Actions). To grant permissions for these API operations, DataSync defines a set of actions that you can specify in a policy. For example, for the DataSync resource, the following actions are defined: CreateTask, DeleteTask, and DescribeTask. Performing an API operation can require permissions for more than one action.

The following are the most basic policy elements:

  • Resource – In a policy, you use an Amazon Resource Name (ARN) to identify the resource to which the policy applies. For DataSync resources, you can use the wildcard character (*) in IAM policies. For more information, see DataSync resources and operations.

  • Action – You use action keywords to identify resource operations that you want to allow or deny. For example, depending on the specified Effect element, the datasync:CreateTask permission allows or denies the user permissions to perform the DataSync CreateTask operation.

  • Effect – You specify the effect when the user requests the specific action—this effect can be either Allow or Deny. If you don't explicitly grant access to (Allow) a resource, access is implicitly denied. You can also explicitly deny access to a resource, which you might do to make sure that a user cannot access it, even if a different policy grants that user access. For more information, see Authorization in the IAM User Guide.

  • Principal – In identity-based policies (IAM policies), the user that the policy is attached to is the implicit principal. For resource-based policies, you specify the user, account, service, or other entity that you want to receive permissions (applies to resource-based policies only). DataSync doesn't support resource-based policies.

To learn more about IAM policy syntax and descriptions, see Amazon Identity and Access Management policy reference in the IAM User Guide.

For a table showing all of the DataSync API actions, see DataSync API permissions: Actions and resources.

Specifying conditions in a policy

When you grant permissions, you can use the IAM policy language to specify the conditions when a policy should take effect when granting permissions. For example, you might want a policy to be applied only after a specific date. For more information about specifying conditions in policy language, see Condition in the IAM User Guide.

To express conditions, you use predefined condition keys. There are no condition keys specific to DataSync. However, there are Amazon wide condition keys that you can use as appropriate. For a complete list of Amazon wide keys, see Available keys in the IAM User Guide.