Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon AppSync

Amazon AppSync (service prefix: appsync) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon AppSync
Actions defined by Amazon AppSync
Permission-only actions for Amazon AppSync
Resource types defined by Amazon AppSync
Condition keys for Amazon AppSync

API operations defined by Amazon AppSync

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateApi	appsync:AssociateApi			Write
AssociateMergedGraphqlApi	appsync:AssociateMergedGraphqlApi			Write
AssociateMergedGraphqlApi	appsync:AssociateSourceGraphqlApi			Write
AssociateSourceGraphqlApi	appsync:AssociateMergedGraphqlApi			Write
AssociateSourceGraphqlApi	appsync:AssociateSourceGraphqlApi			Write
CreateApi	appsync:CreateApi			Write
	appsync:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	appsync.amazonaws.com	Write
CreateApiCache	appsync:CreateApiCache			Write
CreateApiKey	appsync:CreateApiKey			Write
CreateChannelNamespace	appsync:CreateChannelNamespace			Write
CreateChannelNamespace	appsync:TagResource			Tagging, Write
CreateDataSource	appsync:CreateDataSource			Write
CreateDataSource	iam:PassRole	iam:PassedToService	appsync.amazonaws.com	Write
CreateDomainName	appsync:CreateDomainName			Write
CreateDomainName	appsync:TagResource			Tagging, Write
CreateFunction	appsync:CreateFunction			Write
CreateGraphqlApi	appsync:CreateGraphqlApi			Write
	appsync:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	appsync.amazonaws.com	Write
CreateResolver	appsync:CreateResolver			Write
CreateType	appsync:CreateType			Write
DeleteApi	appsync:DeleteApi			Write
DeleteApiCache	appsync:DeleteApiCache			Write
DeleteApiKey	appsync:DeleteApiKey			Write
DeleteChannelNamespace	appsync:DeleteChannelNamespace			Write
DeleteDataSource	appsync:DeleteDataSource			Write
DeleteDomainName	appsync:DeleteDomainName			Write
DeleteFunction	appsync:DeleteFunction			Write
DeleteGraphqlApi	appsync:DeleteGraphqlApi			Write
DeleteResolver	appsync:DeleteResolver			Write
DeleteType	appsync:DeleteType			Write
DisassociateApi	appsync:DisassociateApi			Write
DisassociateMergedGraphqlApi	appsync:DisassociateMergedGraphqlApi			Write
DisassociateSourceGraphqlApi	appsync:DisassociateSourceGraphqlApi			Write
EvaluateCode	appsync:EvaluateCode			Read
EvaluateMappingTemplate	appsync:EvaluateMappingTemplate			Read
FlushApiCache	appsync:FlushApiCache			Write
GetApi	appsync:GetApi			Read
GetApiAssociation	appsync:GetApiAssociation			Read
GetApiCache	appsync:GetApiCache			Read
GetChannelNamespace	appsync:GetChannelNamespace			Read
GetDataSource	appsync:GetDataSource			Read
GetDataSourceIntrospection	appsync:GetDataSourceIntrospection			Read
GetDomainName	appsync:GetDomainName			Read
GetFunction	appsync:GetFunction			Read
GetGraphqlApi	appsync:GetGraphqlApi			Read
GetGraphqlApiEnvironmentVariables	appsync:GetGraphqlApiEnvironmentVariables			Read
GetIntrospectionSchema	appsync:GetIntrospectionSchema			Read
GetResolver	appsync:GetResolver			Read
GetSchemaCreationStatus	appsync:GetSchemaCreationStatus			Read
GetSourceApiAssociation	appsync:GetSourceApiAssociation			Read
GetType	appsync:GetType			Read
ListApiKeys	appsync:ListApiKeys			List
ListApis	appsync:ListApis			List
ListChannelNamespaces	appsync:ListChannelNamespaces			List
ListDataSources	appsync:ListDataSources			List
ListDomainNames	appsync:ListDomainNames			List
ListFunctions	appsync:ListFunctions			List
ListGraphqlApis	appsync:ListGraphqlApis			List
ListResolvers	appsync:ListResolvers			List
ListResolversByFunction	appsync:ListResolversByFunction			List
ListSourceApiAssociations	appsync:ListSourceApiAssociations			List
ListTagsForResource	appsync:ListTagsForResource			Read
ListTypes	appsync:ListTypes			List
ListTypesByAssociation	appsync:ListTypesByAssociation			List
PutGraphqlApiEnvironmentVariables	appsync:PutGraphqlApiEnvironmentVariables			Write
StartDataSourceIntrospection	appsync:StartDataSourceIntrospection			Write
StartSchemaCreation	appsync:StartSchemaCreation			Write
StartSchemaMerge	appsync:StartSchemaMerge			Write
TagResource	appsync:TagResource			Tagging, Write
UntagResource	appsync:UntagResource			Tagging, Write
UpdateApi	appsync:UpdateApi			Write
UpdateApi	iam:PassRole	iam:PassedToService	appsync.amazonaws.com	Write
UpdateApiCache	appsync:UpdateApiCache			Write
UpdateApiKey	appsync:UpdateApiKey			Write
UpdateChannelNamespace	appsync:UpdateChannelNamespace			Write
UpdateDataSource	appsync:UpdateDataSource			Write
UpdateDataSource	iam:PassRole	iam:PassedToService	appsync.amazonaws.com	Write
UpdateDomainName	appsync:UpdateDomainName			Write
UpdateFunction	appsync:UpdateFunction			Write
UpdateGraphqlApi	appsync:UpdateGraphqlApi			Write
UpdateGraphqlApi	iam:PassRole	iam:PassedToService	appsync.amazonaws.com	Write
UpdateResolver	appsync:UpdateResolver			Write
UpdateSourceApiAssociation	appsync:UpdateSourceApiAssociation			Write
UpdateType	appsync:UpdateType			Write

Actions defined by Amazon AppSync

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateApi	Grants permission to attach a GraphQL API to a custom domain name in AppSync	domain*	aws:ResourceTag/${TagKey}	Write
AssociateMergedGraphqlApi	Grants permission to associate a merged API to a source API	graphqlapi*	aws:ResourceTag/${TagKey}	Write
AssociateSourceGraphqlApi	Grants permission to associate a source API to a merged API	graphqlapi*	aws:ResourceTag/${TagKey}	Write
CreateApi	Grants permission to create an API		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateApiCache	Grants permission to create an API cache in AppSync			Write
CreateApiKey	Grants permission to create a unique key that you can distribute to clients who are executing your API			Write
CreateChannelNamespace	Grants permission to create a channel namespace	channelNamespace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDataSource	Grants permission to create a data source			Write
CreateDomainName	Grants permission to create a custom domain name in AppSync	domain*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFunction	Grants permission to create a new function			Write
CreateGraphqlApi	Grants permission to create a GraphQL API, which is the top level AppSync resource		appsync:Visibility aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateResolver	Grants permission to create a resolver. A resolver converts incoming requests into a format that a data source can understand, and converts the data source's responses into GraphQL			Write
CreateType	Grants permission to create a type			Write
DeleteApi	Grants permission to delete a API. This will also clean up every AppSync resource below that API	api*	aws:ResourceTag/${TagKey}	Write
DeleteApiCache	Grants permission to delete an API cache in AppSync			Write
DeleteApiKey	Grants permission to delete an API key			Write
DeleteChannelNamespace	Grants permission to delete a channel namespace	channelNamespace*	aws:ResourceTag/${TagKey}	Write
DeleteDataSource	Grants permission to delete a data source			Write
DeleteDomainName	Grants permission to delete a custom domain name in AppSync	domain*	aws:ResourceTag/${TagKey}	Write
DeleteFunction	Grants permission to delete a function			Write
DeleteGraphqlApi	Grants permission to delete a GraphQL Api. This will also clean up every AppSync resource below that API	graphqlapi*	aws:ResourceTag/${TagKey}	Write
DeleteResolver	Grants permission to delete a resolver			Write
DeleteType	Grants permission to delete a type			Write
DisassociateApi	Grants permission to detach a GraphQL API to a custom domain name in AppSync	domain*	aws:ResourceTag/${TagKey}	Write
DisassociateMergedGraphqlApi	Grants permission to remove an associated source API from a merged API identified by the source API	mergedApiAssociation*		Write
DisassociateSourceGraphqlApi	Grants permission to remove an associated source API from a merged API identified by the merged API	sourceApiAssociation*		Write
EvaluateCode	Grants permission to evaluate code with a runtime and context			Read
EvaluateMappingTemplate	Grants permission to evaluate template mapping			Read
EventConnect	Grants permission to connect to an Event API	api*	aws:ResourceTag/${TagKey}	Write
EventPublish	Grants permission to publish events to a channel namespace	channelNamespace*	aws:ResourceTag/${TagKey}	Write
EventSubscribe	Grants permission to subscribe to a channel namespace	channelNamespace*	aws:ResourceTag/${TagKey}	Write
FlushApiCache	Grants permission to flush an API cache in AppSync			Write
GetApi	Grants permission to retrieve an API	api*	aws:ResourceTag/${TagKey}	Read
GetApiAssociation	Grants permission to read custom domain name - GraphQL API association details in AppSync	domain*	aws:ResourceTag/${TagKey}	Read
GetApiCache	Grants permission to read information about an API cache in AppSync			Read
GetChannelNamespace	Grants permission to retrieve a channel namespace	channelNamespace*	aws:ResourceTag/${TagKey}	Read
GetDataSource	Grants permission to retrieve a data source			Read
GetDataSourceIntrospection	Grants permission to retrieve a data source introspection			Read
GetDomainName	Grants permission to read information about a custom domain name in AppSync	domain*	aws:ResourceTag/${TagKey}	Read
GetFunction	Grants permission to retrieve a function			Read
GetGraphqlApi	Grants permission to retrieve a GraphQL API	graphqlapi*	aws:ResourceTag/${TagKey}	Read
GetGraphqlApiEnvironmentVariables	Grants permission to retrieve the environment variables for a GraphQL API			Read
GetIntrospectionSchema	Grants permission to retrieve the introspection schema for a GraphQL API			Read
GetResolver	Grants permission to retrieve a resolver			Read
GetSchemaCreationStatus	Grants permission to retrieve the current status of a schema creation operation			Read
GetSourceApiAssociation	Grants permission to read information about a merged API associated source API	sourceApiAssociation*		Read
GetType	Grants permission to retrieve a type			Read
ListApiKeys	Grants permission to list the API keys for a given API			List
ListApis	Grants permission to list APIs		aws:ResourceTag/${TagKey}	List
ListChannelNamespaces	Grants permission to list channel namespace	api*	aws:ResourceTag/${TagKey}	List
ListDataSources	Grants permission to list the data sources for a given API			List
ListDomainNames	Grants permission to enumerate custom domain names in AppSync		aws:ResourceTag/${TagKey}	List
ListFunctions	Grants permission to list the functions for a given API			List
ListGraphqlApis	Grants permission to list GraphQL APIs			List
ListResolvers	Grants permission to list the resolvers for a given API and type			List
ListResolversByFunction	Grants permission to list the resolvers that are associated with a specific function			List
ListSourceApiAssociations	Grants permission to list source APIs associated to a given merged API			List
ListTagsForResource	Grants permission to list the tags for a resource	api	aws:ResourceTag/${TagKey}	Read
		channelNamespace	aws:ResourceTag/${TagKey}
		domain	aws:ResourceTag/${TagKey}
		graphqlapi	aws:ResourceTag/${TagKey}
ListTypes	Grants permission to list the types for a given API			List
ListTypesByAssociation	Grants permission to list the types for a given merged API and source API association			List
PutGraphqlApiEnvironmentVariables	Grants permission to update the environment variables for a GraphQL API			Write
SetWebACL	Grants permission to set a web ACL			Permissions management, Write
StartDataSourceIntrospection	Grants permission to introspect a data source			Write
StartSchemaCreation	Grants permission to add a new schema to your GraphQL API. This operation is asynchronous - GetSchemaCreationStatus can show when it has completed			Write
StartSchemaMerge	Grants permission to initiate a schema merge for a given merged API and associated source API	sourceApiAssociation*		Write
TagResource	Grants permission to tag a resource	api	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		channelNamespace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		domain	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		graphqlapi	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag a resource	api	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		channelNamespace	aws:ResourceTag/${TagKey} aws:TagKeys
		domain	aws:ResourceTag/${TagKey} aws:TagKeys
		graphqlapi	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateApi	Grants permission to update an API	api*	aws:ResourceTag/${TagKey}	Write
UpdateApiCache	Grants permission to update an API cache in AppSync			Write
UpdateApiKey	Grants permission to update an API key for a given API			Write
UpdateChannelNamespace	Grants permission to update a channel namespace	channelNamespace*	aws:ResourceTag/${TagKey}	Write
UpdateDataSource	Grants permission to update a data source			Write
UpdateDomainName	Grants permission to update a custom domain name in AppSync	domain*	aws:ResourceTag/${TagKey}	Write
UpdateFunction	Grants permission to update an existing function			Write
UpdateGraphqlApi	Grants permission to update a GraphQL API	graphqlapi*	aws:ResourceTag/${TagKey}	Write
UpdateResolver	Grants permission to update a resolver			Write
UpdateSourceApiAssociation	Grants permission to update a merged API source API association	sourceApiAssociation*		Write
UpdateType	Grants permission to update a type			Write

Permission-only actions for Amazon AppSync

The following actions are defined by Amazon AppSync but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateWebACL	Grants permission to associate a web ACL and a resource	api	aws:ResourceTag/${TagKey}	Write
AssociateWebACL	Grants permission to associate a web ACL and a resource	graphqlapi	aws:ResourceTag/${TagKey}	Write
DeleteResourcePolicy	Grants permission to remove a resource policy			Write
DisassociateWebACL	Grants permission to disassociate a web ACL and a resource	api	aws:ResourceTag/${TagKey}	Write
DisassociateWebACL	Grants permission to disassociate a web ACL and a resource	graphqlapi	aws:ResourceTag/${TagKey}	Write
GetResourcePolicy	Grants permission to read a resource policy			Read
GetWebACLForResource	Grants permission to get associated web ACLs for a resource	api	aws:ResourceTag/${TagKey}	Read
GetWebACLForResource	Grants permission to get associated web ACLs for a resource	graphqlapi	aws:ResourceTag/${TagKey}	Read
GraphQL	Grants permission to send a GraphQL query to a GraphQL API	field*		Write
GraphQL	Grants permission to send a GraphQL query to a GraphQL API	graphqlapi*	aws:ResourceTag/${TagKey}	Write
ListResourcesForWebACL	Grants permission to get associated resources for a web ACL			List
PutResourcePolicy	Grants permission to set a resource policy			Write
SourceGraphQL	Grants permission to send a GraphQL query to a source API of a merged API	field*		Write
SourceGraphQL		graphqlapi*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon AppSync

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
api	arn:${Partition}:appsync:${Region}:${Account}:apis/${ApiId}	aws:ResourceTag/${TagKey}
channelNamespace	arn:${Partition}:appsync:${Region}:${Account}:apis/${ApiId}/channelNamespace/${ChannelNamespaceName}	aws:ResourceTag/${TagKey}
datasource	arn:${Partition}:appsync:${Region}:${Account}:apis/${GraphQLAPIId}/datasources/${DatasourceName}
domain	arn:${Partition}:appsync:${Region}:${Account}:domainnames/${DomainName}	aws:ResourceTag/${TagKey}
field	arn:${Partition}:appsync:${Region}:${Account}:apis/${GraphQLAPIId}/types/${TypeName}/fields/${FieldName}
function	arn:${Partition}:appsync:${Region}:${Account}:apis/${GraphQLAPIId}/functions/${FunctionId}
graphqlapi	arn:${Partition}:appsync:${Region}:${Account}:apis/${GraphQLAPIId}	aws:ResourceTag/${TagKey}
mergedApiAssociation	arn:${Partition}:appsync:${Region}:${Account}:apis/${SourceGraphQLAPIId}/mergedApiAssociations/${Associationid}
sourceApiAssociation	arn:${Partition}:appsync:${Region}:${Account}:apis/${MergedGraphQLAPIId}/sourceApiAssociations/${Associationid}
type	arn:${Partition}:appsync:${Region}:${Account}:apis/${GraphQLAPIId}/types/${TypeName}

Condition keys for Amazon AppSync

Amazon AppSync defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
appsync:Visibility	Filters access by the visibility of an API	String
aws:RequestTag/${TagKey}	Filters access by the tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Application Auto Scaling (application-autoscaling)

Amazon Backup (backup)