Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon ElastiCache

Amazon ElastiCache (service prefix: elasticache) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon ElastiCache
Actions defined by Amazon ElastiCache
Permission-only actions for Amazon ElastiCache
Resource types defined by Amazon ElastiCache
Condition keys for Amazon ElastiCache

API operations defined by Amazon ElastiCache

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AddTagsToResource	elasticache:AddTagsToResource	Tagging, Write
AuthorizeCacheSecurityGroupIngress	elasticache:AuthorizeCacheSecurityGroupIngress	Write
BatchApplyUpdateAction	elasticache:BatchApplyUpdateAction	Write
BatchStopUpdateAction	elasticache:BatchStopUpdateAction	Write
CompleteMigration	elasticache:CompleteMigration	Write
CopyServerlessCacheSnapshot	elasticache:CopyServerlessCacheSnapshot	Write
CopySnapshot	elasticache:AddTagsToResource	Tagging, Write
CopySnapshot	elasticache:CopySnapshot	Write
CreateCacheCluster	elasticache:AddTagsToResource	Tagging, Write
CreateCacheCluster	elasticache:CreateCacheCluster	Write
CreateCacheParameterGroup	elasticache:AddTagsToResource	Tagging, Write
CreateCacheParameterGroup	elasticache:CreateCacheParameterGroup	Write
CreateCacheSecurityGroup	elasticache:CreateCacheSecurityGroup	Write
CreateCacheSubnetGroup	elasticache:AddTagsToResource	Tagging, Write
CreateCacheSubnetGroup	elasticache:CreateCacheSubnetGroup	Write
CreateGlobalReplicationGroup	elasticache:CreateGlobalReplicationGroup	Write
CreateReplicationGroup	elasticache:AddTagsToResource	Tagging, Write
CreateReplicationGroup	elasticache:CreateReplicationGroup	Write
CreateServerlessCache	elasticache:AddTagsToResource	Tagging, Write
CreateServerlessCache	elasticache:CreateServerlessCache	Write
CreateServerlessCacheSnapshot	elasticache:AddTagsToResource	Tagging, Write
CreateServerlessCacheSnapshot	elasticache:CreateServerlessCacheSnapshot	Write
CreateSnapshot	elasticache:AddTagsToResource	Tagging, Write
CreateSnapshot	elasticache:CreateSnapshot	Write
CreateUser	elasticache:AddTagsToResource	Tagging, Write
CreateUser	elasticache:CreateUser	Write
CreateUserGroup	elasticache:AddTagsToResource	Tagging, Write
CreateUserGroup	elasticache:CreateUserGroup	Write
DecreaseNodeGroupsInGlobalReplicationGroup	elasticache:DecreaseNodeGroupsInGlobalReplicationGroup	Write
DecreaseReplicaCount	elasticache:DecreaseReplicaCount	Write
DeleteCacheCluster	elasticache:CreateSnapshot	Write
DeleteCacheCluster	elasticache:DeleteCacheCluster	Write
DeleteCacheParameterGroup	elasticache:DeleteCacheParameterGroup	Write
DeleteCacheSecurityGroup	elasticache:DeleteCacheSecurityGroup	Write
DeleteCacheSubnetGroup	elasticache:DeleteCacheSubnetGroup	Write
DeleteGlobalReplicationGroup	elasticache:DeleteGlobalReplicationGroup	Write
DeleteReplicationGroup	elasticache:CreateSnapshot	Write
DeleteReplicationGroup	elasticache:DeleteReplicationGroup	Write
DeleteServerlessCache	elasticache:CreateServerlessCacheSnapshot	Write
DeleteServerlessCache	elasticache:DeleteServerlessCache	Write
DeleteServerlessCacheSnapshot	elasticache:DeleteServerlessCacheSnapshot	Write
DeleteSnapshot	elasticache:DeleteSnapshot	Write
DeleteUser	elasticache:DeleteUser	Write
DeleteUserGroup	elasticache:DeleteUserGroup	Write
DescribeCacheClusters	elasticache:DescribeCacheClusters	List
DescribeCacheEngineVersions	elasticache:DescribeCacheEngineVersions	List
DescribeCacheParameterGroups	elasticache:DescribeCacheParameterGroups	List
DescribeCacheParameters	elasticache:DescribeCacheParameters	List
DescribeCacheSecurityGroups	elasticache:DescribeCacheSecurityGroups	List
DescribeCacheSubnetGroups	elasticache:DescribeCacheSubnetGroups	List
DescribeEngineDefaultParameters	elasticache:DescribeEngineDefaultParameters	List
DescribeEvents	elasticache:DescribeEvents	List
DescribeGlobalReplicationGroups	elasticache:DescribeGlobalReplicationGroups	List
DescribeReplicationGroups	elasticache:DescribeReplicationGroups	List
DescribeReservedCacheNodes	elasticache:DescribeReservedCacheNodes	List
DescribeReservedCacheNodesOfferings	elasticache:DescribeReservedCacheNodesOfferings	List
DescribeServerlessCacheSnapshots	elasticache:DescribeServerlessCacheSnapshots	List
DescribeServerlessCaches	elasticache:DescribeServerlessCaches	List
DescribeServiceUpdates	elasticache:DescribeServiceUpdates	List
DescribeSnapshots	elasticache:DescribeSnapshots	List
DescribeUpdateActions	elasticache:DescribeUpdateActions	List
DescribeUserGroups	elasticache:DescribeUserGroups	List
DescribeUsers	elasticache:DescribeUsers	List
DisassociateGlobalReplicationGroup	elasticache:DisassociateGlobalReplicationGroup	Write
ExportServerlessCacheSnapshot	elasticache:ExportServerlessCacheSnapshot	Write
FailoverGlobalReplicationGroup	elasticache:FailoverGlobalReplicationGroup	Write
IncreaseNodeGroupsInGlobalReplicationGroup	elasticache:IncreaseNodeGroupsInGlobalReplicationGroup	Write
IncreaseReplicaCount	elasticache:IncreaseReplicaCount	Write
ListAllowedNodeTypeModifications	elasticache:ListAllowedNodeTypeModifications	List
ListTagsForResource	elasticache:ListTagsForResource	Read
ModifyCacheCluster	elasticache:ModifyCacheCluster	Write
ModifyCacheParameterGroup	elasticache:ModifyCacheParameterGroup	Write
ModifyCacheSubnetGroup	elasticache:ModifyCacheSubnetGroup	Write
ModifyGlobalReplicationGroup	elasticache:ModifyGlobalReplicationGroup	Write
ModifyReplicationGroup	elasticache:ModifyReplicationGroup	Write
ModifyReplicationGroupShardConfiguration	elasticache:ModifyReplicationGroupShardConfiguration	Write
ModifyServerlessCache	elasticache:ModifyServerlessCache	Write
ModifyUser	elasticache:ModifyUser	Write
ModifyUserGroup	elasticache:ModifyUserGroup	Write
PurchaseReservedCacheNodesOffering	elasticache:AddTagsToResource	Tagging, Write
PurchaseReservedCacheNodesOffering	elasticache:PurchaseReservedCacheNodesOffering	Write
RebalanceSlotsInGlobalReplicationGroup	elasticache:RebalanceSlotsInGlobalReplicationGroup	Write
RebootCacheCluster	elasticache:RebootCacheCluster	Write
RemoveTagsFromResource	elasticache:RemoveTagsFromResource	Tagging, Write
ResetCacheParameterGroup	elasticache:ResetCacheParameterGroup	Write
RevokeCacheSecurityGroupIngress	elasticache:RevokeCacheSecurityGroupIngress	Write
StartMigration	elasticache:StartMigration	Write
TestFailover	elasticache:TestFailover	Write
TestMigration	elasticache:TestMigration	Write

Actions defined by Amazon ElastiCache

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddTagsToResource	Grants permission to add tags to an ElastiCache resource	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit	Tagging, Write
		parametergroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:CacheParameterGroupName
		replicationgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled
		reserved-instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		securitygroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		serverlesscache	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:DataStorageUnit elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MaximumDataStorage elasticache:MaximumECPUPerSecond elasticache:MinimumDataStorage elasticache:MinimumECPUPerSecond elasticache:SnapshotRetentionLimit
		serverlesscachesnapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId
		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId
		subnetgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		user	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:UserAuthenticationMode
		usergroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
AuthorizeCacheSecurityGroupIngress	Grants permission to authorize an EC2 security group on a ElastiCache security group	securitygroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
BatchApplyUpdateAction	Grants permission to apply ElastiCache service updates to sets of clusters and replication groups	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit	Write
BatchApplyUpdateAction		replicationgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
BatchStopUpdateAction	Grants permission to stop ElastiCache service updates from being executed on a set of clusters	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit	Write
BatchStopUpdateAction		replicationgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
CompleteMigration	Grants permission to complete an online migration of data from hosted Redis on Amazon EC2 to ElastiCache	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit	Write
CompleteMigration		replicationgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
Connect	Grants permission to connect as a specified ElastiCache user to an ElastiCache Replication Group or ElastiCache serverless cache	replicationgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
		serverlesscache	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:DataStorageUnit elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MaximumDataStorage elasticache:MaximumECPUPerSecond elasticache:MinimumDataStorage elasticache:MinimumECPUPerSecond elasticache:SnapshotRetentionLimit
		user*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:UserAuthenticationMode
CopyServerlessCacheSnapshot	Grants permission to make a copy of an existing serverless cache snapshot	serverlesscachesnapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId	Write
CopySnapshot	Grants permission to make a copy of an existing snapshot	snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId	Write
CreateCacheCluster	Grants permission to create a cache cluster	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit	Write
		parametergroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:CacheParameterGroupName
		replicationgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled
		securitygroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId
		subnetgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateCacheParameterGroup	Grants permission to create a parameter group	parametergroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:CacheParameterGroupName	Write
CreateCacheSecurityGroup	Grants permission to create a cache security group	securitygroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCacheSubnetGroup	Grants permission to create a cache subnet group	subnetgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateGlobalReplicationGroup	Grants permission to create a global replication group	globalreplicationgroup*	aws:ResourceTag/${TagKey} elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
CreateGlobalReplicationGroup	Grants permission to create a global replication group	replicationgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
CreateReplicationGroup	Grants permission to create a replication group	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit	Write
		globalreplicationgroup	aws:ResourceTag/${TagKey} elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled
		parametergroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:CacheParameterGroupName
		replicationgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled
		securitygroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId
		subnetgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		usergroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateServerlessCache	Grants permission to create a serverless cache	serverlesscache*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:DataStorageUnit elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MaximumDataStorage elasticache:MaximumECPUPerSecond elasticache:MinimumDataStorage elasticache:MinimumECPUPerSecond elasticache:SnapshotRetentionLimit	Write
		serverlesscachesnapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId
		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId
		usergroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateServerlessCacheSnapshot	Grants permission to create a copy of a serverless cache at a specific moment in time	serverlesscache*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:DataStorageUnit elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MaximumDataStorage elasticache:MaximumECPUPerSecond elasticache:MinimumDataStorage elasticache:MinimumECPUPerSecond elasticache:SnapshotRetentionLimit	Write
CreateServerlessCacheSnapshot		serverlesscachesnapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId	Write
CreateSnapshot	Grants permission to create a copy of an entire Redis cluster at a specific moment in time	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit	Write
		replicationgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled
		snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId
CreateUser	Grants permission to create a user for Redis. Users are supported from Redis 6.0 onwards	user*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:UserAuthenticationMode	Write
CreateUserGroup	Grants permission to create a user group for Redis. Groups are supported from Redis 6.0 onwards	user*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:UserAuthenticationMode	Write
CreateUserGroup		usergroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DecreaseNodeGroupsInGlobalReplicationGroup	Grants permission to decrease the number of node groups in global replication groups	globalreplicationgroup*	elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
DecreaseReplicaCount	Grants permission to decrease the number of replicas in a Redis (cluster mode disabled) replication group or the number of replica nodes in one or more node groups (shards) of a Redis (cluster mode enabled) replication group	replicationgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
DeleteCacheCluster	Grants permission to delete a previously provisioned cluster	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit	Write
DeleteCacheCluster		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId	Write
DeleteCacheParameterGroup	Grants permission to delete the specified cache parameter group	parametergroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:CacheParameterGroupName	Write
DeleteCacheSecurityGroup	Grants permission to delete a cache security group	securitygroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteCacheSubnetGroup	Grants permission to delete a cache subnet group	subnetgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteGlobalReplicationGroup	Grants permission to delete an existing global replication group	globalreplicationgroup*	elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
DeleteReplicationGroup	Grants permission to delete an existing replication group	replicationgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
DeleteReplicationGroup	Grants permission to delete an existing replication group	snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId	Write
DeleteServerlessCache	Grants permission to delete a serverless cache	serverlesscache*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:DataStorageUnit elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MaximumDataStorage elasticache:MaximumECPUPerSecond elasticache:MinimumDataStorage elasticache:MinimumECPUPerSecond elasticache:SnapshotRetentionLimit	Write
DeleteServerlessCache	Grants permission to delete a serverless cache	serverlesscachesnapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId	Write
DeleteServerlessCacheSnapshot	Grants permission to delete a serverless cache snapshot	serverlesscachesnapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId	Write
DeleteSnapshot	Grants permission to delete an existing snapshot	snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId	Write
DeleteUser	Grants permission to delete an existing user and thus remove it from all user groups and replication groups where it was assigned	user*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:UserAuthenticationMode	Write
DeleteUserGroup	Grants permission to delete an existing user group	usergroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DescribeCacheClusters	Grants permission to list information about provisioned cache clusters	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit	List
DescribeCacheEngineVersions	Grants permission to list available cache engines and their versions			List
DescribeCacheParameterGroups	Grants permission to list cache parameter group descriptions	parametergroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:CacheParameterGroupName	List
DescribeCacheParameters	Grants permission to retrieve the detailed parameter list for a particular cache parameter group	parametergroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:CacheParameterGroupName	List
DescribeCacheSecurityGroups	Grants permission to list cache security group descriptions	securitygroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	List
DescribeCacheSubnetGroups	Grants permission to list cache subnet group descriptions	subnetgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	List
DescribeEngineDefaultParameters	Grants permission to retrieve the default engine and system parameter information for the specified cache engine			List
DescribeEvents	Grants permission to list events related to clusters, cache security groups, and cache parameter groups			List
DescribeGlobalReplicationGroups	Grants permission to list information about global replication groups	globalreplicationgroup*	elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	List
DescribeReplicationGroups	Grants permission to list information about provisioned replication groups	replicationgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	List
DescribeReservedCacheNodes	Grants permission to list information about purchased reserved cache nodes	reserved-instance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	List
DescribeReservedCacheNodesOfferings	Grants permission to list available reserved cache node offerings			List
DescribeServerlessCacheSnapshots	Grants permission to list information about serverless cache snapshots	serverlesscache	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:DataStorageUnit elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MaximumDataStorage elasticache:MaximumECPUPerSecond elasticache:MinimumDataStorage elasticache:MinimumECPUPerSecond elasticache:SnapshotRetentionLimit	List
DescribeServerlessCacheSnapshots		serverlesscachesnapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId	List
DescribeServerlessCaches	Grants permission to list serverless caches	serverlesscache*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:DataStorageUnit elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MaximumDataStorage elasticache:MaximumECPUPerSecond elasticache:MinimumDataStorage elasticache:MinimumECPUPerSecond elasticache:SnapshotRetentionLimit	List
DescribeServiceUpdates	Grants permission to list details of the service updates			List
DescribeSnapshots	Grants permission to list information about cluster or replication group snapshots	snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId	List
DescribeUpdateActions	Grants permission to list details of the update actions for a set of clusters or replication groups	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit	List
DescribeUpdateActions		replicationgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	List
DescribeUserGroups	Grants permission to list information about Redis user groups	usergroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	List
DescribeUsers	Grants permission to list information about Redis users	user*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:UserAuthenticationMode	List
DisassociateGlobalReplicationGroup	Grants permission to remove a secondary replication group from the global replication group	globalreplicationgroup*	elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
ExportServerlessCacheSnapshot	Grants permission to export a copy of a serverless cache at a specific moment in time to s3 bucket	serverlesscachesnapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId	Write
FailoverGlobalReplicationGroup	Grants permission to failover the primary region to a selected secondary region of a global replication group	globalreplicationgroup*	elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
IncreaseNodeGroupsInGlobalReplicationGroup	Grants permission to increase the number of node groups in a global replication group	globalreplicationgroup*	elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
IncreaseReplicaCount	Grants permission to increase the number of replicas in a Redis (cluster mode disabled) replication group or the number of replica nodes in one or more node groups (shards) of a Redis (cluster mode enabled) replication group	replicationgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
ListAllowedNodeTypeModifications	Grants permission to list available node type that can be used to scale a particular Redis cluster or replication group	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit	List
ListAllowedNodeTypeModifications		replicationgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	List
ListTagsForResource	Grants permission to list tags for an ElastiCache resource	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit	Read
		parametergroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:CacheParameterGroupName
		replicationgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled
		reserved-instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		securitygroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		serverlesscache	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:DataStorageUnit elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MaximumDataStorage elasticache:MaximumECPUPerSecond elasticache:MinimumDataStorage elasticache:MinimumECPUPerSecond elasticache:SnapshotRetentionLimit
		serverlesscachesnapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId
		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId
		subnetgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		user	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:UserAuthenticationMode
		usergroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
ModifyCacheCluster	Grants permission to modify settings for a cluster	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit	Write
		parametergroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:CacheParameterGroupName
		securitygroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
ModifyCacheParameterGroup	Grants permission to modify parameters of a cache parameter group	parametergroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:CacheParameterGroupName	Write
ModifyCacheSubnetGroup	Grants permission to modify an existing cache subnet group	subnetgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
ModifyGlobalReplicationGroup	Grants permission to modify settings for a global replication group	globalreplicationgroup*	elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
ModifyReplicationGroup	Grants permission to modify the settings for a replication group	parametergroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:CacheParameterGroupName	Write
		replicationgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled
		securitygroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		usergroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
ModifyReplicationGroupShardConfiguration	Grants permission to add shards, remove shards, or rebalance the keyspaces among existing shards of a replication group	replicationgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
ModifyServerlessCache	Grants permission to modify parameters for a serverless cache	serverlesscache*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:DataStorageUnit elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MaximumDataStorage elasticache:MaximumECPUPerSecond elasticache:MinimumDataStorage elasticache:MinimumECPUPerSecond elasticache:SnapshotRetentionLimit	Write
ModifyServerlessCache		usergroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
ModifyUser	Grants permission to change Redis user password(s) and/or access string	user*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:UserAuthenticationMode	Write
ModifyUserGroup	Grants permission to change list of users that belong to the user group	user*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:UserAuthenticationMode	Write
ModifyUserGroup		usergroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PurchaseReservedCacheNodesOffering	Grants permission to purchase a reserved cache node offering	reserved-instance*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
RebalanceSlotsInGlobalReplicationGroup	Grants permission to perform a key space rebalance operation to redistribute slots and ensure uniform key distribution across existing shards in a global replication group	globalreplicationgroup*	elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
RebootCacheCluster	Grants permission to reboot some, or all, of the cache nodes within a provisioned cache cluster or replication group (cluster mode disabled)	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit	Write
RemoveTagsFromResource	Grants permission to remove tags from a ElastiCache resource	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit	Tagging, Write
		parametergroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:CacheParameterGroupName
		replicationgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled
		reserved-instance	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		securitygroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		serverlesscache	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:DataStorageUnit elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MaximumDataStorage elasticache:MaximumECPUPerSecond elasticache:MinimumDataStorage elasticache:MinimumECPUPerSecond elasticache:SnapshotRetentionLimit
		serverlesscachesnapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId
		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId
		subnetgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		user	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:UserAuthenticationMode
		usergroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
ResetCacheParameterGroup	Grants permission to modify parameters of a cache parameter group back to their default values	parametergroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:CacheParameterGroupName	Write
RevokeCacheSecurityGroupIngress	Grants permission to remove an EC2 security group ingress from a ElastiCache security group	securitygroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
StartMigration	Grants permission to start a migration of data from hosted Redis on Amazon EC2 to ElastiCache for Redis	replicationgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
TestFailover	Grants permission to test automatic failover on a specified node group in a replication group	replicationgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write
TestMigration	Grants permission to test a migration of data from hosted Redis on Amazon EC2 to ElastiCache for Redis	replicationgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write

Permission-only actions for Amazon ElastiCache

The following actions are defined by Amazon ElastiCache but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
InterruptClusterAzPower	Grants permission to test an AZ power interruption for an ElastiCache resource	replicationgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled	Write

Actions

Description

Resource types (*required)

Condition keys

Access level

InterruptClusterAzPower

Grants permission to test an AZ power interruption for an ElastiCache resource

replicationgroup*

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

elasticache:AtRestEncryptionEnabled

elasticache:AuthTokenEnabled

elasticache:AutomaticFailoverEnabled

elasticache:CacheNodeType

elasticache:CacheParameterGroupName

elasticache:ClusterModeEnabled

elasticache:Durability

elasticache:EngineType

elasticache:EngineVersion

elasticache:KmsKeyId

elasticache:MultiAZEnabled

elasticache:NumNodeGroups

elasticache:ReplicasPerNodeGroup

elasticache:SnapshotRetentionLimit

elasticache:TransitEncryptionEnabled

Write

Resource types defined by Amazon ElastiCache

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
cluster	arn:${Partition}:elasticache:${Region}:${Account}:cluster:${CacheClusterId}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AuthTokenEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:EngineType elasticache:EngineVersion elasticache:MultiAZEnabled elasticache:SnapshotRetentionLimit
globalreplicationgroup	arn:${Partition}:elasticache::${Account}:globalreplicationgroup:${GlobalReplicationGroupId}	elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled
parametergroup	arn:${Partition}:elasticache:${Region}:${Account}:parametergroup:${CacheParameterGroupName}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:CacheParameterGroupName
replicationgroup	arn:${Partition}:elasticache:${Region}:${Account}:replicationgroup:${ReplicationGroupId}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:AtRestEncryptionEnabled elasticache:AuthTokenEnabled elasticache:AutomaticFailoverEnabled elasticache:CacheNodeType elasticache:CacheParameterGroupName elasticache:ClusterModeEnabled elasticache:Durability elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MultiAZEnabled elasticache:NumNodeGroups elasticache:ReplicasPerNodeGroup elasticache:SnapshotRetentionLimit elasticache:TransitEncryptionEnabled
reserved-instance	arn:${Partition}:elasticache:${Region}:${Account}:reserved-instance:${ReservedCacheNodeId}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
securitygroup	arn:${Partition}:elasticache:${Region}:${Account}:securitygroup:${CacheSecurityGroupName}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
serverlesscache	arn:${Partition}:elasticache:${Region}:${Account}:serverlesscache:${ServerlessCacheName}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:DataStorageUnit elasticache:EngineType elasticache:EngineVersion elasticache:KmsKeyId elasticache:MaximumDataStorage elasticache:MaximumECPUPerSecond elasticache:MinimumDataStorage elasticache:MinimumECPUPerSecond elasticache:SnapshotRetentionLimit
serverlesscachesnapshot	arn:${Partition}:elasticache:${Region}:${Account}:serverlesscachesnapshot:${ServerlessCacheSnapshotName}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId
snapshot	arn:${Partition}:elasticache:${Region}:${Account}:snapshot:${SnapshotName}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:KmsKeyId
subnetgroup	arn:${Partition}:elasticache:${Region}:${Account}:subnetgroup:${CacheSubnetGroupName}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
user	arn:${Partition}:elasticache:${Region}:${Account}:user:${UserId}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticache:UserAuthenticationMode
usergroup	arn:${Partition}:elasticache:${Region}:${Account}:usergroup:${UserGroupId}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys

Condition keys for Amazon ElastiCache

Amazon ElastiCache defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters actions based on the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters actions based on the tags associated with the resource	String
aws:TagKeys	Filters actions based on the tag keys that are passed in the request	ArrayOfString
elasticache:AtRestEncryptionEnabled	Filters access by the AtRestEncryptionEnabled parameter present in the request or default false value if parameter is not present	Bool
elasticache:AuthTokenEnabled	Filters access by the presence of non empty AuthToken parameter in the request	Bool
elasticache:AutomaticFailoverEnabled	Filters access by the AutomaticFailoverEnabled parameter in the request	Bool
elasticache:CacheNodeType	Filters access by the cacheNodeType parameter present in the request. This key can be used to restrict which cache node types can be used on cluster creation or scaling operations	String
elasticache:CacheParameterGroupName	Filters access by the CacheParameterGroupName parameter in the request	String
elasticache:ClusterModeEnabled	Filters access by the cluster mode parameter present in the request. Default value for single node group (shard) creations is false	Bool
elasticache:DataStorageUnit	Filters access by the CacheUsageLimits.DataStorage.Unit parameter in the CreateServerlessCache and ModifyServerlessCache request	String
elasticache:Durability	Filters access by the Durability parameter in the request. Valid values are default, async, sync, or disabled	String
elasticache:EngineType	Filters access by the engine type present in creation requests. For replication group creations, default engine 'redis' is used as key if parameter is not present	String
elasticache:EngineVersion	Filters access by the engineVersion parameter present in creation or cluster modification requests	String
elasticache:KmsKeyId	Filters access by the Key ID of the KMS key	String
elasticache:MaximumDataStorage	Filters access by the CacheUsageLimits.DataStorage.Maximum parameter in the CreateServerlessCache and ModifyServerlessCache request	Numeric
elasticache:MaximumECPUPerSecond	Filters access by the CacheUsageLimits.ECPUPerSecond.Maximum parameter in the CreateServerlessCache and ModifyServerlessCache request	Numeric
elasticache:MinimumDataStorage	Filters access by the CacheUsageLimits.DataStorage.Minimum parameter in the CreateServerlessCache and ModifyServerlessCache request	Numeric
elasticache:MinimumECPUPerSecond	Filters access by the CacheUsageLimits.ECPUPerSecond.Minimum parameter in the CreateServerlessCache and ModifyServerlessCache request	Numeric
elasticache:MultiAZEnabled	Filters access by the AZMode parameter, MultiAZEnabled parameter or the number of availability zones that the cluster or replication group can be placed in	Bool
elasticache:NumNodeGroups	Filters access by the NumNodeGroups or NodeGroupCount parameter specified in the request. This key can be used to restrict the number of node groups (shards) clusters can have after creation or scaling operations	Numeric
elasticache:ReplicasPerNodeGroup	Filters access by the number of replicas per node group (shards) specified in creations or scaling requests	Numeric
elasticache:SnapshotRetentionLimit	Filters access by the SnapshotRetentionLimit parameter in the request	Numeric
elasticache:TransitEncryptionEnabled	Filters access by the TransitEncryptionEnabled parameter present in the request. For replication group creations, default value 'false' is used as key if parameter is not present	Bool
elasticache:UserAuthenticationMode	Filters access by the UserAuthenticationMode parameter in the request	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Elastic MapReduce (elasticmapreduce)

Amazon EMR Serverless (emr-serverless)