Policy actions Policy resources Policy condition keys Examples

Amazon IoT SiteWise identity-based policies

IAM policies let you control who can do what in Amazon IoT SiteWise. You can decide what actions are allowed or not and set specific conditions for these actions. For example, you can make rules about who can see or change information in Amazon IoT SiteWise. Amazon IoT SiteWise supports specific actions, resources, and condition keys. To learn about all of the elements that you use in a JSON policy, see IAM JSON policy elements reference in the IAM User Guide.

Policy actions

Administrators can use Amazon JSON policies to specify who has access to what. That is, which principal can perform actions on what resources, and under what conditions.

The Action element of a JSON policy describes the actions that you can use to allow or deny access in a policy. Policy actions usually have the same name as the associated Amazon API operation. There are some exceptions, such as permission-only actions that don't have a matching API operation. There are also some operations that require multiple actions in a policy. These additional actions are called dependent actions.

Include actions in a policy to grant permissions to perform the associated operation.

Policy actions in Amazon IoT SiteWise use the following prefix before the action: iotsitewise:. For example, to grant someone permission to upload asset property data to Amazon IoT SiteWise with the BatchPutAssetPropertyValue API operation, you include the iotsitewise:BatchPutAssetPropertyValue action in their policy. Policy statements must include either an Action or NotAction element. Amazon IoT SiteWise defines its own set of actions that describe tasks that you can perform with this service.

To specify multiple actions in a single statement, separate them with commas as follows.


"Action": [
  "iotsitewise:action1",
  "iotsitewise:action2"
]

You can specify multiple actions using wildcards (*). For example, to specify all actions that begin with the word Describe, include the following action.


"Action": "iotsitewise:Describe*"

To see a list of Amazon IoT SiteWise actions, see Actions Defined by Amazon IoT SiteWise in the IAM User Guide.

BatchPutAssetPropertyValue authorization

Amazon IoT SiteWise authorizes access to the BatchPutAssetPropertyValue action in an unusual way. For most actions, when you allow or deny access, that action returns an error if permissions aren't granted. With BatchPutAssetPropertyValue, you can send multiple data entries to different assets and asset properties in a single API request. Amazon IoT SiteWise authorizes each data entry independently. For any individual entry that fails authorization in the request, Amazon IoT SiteWise includes an AccessDeniedException in the returned list of errors. Amazon IoT SiteWise receives the data for any entry that authorizes and succeeds, even if another entry in the same request fails.

Important

Before you ingest data to a data stream, do the following:

Authorize the time-series resource if you use a property alias to identify the data stream.
Authorize the asset resource if you use an asset ID to identify the asset that contains the associated asset property.

Policy resources

Administrators can use Amazon JSON policies to specify who has access to what. That is, which principal can perform actions on what resources, and under what conditions.

The Resource JSON policy element specifies the object or objects to which the action applies. Statements must include either a Resource or a NotResource element. As a best practice, specify a resource using its Amazon Resource Name (ARN). You can do this for actions that support a specific resource type, known as resource-level permissions.

For actions that don't support resource-level permissions, such as listing operations, use a wildcard (*) to indicate that the statement applies to all resources.


"Resource": "*"

Each IAM policy statement applies to the resources that you specify using their ARNs. An ARN has the following general syntax.


arn:${Partition}:${Service}:${Region}:${Account}:${ResourceType}/${ResourcePath}

For more information about the format of ARNs, see Amazon Resource Names (ARNs) and Amazon service namespaces.

For example, to specify the asset with ID a1b2c3d4-5678-90ab-cdef-22222EXAMPLE in your statement, use the following ARN.;


"Resource": "arn:aws-cn:iotsitewise:region:123456789012:asset/a1b2c3d4-5678-90ab-cdef-22222EXAMPLE"

To specify all data streams that belong to a specific account, use the wildcard (*):


"Resource": "arn:aws-cn:iotsitewise:region:123456789012:time-series/*"

To specify all assets that belong to a specific account, use the wildcard (*):


"Resource": "arn:aws-cn:iotsitewise:region:123456789012:asset/*"

Some Amazon IoT SiteWise actions, such as those for creating resources, can't be performed on a specific resource. In those cases, you must use the wildcard (*).


"Resource": "*"

To specify multiple resources in a single statement, separate the ARNs with commas.


"Resource": [
  "resource1",
  "resource2"
]

To see a list of Amazon IoT SiteWise resource types and their ARNs, see Resources Defined by Amazon IoT SiteWise in the IAM User Guide. To learn with which actions you can specify the ARN of each resource, see Actions Defined by Amazon IoT SiteWise.

Policy condition keys

Administrators can use Amazon JSON policies to specify who has access to what. That is, which principal can perform actions on what resources, and under what conditions.

The Condition element (or Condition block) lets you specify conditions in which a statement is in effect. The Condition element is optional. You can create conditional expressions that use condition operators, such as equals or less than, to match the condition in the policy with values in the request.

If you specify multiple Condition elements in a statement, or multiple keys in a single Condition element, Amazon evaluates them using a logical AND operation. If you specify multiple values for a single condition key, Amazon evaluates the condition using a logical OR operation. All of the conditions must be met before the statement's permissions are granted.

You can also use placeholder variables when you specify conditions. For example, you can grant an IAM user permission to access a resource only if it is tagged with their IAM user name. For more information, see IAM policy elements: variables and tags in the IAM User Guide.

Amazon supports global condition keys and service-specific condition keys. To see all Amazon global condition keys, see Amazon global condition context keys in the IAM User Guide.

Important

Many condition keys are specific to a resource, and some API actions use multiple resources. If you write a policy statement with a condition key, use the Resource element of the statement to specify the resource to which the condition key applies. If you don't do so, the policy might prevent users from performing the action at all, because the condition check fails for the resources to which the condition key doesn't apply. If you don't want to specify a resource, or if you've written the Action element of your policy to include multiple API actions, then you must use the ...IfExists condition type to ensure that the condition key is ignored for resources that don't use it. For more information, see ...IfExists conditions in the IAM User Guide.

Amazon IoT SiteWise defines its own set of condition keys and also supports using some global condition keys. To see all Amazon global condition keys, see Amazon global condition context keys in the IAM User Guide.

Amazon IoT SiteWise condition keys
Condition key	Description	Types
`iotsitewise:isAssociatedWithAssetProperty`	Whether data streams are associated with an asset property. Use this condition key to define permissions based on the existence of an associated asset property for data streams. Example value: `true`	String
`iotsitewise:assetHierarchyPath`	The asset's hierarchy path, which is a string of asset IDs each separated by a forward slash. Use this condition key to define permissions based on a subset of your hierarchy of all assets in your account. Example value: `/a1b2c3d4-5678-90ab-cdef-22222EXAMPLE/a1b2c3d4-5678-90ab-cdef-66666EXAMPLE`	String
`iotsitewise:propertyId`	The ID of an asset property. Use this condition key to define permissions based on a specified property of an asset model. This condition key applies to all assets of that model. Example value: `a1b2c3d4-5678-90ab-cdef-33333EXAMPLE`	String
`iotsitewise:childAssetId`	The ID of an asset being associated as a child to another asset. Use this condition key to define permissions based on child assets. To define permissions based on parent assets, use the resource section of a policy statement. Example value: `a1b2c3d4-5678-90ab-cdef-66666EXAMPLE`	String
`iotsitewise:iam`	The ARN of an IAM identity when listing access policies. Use this condition key to define access policy permissions for an IAM identity. Example value: `arn:aws-cn:iam::123456789012:user/JohnDoe`	String, Null
`iotsitewise:propertyAlias`	The alias that identifies an asset property or data stream. Use this condition key to define permissions based on the alias.	String
`iotsitewise:user`	The ID of an IAM Identity Center user when listing access policies. Use this condition key to define access policy permissions for an IAM Identity Center user. Example value: `a1b2c3d4e5-a1b2c3d4-5678-90ab-cdef-aaaaaEXAMPLE`	String, Null
`iotsitewise:group`	The ID of an IAM Identity Center group when listing access policies. Use this condition key to define access policy permissions for an IAM Identity Center group. Example value: `a1b2c3d4e5-a1b2c3d4-5678-90ab-cdef-bbbbbEXAMPLE`	String, Null
`iotsitewise:portal`	The ID of a portal in an access policy. Use this condition key to define access policy permissions based on a portal. Example value: `a1b2c3d4-5678-90ab-cdef-77777EXAMPLE`	String, Null
`iotsitewise:project`	The ID of a project in an access policy, or the ID of a project for a dashboard. Use this condition key to define dashboard or access policy permissions based on a project. Example value: `a1b2c3d4-5678-90ab-cdef-88888EXAMPLE`	String, Null

To learn with which actions and resources you can use a condition key, see Actions Defined by Amazon IoT SiteWise.

Examples

To view examples of Amazon IoT SiteWise identity-based policies, see Amazon IoT SiteWise identity-based policy examples.

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Authorization based on tags

Identity-based policy examples