Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Glue DataBrew

Amazon Glue DataBrew (service prefix: databrew) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Glue DataBrew
Actions defined by Amazon Glue DataBrew
Resource types defined by Amazon Glue DataBrew
Condition keys for Amazon Glue DataBrew

API operations defined by Amazon Glue DataBrew

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
BatchDeleteRecipeVersion	databrew:BatchDeleteRecipeVersion			Write
CreateDataset	databrew:CreateDataset			Write
CreateDataset	databrew:TagResource			Tagging, Write
CreateProfileJob	databrew:CreateProfileJob			Write
	databrew:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	databrew.amazonaws.com	Write
CreateProject	databrew:CreateProject			Write
	databrew:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	databrew.amazonaws.com	Write
CreateRecipe	databrew:CreateRecipe			Write
CreateRecipe	databrew:TagResource			Tagging, Write
CreateRecipeJob	databrew:CreateRecipeJob			Write
	databrew:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	databrew.amazonaws.com	Write
CreateRuleset	databrew:CreateRuleset			Write
CreateRuleset	databrew:TagResource			Tagging, Write
CreateSchedule	databrew:CreateSchedule			Write
CreateSchedule	databrew:TagResource			Tagging, Write
DeleteDataset	databrew:DeleteDataset			Write
DeleteJob	databrew:DeleteJob			Write
DeleteProject	databrew:DeleteProject			Write
DeleteRecipeVersion	databrew:DeleteRecipeVersion			Write
DeleteRuleset	databrew:DeleteRuleset			Write
DeleteSchedule	databrew:DeleteSchedule			Write
DescribeDataset	databrew:DescribeDataset			Read
DescribeJob	databrew:DescribeJob			Read
DescribeJobRun	databrew:DescribeJobRun			Read
DescribeProject	databrew:DescribeProject			Read
DescribeRecipe	databrew:DescribeRecipe			Read
DescribeRuleset	databrew:DescribeRuleset			Read
DescribeSchedule	databrew:DescribeSchedule			Read
ListDatasets	databrew:ListDatasets			Read
ListJobRuns	databrew:ListJobRuns			Read
ListJobs	databrew:ListJobs			Read
ListProjects	databrew:ListProjects			Read
ListRecipeVersions	databrew:ListRecipeVersions			Read
ListRecipes	databrew:ListRecipes			Read
ListRulesets	databrew:ListRulesets			Read
ListSchedules	databrew:ListSchedules			Read
ListTagsForResource	databrew:ListTagsForResource			Read
PublishRecipe	databrew:PublishRecipe			Write
SendProjectSessionAction	databrew:SendProjectSessionAction			Write
StartJobRun	databrew:StartJobRun			Write
StartProjectSession	databrew:StartProjectSession			Write
StopJobRun	databrew:StopJobRun			Write
TagResource	databrew:TagResource			Tagging, Write
UntagResource	databrew:UntagResource			Tagging, Write
UpdateDataset	databrew:UpdateDataset			Write
UpdateProfileJob	databrew:UpdateProfileJob			Write
UpdateProfileJob	iam:PassRole	iam:PassedToService	databrew.amazonaws.com	Write
UpdateProject	databrew:UpdateProject			Write
UpdateProject	iam:PassRole	iam:PassedToService	databrew.amazonaws.com	Write
UpdateRecipe	databrew:UpdateRecipe			Write
UpdateRecipeJob	databrew:UpdateRecipeJob			Write
UpdateRecipeJob	iam:PassRole	iam:PassedToService	databrew.amazonaws.com	Write
UpdateRuleset	databrew:UpdateRuleset			Write
UpdateSchedule	databrew:UpdateSchedule			Write

Actions defined by Amazon Glue DataBrew

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchDeleteRecipeVersion	Grants permission to delete one or more recipe versions	Recipe*	aws:ResourceTag/${TagKey}	Write
CreateDataset	Grants permission to create a dataset		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateProfileJob	Grants permission to create a profile job		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateProject	Grants permission to create a project		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRecipe	Grants permission to create a recipe		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRecipeJob	Grants permission to create a recipe job		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateRuleset	Grants permission to create a ruleset		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSchedule	Grants permission to create a schedule		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteDataset	Grants permission to delete a dataset	Dataset*	aws:ResourceTag/${TagKey}	Write
DeleteJob	Grants permission to delete a job	Job*	aws:ResourceTag/${TagKey}	Write
DeleteProject	Grants permission to delete a project	Project*	aws:ResourceTag/${TagKey}	Write
DeleteRecipeVersion	Grants permission to delete a recipe version	Recipe*	aws:ResourceTag/${TagKey}	Write
DeleteRuleset	Grants permission to delete a ruleset	Ruleset*	aws:ResourceTag/${TagKey}	Write
DeleteSchedule	Grants permission to delete a schedule	Schedule*	aws:ResourceTag/${TagKey}	Write
DescribeDataset	Grants permission to view details about a dataset	Dataset*	aws:ResourceTag/${TagKey}	Read
DescribeJob	Grants permission to view details about a job	Job*	aws:ResourceTag/${TagKey}	Read
DescribeJobRun	Grants permission to view details about job run for a given job	Job*	aws:ResourceTag/${TagKey}	Read
DescribeProject	Grants permission to view details about a project	Project*	aws:ResourceTag/${TagKey}	Read
DescribeRecipe	Grants permission to view details about a recipe	Recipe*	aws:ResourceTag/${TagKey}	Read
DescribeRuleset	Grants permission to view details about a ruleset	Ruleset*	aws:ResourceTag/${TagKey}	Read
DescribeSchedule	Grants permission to view details about a schedule	Schedule*	aws:ResourceTag/${TagKey}	Read
ListDatasets	Grants permission to list datasets in your account			Read
ListJobRuns	Grants permission to list job runs for a given job	Job*	aws:ResourceTag/${TagKey}	Read
ListJobs	Grants permission to list jobs in your account			Read
ListProjects	Grants permission to list projects in your account			Read
ListRecipeVersions	Grants permission to list versions in your recipe	Recipe*	aws:ResourceTag/${TagKey}	Read
ListRecipes	Grants permission to list recipes in your account			Read
ListRulesets	Grants permission to list rulesets in your account			Read
ListSchedules	Grants permission to list schedules in your account			Read
ListTagsForResource	Grants permission to retrieve tags associated with a resource	Dataset	aws:ResourceTag/${TagKey}	Read
		Job	aws:ResourceTag/${TagKey}
		Project	aws:ResourceTag/${TagKey}
		Recipe	aws:ResourceTag/${TagKey}
		Ruleset	aws:ResourceTag/${TagKey}
		Schedule	aws:ResourceTag/${TagKey}
PublishRecipe	Grants permission to publish a major verison of a recipe	Recipe*	aws:ResourceTag/${TagKey}	Write
SendProjectSessionAction	Grants permission to submit an action to the interactive session for a project	Project*	aws:ResourceTag/${TagKey}	Write
StartJobRun	Grants permission to start running a job	Job*	aws:ResourceTag/${TagKey}	Write
StartProjectSession	Grants permission to start an interactive session for a project	Project*	aws:ResourceTag/${TagKey}	Write
StopJobRun	Grants permission to stop a job run for a job	Job*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add tags to a resource	Dataset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		Job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Project	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Recipe	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Ruleset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Schedule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags associated with a resource	Dataset	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		Job	aws:ResourceTag/${TagKey} aws:TagKeys
		Project	aws:ResourceTag/${TagKey} aws:TagKeys
		Recipe	aws:ResourceTag/${TagKey} aws:TagKeys
		Ruleset	aws:ResourceTag/${TagKey} aws:TagKeys
		Schedule	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateDataset	Grants permission to modify a dataset	Dataset*	aws:ResourceTag/${TagKey}	Write
UpdateProfileJob	Grants permission to modify a profile job	Job*	aws:ResourceTag/${TagKey}	Write
UpdateProject	Grants permission to modify a project	Project*	aws:ResourceTag/${TagKey}	Write
UpdateRecipe	Grants permission to modify a recipe	Recipe*	aws:ResourceTag/${TagKey}	Write
UpdateRecipeJob	Grants permission to modify a recipe job	Job*	aws:ResourceTag/${TagKey}	Write
UpdateRuleset	Grants permission to modify a ruleset	Ruleset*	aws:ResourceTag/${TagKey}	Write
UpdateSchedule	Grants permission to modify a schedule	Schedule*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Glue DataBrew

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
Dataset	arn:${Partition}:databrew:${Region}:${Account}:dataset/${ResourceId}	aws:ResourceTag/${TagKey}
Job	arn:${Partition}:databrew:${Region}:${Account}:job/${ResourceId}	aws:ResourceTag/${TagKey}
Project	arn:${Partition}:databrew:${Region}:${Account}:project/${ResourceId}	aws:ResourceTag/${TagKey}
Recipe	arn:${Partition}:databrew:${Region}:${Account}:recipe/${ResourceId}	aws:ResourceTag/${TagKey}
Ruleset	arn:${Partition}:databrew:${Region}:${Account}:ruleset/${ResourceId}	aws:ResourceTag/${TagKey}
Schedule	arn:${Partition}:databrew:${Region}:${Account}:schedule/${ResourceId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Glue DataBrew

Amazon Glue DataBrew defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Glue (glue)

Amazon Health APIs and Notifications (health)