Actions, resources, and condition keys for Amazon GameLift - Service Authorization Reference
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China.

Actions, resources, and condition keys for Amazon GameLift

Amazon GameLift (service prefix: gamelift) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Actions defined by Amazon GameLift

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. Required resources are indicated in the table with an asterisk (*). If you specify a resource-level permission ARN in a statement using this action, then it must be of this type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one but not the other.

For details about the columns in the following table, see Actions table.

Actions Description Access level Resource types (*required) Condition keys Dependent actions
AcceptMatch Grants permission to register player acceptance or rejection of a proposed FlexMatch match Write
ClaimGameServer Grants permission to locate and reserve a game server to host a new game session Write

gameServerGroup*

CreateAlias Grants permission to define a new alias for a fleet Write

aws:RequestTag/${TagKey}

aws:TagKeys

CreateBuild Grants permission to create a new game build using files stored in an Amazon S3 bucket Write

aws:RequestTag/${TagKey}

aws:TagKeys

CreateFleet Grants permission to create a new fleet of computing resources to run your game servers Write

aws:RequestTag/${TagKey}

aws:TagKeys

CreateFleetLocations Grants permission to specify additional locations for a fleet Write

fleet*

CreateGameServerGroup Grants permission to create a new game server group, set up a corresponding Auto Scaling group, and launche instances to host game servers Write

aws:RequestTag/${TagKey}

aws:TagKeys

CreateGameSession Grants permission to start a new game session on a specified fleet Write
CreateGameSessionQueue Grants permission to set up a new queue for processing game session placement requests Write

aws:RequestTag/${TagKey}

aws:TagKeys

CreateLocation Grants permission to define a new location for a fleet Write

aws:RequestTag/${TagKey}

aws:TagKeys

CreateMatchmakingConfiguration Grants permission to create a new FlexMatch matchmaker Write

aws:RequestTag/${TagKey}

aws:TagKeys

CreateMatchmakingRuleSet Grants permission to create a new matchmaking rule set for FlexMatch Write

aws:RequestTag/${TagKey}

aws:TagKeys

CreatePlayerSession Grants permission to reserve an available game session slot for a player Write
CreatePlayerSessions Grants permission to reserve available game session slots for multiple players Write
CreateScript Grants permission to create a new Realtime Servers script Write

aws:RequestTag/${TagKey}

aws:TagKeys

CreateVpcPeeringAuthorization Grants permission to allow GameLift to create or delete a peering connection between a GameLift fleet VPC and a VPC on another Amazon Web Services account Write
CreateVpcPeeringConnection Grants permission to establish a peering connection between your GameLift fleet VPC and a VPC on another account Write
DeleteAlias Grants permission to delete an alias Write

alias*

DeleteBuild Grants permission to delete a game build Write

build*

DeleteFleet Grants permission to delete an empty fleet Write

fleet*

DeleteFleetLocations Grants permission to delete locations for a fleet Write

fleet*

DeleteGameServerGroup Grants permission to permanently delete a game server group and terminate FleetIQ activity for the corresponding Auto Scaling group Write

gameServerGroup*

DeleteGameSessionQueue Grants permission to delete an existing game session queue Write

gameSessionQueue*

DeleteLocation Grants permission to delete a location Write

location*

DeleteMatchmakingConfiguration Grants permission to delete an existing FlexMatch matchmaker Write

matchmakingConfiguration*

DeleteMatchmakingRuleSet Grants permission to delete an existing FlexMatch matchmaking rule set Write

matchmakingRuleSet*

DeleteScalingPolicy Grants permission to delete a set of auto-scaling rules Write

fleet*

DeleteScript Grants permission to delete a Realtime Servers script Write

script*

DeleteVpcPeeringAuthorization Grants permission to cancel a VPC peering authorization Write
DeleteVpcPeeringConnection Grants permission to remove a peering connection between VPCs Write
DeregisterCompute Grants permission to deregister a compute against a fleet Write

fleet*

DeregisterGameServer Grants permission to remove a game server from a game server group Write

gameServerGroup*

DescribeAlias Grants permission to retrieve properties for an alias Read

alias*

DescribeBuild Grants permission to retrieve properties for a game build Read

build*

DescribeCompute Grants permission to retrieve general properties of the compute such as ARN, fleet details, SDK endpoints, and location Read

fleet*

DescribeEC2InstanceLimits Grants permission to retrieve the maximum allowed and current usage for EC2 instance types Read
DescribeFleetAttributes Grants permission to retrieve general properties, including status, for fleets Read
DescribeFleetCapacity Grants permission to retrieve the current capacity setting for fleets Read
DescribeFleetEvents Grants permission to retrieve entries from a fleet's event log Read

fleet*

DescribeFleetLocationAttributes Grants permission to retrieve general properties, including statuses, for a fleet's locations Read

fleet*

DescribeFleetLocationCapacity Grants permission to retrieve the current capacity setting for a fleet's location Read

fleet*

DescribeFleetLocationUtilization Grants permission to retrieve utilization statistics for fleet's location Read

fleet*

DescribeFleetPortSettings Grants permission to retrieve the inbound connection permissions for a fleet Read

fleet*

DescribeFleetUtilization Grants permission to retrieve utilization statistics for fleets Read
DescribeGameServer Grants permission to retrieve properties for a game server Read

gameServerGroup*

DescribeGameServerGroup Grants permission to retrieve properties for a game server group Read

gameServerGroup*

DescribeGameServerInstances Grants permission to retrieve the status of EC2 instances in a game server group Read

gameServerGroup*

DescribeGameSessionDetails Grants permission to retrieve properties for game sessions in a fleet, including the protection policy Read
DescribeGameSessionPlacement Grants permission to retrieve details of a game session placement request Read
DescribeGameSessionQueues Grants permission to retrieve properties for game session queues Read
DescribeGameSessions Grants permission to retrieve properties for game sessions in a fleet Read
DescribeInstances Grants permission to retrieve information about instances in a fleet Read

fleet*

DescribeMatchmaking Grants permission to retrieve details of matchmaking tickets Read
DescribeMatchmakingConfigurations Grants permission to retrieve properties for FlexMatch matchmakers Read
DescribeMatchmakingRuleSets Grants permission to retrieve properties for FlexMatch matchmaking rule sets Read
DescribePlayerSessions Grants permission to retrieve properties for player sessions in a game session Read
DescribeRuntimeConfiguration Grants permission to retrieve the current runtime configuration for a fleet Read

fleet*

DescribeScalingPolicies Grants permission to retrieve all scaling policies that are applied to a fleet Read

fleet*

DescribeScript Grants permission to retrieve properties for a Realtime Servers script Read

script*

DescribeVpcPeeringAuthorizations Grants permission to retrieve valid VPC peering authorizations Read
DescribeVpcPeeringConnections Grants permission to retrieve details on active or pending VPC peering connections Read
GetComputeAccess Grants permission to retrieve access credentials of the compute Read

fleet*

GetComputeAuthToken Grants permission to retrieve an authorization token for a compute and fleet to use in game server processes Read

fleet*

GetGameSessionLogUrl Grants permission to retrieve the location of stored logs for a game session Read
GetInstanceAccess Grants permission to request remote access to a specified fleet instance Read

fleet*

ListAliases Grants permission to retrieve all aliases that are defined in the current Region List
ListBuilds Grants permission to retrieve all game build in the current Region List
ListCompute Grants permission to retrieve all compute resources in the current Region List

fleet*

ListFleets Grants permission to retrieve a list of fleet IDs for all fleets in the current Region List
ListGameServerGroups Grants permission to retrieve all game server groups that are defined in the current Region List
ListGameServers Grants permission to retrieve all game servers that are currently running in a game server group List

gameServerGroup*

ListLocations Grants permission to retrieve all locations in this account List
ListScripts Grants permission to retrieve properties for all Realtime Servers scripts in the current region List
ListTagsForResource Grants permission to retrieve tags for GameLift resources Read

alias

build

fleet

gameServerGroup

gameSessionQueue

location

matchmakingConfiguration

matchmakingRuleSet

script

PutScalingPolicy Grants permission to create or update a fleet auto-scaling policy Write

fleet*

RegisterCompute Grants permission to register a compute against a fleet Write

fleet*

RegisterGameServer Grants permission to notify GameLift FleetIQ when a new game server is ready to host gameplay Write

gameServerGroup*

RequestUploadCredentials Grants permission to retrieve fresh upload credentials to use when uploading a new game build Read

build*

ResolveAlias Grants permission to retrieve the fleet ID associated with an alias Read

alias*

ResumeGameServerGroup Grants permission to reinstate suspended FleetIQ activity for a game server group Write

gameServerGroup*

SearchGameSessions Grants permission to retrieve game sessions that match a set of search criteria Read
StartFleetActions Grants permission to resume auto-scaling activity on a fleet after it was suspended with StopFleetActions() Write

fleet*

StartGameSessionPlacement Grants permission to send a game session placement request to a game session queue Write

gameSessionQueue*

StartMatchBackfill Grants permission to request FlexMatch matchmaking to fill available player slots in an existing game session Write
StartMatchmaking Grants permission to request FlexMatch matchmaking for one or a group of players and initiate game session placement Write
StopFleetActions Grants permission to suspend auto-scaling activity on a fleet Write

fleet*

StopGameSessionPlacement Grants permission to cancel a game session placement request that is in progress Write
StopMatchmaking Grants permission to cancel a matchmaking or match backfill request that is in progress Write
SuspendGameServerGroup Grants permission to temporarily stop FleetIQ activity for a game server group Write

gameServerGroup*

TagResource Grants permission to tag GameLift resources Tagging

alias

build

fleet

gameServerGroup

gameSessionQueue

location

matchmakingConfiguration

matchmakingRuleSet

script

aws:RequestTag/${TagKey}

aws:TagKeys

UntagResource Grants permission to untag GameLift resources Tagging

alias

build

fleet

gameServerGroup

gameSessionQueue

location

matchmakingConfiguration

matchmakingRuleSet

script

aws:TagKeys

UpdateAlias Grants permission to update the properties of an existing alias Write

alias*

UpdateBuild Grants permission to update an existing build's metadata Write

build*

UpdateFleetAttributes Grants permission to update the general properties of an existing fleet Write

fleet*

UpdateFleetCapacity Grants permission to adjust a fleet's capacity settings Write

fleet*

UpdateFleetPortSettings Grants permission to adjust a fleet's port settings Write

fleet*

UpdateGameServer Grants permission to change game server properties, health status, or utilization status Write

gameServerGroup*

UpdateGameServerGroup Grants permission to update properties for game server group, including allowed instance types Write

gameServerGroup*

UpdateGameSession Grants permission to update the properties of an existing game session Write
UpdateGameSessionQueue Grants permission to update properties of an existing game session queue Write

gameSessionQueue*

UpdateMatchmakingConfiguration Grants permission to update properties of an existing FlexMatch matchmaking configuration Write

matchmakingConfiguration*

UpdateRuntimeConfiguration Grants permission to update how server processes are configured on instances in an existing fleet Write

fleet*

UpdateScript Grants permission to update the metadata and content of an existing Realtime Servers script Write

script*

ValidateMatchmakingRuleSet Grants permission to validate the syntax of a FlexMatch matchmaking rule set Read

Resource types defined by Amazon GameLift

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the table. For details about the columns in the following table, see Resource types table.

Resource types ARN Condition keys
alias arn:${Partition}:gamelift:${Region}::alias/${AliasId}

aws:ResourceTag/${TagKey}

build arn:${Partition}:gamelift:${Region}:${AccountId}:build/${BuildId}

aws:ResourceTag/${TagKey}

fleet arn:${Partition}:gamelift:${Region}:${Account}:fleet/${FleetId}

aws:ResourceTag/${TagKey}

gameServerGroup arn:${Partition}:gamelift:${Region}:${Account}:gameservergroup/${GameServerGroupName}

aws:ResourceTag/${TagKey}

gameSessionQueue arn:${Partition}:gamelift:${Region}:${Account}:gamesessionqueue/${GameSessionQueueName}

aws:ResourceTag/${TagKey}

location arn:${Partition}:gamelift:${Region}::location/${LocationId}

aws:ResourceTag/${TagKey}

matchmakingConfiguration arn:${Partition}:gamelift:${Region}:${Account}:matchmakingconfiguration/${MatchmakingConfigurationName}

aws:ResourceTag/${TagKey}

matchmakingRuleSet arn:${Partition}:gamelift:${Region}:${Account}:matchmakingruleset/${MatchmakingRuleSetName}

aws:ResourceTag/${TagKey}

script arn:${Partition}:gamelift:${Region}:${AccountId}:script/${ScriptId}

aws:ResourceTag/${TagKey}

Condition keys for Amazon GameLift

Amazon GameLift defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.

Condition keys Description Type
aws:RequestTag/${TagKey} Filters access by the tags that are passed in the request String
aws:ResourceTag/${TagKey} Filters access by the tags associated with the resource String
aws:TagKeys Filters access by the tag keys that are passed in the request ArrayOfString