Authorizing users and cloud services to use Amazon IoT Jobs

The following table shows a list of IAM policy actions and permissions to use the API actions. For information about resource types, see Resource types defined by Amazon IoT. For more information about Amazon IoT actions, see Actions defined by Amazon IoT.

The following example shows an IAM policy that allows the user permission to perform the following actions for your IoT thing and thing group.

In the example, replace:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": [
                "iot:CreateJobTemplate",
                "iot:CreateJob",
                ],
            "Effect": "Allow",
            "Resource": "arn:aws:iot:region:account-id:thinggroup/thing-group-name"
        },
        {
            "Action": [
                "iot:DescribeJob",
                "iot:CancelJob",
                "iot:DeleteJob",
            ],
            "Effect": "Allow",
            "Resource": "arn:aws:iot:region:account-id:job/*"
        },
        {
            "Action": [
                "iot:DescribeJobExecution",
                "iot:CancelJobExecution",
                "iot:DeleteJobExecution",
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:iot:region:account-id:thing/thing-name"
                "arn:aws:iot:region:account-id:job/*"
            ]
        }
    ]
}

You can restrict principals from making API calls to your control plane endpoint from specific IP addresses. To specify the IP addresses that can be allowed, in the Condition element of your IAM policy, use the aws:SourceIp global condition key.

Using this condition key can also deny access to other Amazon Web Services from making these API calls on your behalf, such as Amazon CloudFormation. To allow access to these services, use the aws:ViaAWSService global condition key with the aws:SourceIp key. This makes sure that the source IP address access restriction applies only to requests that are made directly by a principal. For more information, see Amazon: Denies access to Amazon based on the source IP.

The following example shows how to allow only a specific IP address that can make API calls to the control plane endpoint. The aws:ViaAWSService key is set to true, which allows other services to make API calls on your behalf.

{            
   "Version": "2012-10-17",
   "Statement": [
       {
            "Effect": "Allow",
            "Action": [
                "iot:CreateJobTemplate",
                "iot:CreateJob"
             ],
            "Resource": ["*"],
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "123.45.167.89"
                }
            },            
            "Bool": {"aws:ViaAWSService": "true"}
        }
    ],
}           

The API operations that must be authorized are usually performed by you typing CLI commands. The following shows an example of a user performing a DescribeJobExecution operation.

In the example, replace:

aws iot-jobs-data describe-job-execution \ 
    --endpoint-url "https://account-id.jobs.iot.region.amazonaws.com" \ 
    --job-id jobID --thing-name thing-name
            

The following shows a sample IAM policy that authorizes this action:

{
    "Version": "2012-10-17",
    "Statement": 
    {
        "Action": ["iotjobsdata:DescribeJobExecution"],
        "Effect": "Allow",
        "Resource": "arn:aws:iot:region:account-id:thing/thing-name",
    }
   }

You can restrict principals from making API calls to your data plane endpoint from specific IP addresses. To specify the IP addresses that can be allowed, in the Condition element of your IAM policy, use the aws:SourceIp global condition key.

Using this condition key can also deny access to other Amazon Web Services from making these API calls on your behalf, such as Amazon CloudFormation. To allow access to these services, use the aws:ViaAWSService global condition key with the aws:SourceIp condition key. This makes sure that the IP address access restriction only applies to requests that are directly made by the principal. For more information, see Amazon: Denies access to Amazon based on the source IP.

The following example shows how to allow only a specific IP address that can make API calls to the data plane endpoint.

{            
   "Version": "2012-10-17",
   "Statement": [
       {
            "Effect": "Allow",
            "Action": ["iotjobsdata:*"],
            "Resource": ["*"],
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": "123.45.167.89"
                }
            },            
            "Bool": {"aws:ViaAWSService": "false"}
        }
    ],
}           

The following example shows how to restrict specific IP addresses or address ranges from making API calls to the data plane endpoint.

{            
   "Version": "2012-10-17",
   "Statement": [
       {
            "Effect": "Deny",
            "Action": ["iotjobsdata:*"],
            "Condition": {
                "IpAddress": {
                    "aws:SourceIp": [
                        "123.45.167.89",
                        "192.0.2.0/24", 
                        "203.0.113.0/24"                        
                    ]
                }
            },
            "Resource": ["*"],
        }
    ],
}

If you perform an API operation on both the control plane and data plane, your control plane policy action must use the iot: prefix, and your data plane policy action must use the iotjobsdata: prefix.

For example, the DescribeJobExecution API can be used in both the control plane and data plane. On the control plane, the DescribeJobExecution API is used to describe a job execution. On the data plane, the DescribeJobExecution API is used to get details of a job execution.

The following IAM policy authorizes a user permission to use the DescribeJobExecution API on both the control plane and data plane.

In the example, replace:

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Action": ["iotjobsdata:DescribeJobExecution"],
            "Effect": "Allow",
            "Resource": "arn:aws:iot:region:account-id:thing/thing-name"
        },
        {
            "Action": [
                "iot:DescribeJobExecution",
                "iot:CancelJobExecution",
                "iot:DeleteJobExecution",
            ],
            "Effect": "Allow",
            "Resource": [
                "arn:aws:iot:region:account-id:thing/thing-name"
                "arn:aws:iot:region:account-id:job/*"
            ]
        }
    ]            
}

Refer to the following IAM policy examples granting tagging permissions:

Example 1

A user that runs the following command to create a job and tag it to a specific environment.

In this example, replace:

aws iot create-job 
    --job-id test_job 
    --targets "arn:aws:iot:region:account-id:thing/thingOne"
    --document-source "https://s3.amazonaws.com/my-s3-bucket/job-document.json"
    --description "test job description" 
    --tags Key=environment,Value=beta

For this example, you must use the following IAM policy:

{
    "Version": "2012-10-17",
    "Statement": 
    {
        "Action": [ "iot:CreateJob", "iot:CreateJobTemplate", "iot:TagResource" ],
        "Effect": "Allow",
        "Resource": [
            "arn:aws:iot:aws-region:account-id:job/*",
            "arn:aws:iot:aws-region:account-id:jobtemplate/*"
        ]
    }
}