Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon OpenSearch Service

Amazon OpenSearch Service (service prefix: es) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon OpenSearch Service
Actions defined by Amazon OpenSearch Service
Resource types defined by Amazon OpenSearch Service
Condition keys for Amazon OpenSearch Service

API operations defined by Amazon OpenSearch Service

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AcceptInboundCrossClusterSearchConnection	es:AcceptInboundConnection			Write
AcceptInboundCrossClusterSearchConnection	es:AcceptInboundCrossClusterSearchConnection			Write
AddTags	es:AddTags			Tagging, Write
AssociatePackage	es:AssociatePackage			Write
AssociatePackage	iam:PassRole	iam:PassedToService	es.amazonaws.com	Write
AuthorizeVpcEndpointAccess	es:AuthorizeVpcEndpointAccess			Write
CancelDomainConfigChange	es:CancelDomainConfigChange			Write
CancelElasticsearchServiceSoftwareUpdate	es:CancelElasticsearchServiceSoftwareUpdate			Write
CancelElasticsearchServiceSoftwareUpdate	es:CancelServiceSoftwareUpdate			Write
CreateElasticsearchDomain	es:AddTags			Tagging, Write
	es:CreateDomain			Write
	es:CreateElasticsearchDomain			Write
	iam:PassRole	iam:PassedToService	es.amazonaws.com	Write
CreateOutboundCrossClusterSearchConnection	es:CreateOutboundConnection			Write
CreateOutboundCrossClusterSearchConnection	es:CreateOutboundCrossClusterSearchConnection			Write
CreatePackage	es:CreatePackage			Write
CreateVpcEndpoint	es:CreateVpcEndpoint			Write
DeleteElasticsearchDomain	es:DeleteDomain			Write
DeleteElasticsearchDomain	es:DeleteElasticsearchDomain			Write
DeleteElasticsearchServiceRole	es:DeleteElasticsearchServiceRole			Write
DeleteInboundCrossClusterSearchConnection	es:DeleteInboundCrossClusterSearchConnection			Write
DeleteOutboundCrossClusterSearchConnection	es:DeleteOutboundConnection			Write
DeleteOutboundCrossClusterSearchConnection	es:DeleteOutboundCrossClusterSearchConnection			Write
DeletePackage	es:DeletePackage			Write
DeleteVpcEndpoint	es:DeleteVpcEndpoint			Write
DescribeDomainAutoTunes	es:DescribeDomainAutoTunes			Read
DescribeDomainChangeProgress	es:DescribeDomainChangeProgress			Read
DescribeElasticsearchDomain	es:DescribeDomain			Read
DescribeElasticsearchDomain	es:DescribeElasticsearchDomain			Read
DescribeElasticsearchDomainConfig	es:DescribeDomainConfig			Read
DescribeElasticsearchDomainConfig	es:DescribeElasticsearchDomainConfig			Read
DescribeElasticsearchDomains	es:DescribeDomains			List
DescribeElasticsearchDomains	es:DescribeElasticsearchDomains			List
DescribeElasticsearchInstanceTypeLimits	es:DescribeElasticsearchInstanceTypeLimits			List
DescribeElasticsearchInstanceTypeLimits	es:DescribeInstanceTypeLimits			List
DescribeInboundCrossClusterSearchConnections	es:DescribeInboundConnections			List
DescribeInboundCrossClusterSearchConnections	es:DescribeInboundCrossClusterSearchConnections			List
DescribeOutboundCrossClusterSearchConnections	es:DescribeOutboundConnections			List
DescribeOutboundCrossClusterSearchConnections	es:DescribeOutboundCrossClusterSearchConnections			List
DescribePackages	es:DescribePackages			Read
DescribeReservedElasticsearchInstanceOfferings	es:DescribeReservedElasticsearchInstanceOfferings			List
DescribeReservedElasticsearchInstanceOfferings	es:DescribeReservedInstanceOfferings			List
DescribeReservedElasticsearchInstances	es:DescribeReservedElasticsearchInstances			List
DescribeReservedElasticsearchInstances	es:DescribeReservedInstances			List
DescribeVpcEndpoints	es:DescribeVpcEndpoints			List
DissociatePackage	es:DissociatePackage			Write
GetCompatibleElasticsearchVersions	es:GetCompatibleElasticsearchVersions			List
GetCompatibleElasticsearchVersions	es:GetCompatibleVersions			List
GetPackageVersionHistory	es:GetPackageVersionHistory			Read
GetUpgradeHistory	es:GetUpgradeHistory			Read
GetUpgradeStatus	es:GetUpgradeStatus			Read
ListDomainNames	es:ListDomainNames			List
ListDomainsForPackage	es:ListDomainsForPackage			List
ListElasticsearchInstanceTypes	es:ListElasticsearchInstanceTypes			List
ListElasticsearchVersions	es:ListElasticsearchVersions			List
ListElasticsearchVersions	es:ListVersions			List
ListPackagesForDomain	es:ListPackagesForDomain			List
ListTags	es:ListTags			Read
ListVpcEndpointAccess	es:ListVpcEndpointAccess			List
ListVpcEndpoints	es:ListVpcEndpoints			List
ListVpcEndpointsForDomain	es:ListVpcEndpointsForDomain			List
PurchaseReservedElasticsearchInstanceOffering	es:PurchaseReservedElasticsearchInstanceOffering			Write
PurchaseReservedElasticsearchInstanceOffering	es:PurchaseReservedInstanceOffering			Write
RejectInboundCrossClusterSearchConnection	es:RejectInboundConnection			Write
RejectInboundCrossClusterSearchConnection	es:RejectInboundCrossClusterSearchConnection			Write
RemoveTags	es:RemoveTags			Tagging, Write
RevokeVpcEndpointAccess	es:RevokeVpcEndpointAccess			Write
StartElasticsearchServiceSoftwareUpdate	es:StartElasticsearchServiceSoftwareUpdate			Write
StartElasticsearchServiceSoftwareUpdate	es:StartServiceSoftwareUpdate			Write
UpdateElasticsearchDomainConfig	es:UpdateDomainConfig			Write
	es:UpdateElasticsearchDomainConfig			Write
	iam:PassRole	iam:PassedToService	es.amazonaws.com	Write
UpdatePackage	es:UpdatePackage			Write
UpdateVpcEndpoint	es:UpdateVpcEndpoint			Write
UpgradeElasticsearchDomain	es:UpgradeDomain			Write
UpgradeElasticsearchDomain	es:UpgradeElasticsearchDomain			Write

Actions defined by Amazon OpenSearch Service

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptInboundConnection	Grants permission to the destination domain owner to accept an inbound cross-cluster search connection request			Write
AcceptInboundCrossClusterSearchConnection	Grants permission to the destination domain owner to accept an inbound cross-cluster search connection request. This permission is deprecated. Use AcceptInboundConnection instead			Write
AddDataSource	Grants permission to add the data source for the OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Write
AddDirectQueryDataSource	Grants permission to add the data source for the provided OpenSearch arns	datasource*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
AddTags	Grants permission to attach resource tags to an OpenSearch Service domain, data source, or application	application*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		datasource*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		domain*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
AssociatePackage	Grants permission to associate a package with an OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Write
AssociatePackages	Grants permission to associate multiple packages with an OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Write
AttachDataSource	Grants permission to attach a data source to an OpenSearch Application	application*	aws:ResourceTag/${TagKey}	Write
AuthorizeVpcEndpointAccess	Grants permission to provide access to an Amazon OpenSearch Service domain through the use of an interface VPC endpoint			Write
CancelDomainConfigChange	Grants permission to cancel a change on an OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Write
CancelElasticsearchServiceSoftwareUpdate	Grants permission to cancel a service software update of a domain. This permission is deprecated. Use CancelServiceSoftwareUpdate instead	domain*	aws:ResourceTag/${TagKey}	Write
CancelServiceSoftwareUpdate	Grants permission to cancel a service software update of a domain	domain*	aws:ResourceTag/${TagKey}	Write
CreateApplication	Grants permission to create an OpenSearch Application		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDomain	Grants permission to create an Amazon OpenSearch Service domain	domain	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateElasticsearchDomain	Grants permission to create an OpenSearch Service domain. This permission is deprecated. Use CreateDomain instead	domain	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateElasticsearchServiceRole	Grants permission to create the service-linked role required for OpenSearch Service domains that use VPC access. This permission is deprecated. OpenSearch Service creates the service-linked role for you			Write
CreateIndex	Grants permission to create index for the OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Write
CreateOutboundConnection	Grants permission to create a new cross-cluster search connection from a source domain to a destination domain	domain*	aws:ResourceTag/${TagKey}	Write
CreateOutboundCrossClusterSearchConnection	Grants permission to create a new cross-cluster search connection from a source domain to a destination domain. This permission is deprecated. Use CreateOutboundConnection instead	domain*	aws:ResourceTag/${TagKey}	Write
CreatePackage	Grants permission to add a package for use with OpenSearch Service domains			Write
CreateServiceRole	Grants permission to create the service-linked role required for Amazon OpenSearch Service domains that use VPC access			Write
CreateVpcEndpoint	Grants permission to create an Amazon OpenSearch Service-managed VPC endpoint			Write
DeleteApplication	Grants permission to delete an OpenSearch Application	application*	aws:ResourceTag/${TagKey}	Write
DeleteDataSource	Grants permission to delete the data source for the OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Write
DeleteDirectQueryDataSource	Grants permission to delete the data source for the provided OpenSearch arns	datasource*	aws:ResourceTag/${TagKey}	Write
DeleteDomain	Grants permission to delete an Amazon OpenSearch Service domain and all of its data	domain*	aws:ResourceTag/${TagKey}	Write
DeleteElasticsearchDomain	Grants permission to delete an OpenSearch Service domain and all of its data. This permission is deprecated. Use DeleteDomain instead	domain*	aws:ResourceTag/${TagKey}	Write
DeleteElasticsearchServiceRole	Grants permission to delete the service-linked role required for OpenSearch Service domains that use VPC access. This permission is deprecated. Use the IAM API to delete service-linked roles			Write
DeleteInboundConnection	Grants permission to the destination domain owner to delete an existing inbound cross-cluster search connection			Write
DeleteInboundCrossClusterSearchConnection	Grants permission to the destination domain owner to delete an existing inbound cross-cluster search connection. This permission is deprecated. Use DeleteInboundConnection instead			Write
DeleteIndex	Grants permission to delete Index for the OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Write
DeleteOutboundConnection	Grants permission to the source domain owner to delete an existing outbound cross-cluster search connection			Write
DeleteOutboundCrossClusterSearchConnection	Grants permission to the source domain owner to delete an existing outbound cross-cluster search connection. This permission is deprecated. Use DeleteOutboundConnection instead			Write
DeletePackage	Grants permission to delete a package from OpenSearch Service. The package cannot be associated with any domains			Write
DeleteVpcEndpoint	Grants permission to delete an Amazon OpenSearch Service-managed interface VPC endpoint			Write
DeregisterCapability	Grants permission to deregister a capability from an OpenSearch Application	application*	aws:ResourceTag/${TagKey}	Write
DescribeDataSourceAttachment	Grants permission to describe the status of a data source attachment for an OpenSearch Application	application*	aws:ResourceTag/${TagKey}	Read
DescribeDomain	Grants permission to view a description of the domain configuration for the specified OpenSearch Service domain, including the domain ID, service endpoint, and ARN	domain*	aws:ResourceTag/${TagKey}	Read
DescribeDomainAutoTunes	Grants permission to view the Auto-Tune configuration of the domain for the specified OpenSearch Service domain, including the Auto-Tune state and maintenance schedules	domain*	aws:ResourceTag/${TagKey}	Read
DescribeDomainChangeProgress	Grants permission to view detail stage progress of an OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Read
DescribeDomainConfig	Grants permission to view a description of the configuration options and status of an OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Read
DescribeDomainHealth	Grants permission to view information about domain and node health, the standby Availability Zone, number of nodes per Availability Zone, and shard count per node	domain*	aws:ResourceTag/${TagKey}	Read
DescribeDomainNodes	Grants permission to view information about nodes configured for the domain and their configurations- the node id, type of node, status of node, Availability Zone, instance type and storage	domain*	aws:ResourceTag/${TagKey}	Read
DescribeDomains	Grants permission to view a description of the domain configuration for up to five specified OpenSearch Service domains	domain*	aws:ResourceTag/${TagKey}	List
DescribeDryRunProgress	Grants permission to describe the status of a pre-update validation check on an OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Read
DescribeElasticsearchDomain	Grants permission to view a description of the domain configuration for the specified OpenSearch Service domain, including the domain ID, service endpoint, and ARN. This permission is deprecated. Use DescribeDomain instead	domain*	aws:ResourceTag/${TagKey}	Read
DescribeElasticsearchDomainConfig	Grants permission to view a description of the configuration and status of an OpenSearch Service domain. This permission is deprecated. Use DescribeDomainConfig instead	domain*	aws:ResourceTag/${TagKey}	Read
DescribeElasticsearchDomains	Grants permission to view a description of the domain configuration for up to five specified Amazon OpenSearch domains. This permission is deprecated. Use DescribeDomains instead	domain*	aws:ResourceTag/${TagKey}	List
DescribeElasticsearchInstanceTypeLimits	Grants permission to view the instance count, storage, and master node limits for a given OpenSearch version and instance type. This permission is deprecated. Use DescribeInstanceTypeLimits instead			List
DescribeInboundConnections	Grants permission to list all the inbound cross-cluster search connections for a destination domain			List
DescribeInboundCrossClusterSearchConnections	Grants permission to list all the inbound cross-cluster search connections for a destination domain. This permission is deprecated. Use DescribeInboundConnections instead			List
DescribeInsightDetails	Grants permission to view detailed information about insights for an OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Read
DescribeInstanceTypeLimits	Grants permission to view the instance count, storage, and master node limits for a given engine version and instance type			List
DescribeOutboundConnections	Grants permission to list all the outbound cross-cluster search connections for a source domain			List
DescribeOutboundCrossClusterSearchConnections	Grants permission to list all the outbound cross-cluster search connections for a source domain. This permission is deprecated. Use DescribeOutboundConnections instead			List
DescribePackages	Grants permission to describe all packages available to OpenSearch Service domains			Read
DescribeReservedElasticsearchInstanceOfferings	Grants permission to fetch Reserved Instance offerings for Amazon OpenSearch Service. This permission is deprecated. Use DescribeReservedInstanceOfferings instead			List
DescribeReservedElasticsearchInstances	Grants permission to fetch OpenSearch Service Reserved Instances that have already been purchased. This permission is deprecated. Use DescribeReservedInstances instead			List
DescribeReservedInstanceOfferings	Grants permission to fetch Reserved Instance offerings for OpenSearch Service			List
DescribeReservedInstances	Grants permission to fetch OpenSearch Service Reserved Instances that have already been purchased			List
DescribeVpcEndpoints	Grants permission to describe one or more Amazon OpenSearch Service-managed VPC endpoints			List
DetachDataSource	Grants permission to detach a data source from an OpenSearch Application	application*	aws:ResourceTag/${TagKey}	Write
DissociatePackage	Grants permission to disassociate a package from the specified OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Write
DissociatePackages	Grants permission to disassociate multiple packages from the specified OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Write
ESCrossClusterGet	Grants permission to send cross-cluster requests to a destination domain	domain	aws:ResourceTag/${TagKey}	Read
ESHttpDelete	Grants permission to send HTTP DELETE requests to the OpenSearch APIs	domain	aws:ResourceTag/${TagKey}	Write
ESHttpGet	Grants permission to send HTTP GET requests to the OpenSearch APIs	domain	aws:ResourceTag/${TagKey}	Read
ESHttpHead	Grants permission to send HTTP HEAD requests to the OpenSearch APIs	domain	aws:ResourceTag/${TagKey}	Read
ESHttpPatch	Grants permission to send HTTP PATCH requests to the OpenSearch APIs	domain	aws:ResourceTag/${TagKey}	Write
ESHttpPost	Grants permission to send HTTP POST requests to the OpenSearch APIs	domain	aws:ResourceTag/${TagKey}	Write
ESHttpPut	Grants permission to send HTTP PUT requests to the OpenSearch APIs	domain	aws:ResourceTag/${TagKey}	Write
GetApplication	Grants permission to get information about an OpenSearch Application	application*	aws:ResourceTag/${TagKey}	Read
GetCapability	Grants permission to get a registered capability for an OpenSearch Application	application*	aws:ResourceTag/${TagKey}	Read
GetCompatibleElasticsearchVersions	Grants permission to fetch a list of compatible OpenSearch and Elasticsearch versions to which an OpenSearch Service domain can be upgraded. This permission is deprecated. Use GetCompatibleVersions instead	domain*	aws:ResourceTag/${TagKey}	List
GetCompatibleVersions	Grants permission to fetch list of compatible engine versions to which an OpenSearch Service domain can be upgraded	domain*	aws:ResourceTag/${TagKey}	List
GetDataSource	Grants permission to get the data source for the OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Read
GetDefaultApplicationSetting	Grants permission to get the default application setting for OpenSearch Service	application*	aws:ResourceTag/${TagKey}	Read
GetDirectQueryDataSource	Grants permission to get the data source for the provided OpenSearch arns	datasource*	aws:ResourceTag/${TagKey}	Read
GetDomainMaintenanceStatus	Grants permission to retrieve the status of maintenance action for the node	domain*	aws:ResourceTag/${TagKey}	Read
GetIndex	Grants permission to get index for the OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Read
GetPackageVersionHistory	Grants permission to fetch the version history for a package			Read
GetUpgradeHistory	Grants permission to fetch the upgrade history of a given OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Read
GetUpgradeStatus	Grants permission to fetch the upgrade status of a given OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Read
InsightFeedback	Grants permission to submit feedback for OpenSearch domain insight	domain*	aws:ResourceTag/${TagKey}	Write
ListApplications	Grants permission to list OpenSearch Applications	application*	aws:ResourceTag/${TagKey}	List
ListDataSourceAttachments	Grants permission to list data source attachments for an OpenSearch Application	application*	aws:ResourceTag/${TagKey}	List
ListDataSources	Grants permission to retrieve a list of data source for the OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	List
ListDirectQueryDataSources	Grants permission to retrieve a list of data source for the provided OpenSearch arns	datasource*	aws:ResourceTag/${TagKey}	List
ListDomainMaintenances	Grants permission to retrieve a list of maintenance actions for the OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	List
ListDomainNames	Grants permission to display the names of all OpenSearch Service domains that the current user owns			List
ListDomainsForPackage	Grants permission to list all OpenSearch Service domains that a package is associated with			List
ListElasticsearchInstanceTypeDetails	Grants permission to list all instance types and available features for a given OpenSearch version. This permission is deprecated. Use ListInstanceTypeDetails instead			List
ListElasticsearchInstanceTypes	Grants permission to list all EC2 instance types that are supported for a given OpenSearch version			List
ListElasticsearchVersions	Grants permission to list all supported OpenSearch versions on Amazon OpenSearch Service. This permission is deprecated. Use ListVersions instead			List
ListInsights	Grants permission to list insights for OpenSearch Service domains in the account	domain	aws:ResourceTag/${TagKey}	List
ListInstanceTypeDetails	Grants permission to list all instance types and available features for a given OpenSearch or Elasticsearch version			List
ListPackagesForDomain	Grants permission to list all packages associated with the OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	List
ListScheduledActions	Grants permission to retrieve a list of configuration changes that are scheduled for a OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	List
ListTags	Grants permission to display all resource tags for an OpenSearch Service domain, data source, or application	application*	aws:ResourceTag/${TagKey}	Read
		datasource*	aws:ResourceTag/${TagKey}
		domain*	aws:ResourceTag/${TagKey}
ListVersions	Grants permission to list all supported OpenSearch and Elasticsearch versions in Amazon OpenSearch Service			List
ListVpcEndpointAccess	Grants permission to retrieve information about each Amazon principal that is allowed to access a given Amazon OpenSearch Service domain through the use of an interface VPC endpoint			List
ListVpcEndpoints	Grants permission to retrieve all Amazon OpenSearch Service-managed VPC endpoints in the current Amazon Web Services account and Region			List
ListVpcEndpointsForDomain	Grants permission to retrieve all Amazon OpenSearch Service-managed VPC endpoints associated with a particular domain			List
PurchaseReservedElasticsearchInstanceOffering	Grants permission to purchase OpenSearch Service Reserved Instances. This permission is deprecated. Use PurchaseReservedInstanceOffering instead			Write
PurchaseReservedInstanceOffering	Grants permission to purchase OpenSearch reserved instances			Write
PutDefaultApplicationSetting	Grants permission to set or remove the default application setting for OpenSearch Service	application*	aws:ResourceTag/${TagKey}	Write
RegisterCapability	Grants permission to register a capability for an OpenSearch Application	application*	aws:ResourceTag/${TagKey}	Write
RejectInboundConnection	Grants permission to the destination domain owner to reject an inbound cross-cluster search connection request			Write
RejectInboundCrossClusterSearchConnection	Grants permission to the destination domain owner to reject an inbound cross-cluster search connection request. This permission is deprecated. Use RejectInboundConnection instead			Write
RemoveTags	Grants permission to remove resource tags from an OpenSearch Service domain, data source, or application	application*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		datasource*	aws:ResourceTag/${TagKey} aws:TagKeys
		domain*	aws:ResourceTag/${TagKey} aws:TagKeys
RevokeVpcEndpointAccess	Grants permission to revoke access to an Amazon OpenSearch Service domain that was provided through an interface VPC endpoint			Write
RollbackElasticsearchServiceSoftwareUpdate	Grants permission to rollback a service software update of an elasticsearch domain to its previous version	domain*	aws:ResourceTag/${TagKey}	Write
RollbackServiceSoftwareUpdate	Grants permission to rollback a service software update of an opensearch domain to its previous version	domain*	aws:ResourceTag/${TagKey}	Write
StartDomainMaintenance	Grants permission to initiate the maintenance on the node	domain*	aws:ResourceTag/${TagKey}	Write
StartElasticsearchServiceSoftwareUpdate	Grants permission to start a service software update of a domain. This permission is deprecated. Use StartServiceSoftwareUpdate instead	domain*	aws:ResourceTag/${TagKey}	Write
StartServiceSoftwareUpdate	Grants permission to start a service software update of a domain	domain*	aws:ResourceTag/${TagKey}	Write
UpdateApplication	Grants permission to update an OpenSearch Application	application*	aws:ResourceTag/${TagKey}	Write
UpdateDataSource	Grants permission to update the data source for the OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Write
UpdateDirectQueryDataSource	Grants permission to update the data source for the provided OpenSearch arns	datasource*	aws:ResourceTag/${TagKey}	Write
UpdateDomainConfig	Grants permission to modify the configuration of an OpenSearch Service domain, such as the instance type or number of instances	domain*	aws:ResourceTag/${TagKey}	Write
UpdateElasticsearchDomainConfig	Grants permission to modify the configuration of an OpenSearch Service domain, such as the instance type or number of instances. This permission is deprecated. Use UpdateDomainConfig instead	domain*	aws:ResourceTag/${TagKey}	Write
UpdateIndex	Grants permission to update index for the OpenSearch Service domain	domain*	aws:ResourceTag/${TagKey}	Write
UpdatePackage	Grants permission to update a package for use with OpenSearch Service domains			Write
UpdatePackageScope	Grants permission to update scope a package			Write
UpdateScheduledAction	Grants permission to reschedule a planned OpenSearch Service domain configuration change for a later time	domain*	aws:ResourceTag/${TagKey}	Write
UpdateVpcEndpoint	Grants permission to modify an Amazon OpenSearch Service-managed interface VPC endpoint			Write
UpgradeDomain	Grants permission to initiate upgrade of an OpenSearch Service domain to a given version	domain*	aws:ResourceTag/${TagKey}	Write
UpgradeElasticsearchDomain	Grants permission to initiate upgrade of an OpenSearch Service domain to a specified version. This permission is deprecated. Use UpgradeDomain instead	domain*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon OpenSearch Service

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
application	arn:${Partition}:opensearch:${Region}:${Account}:application/${AppId}	aws:ResourceTag/${TagKey}
datasource	arn:${Partition}:opensearch:${Region}:${Account}:datasource/${DataSourceName}	aws:ResourceTag/${TagKey}
domain	arn:${Partition}:es:${Region}:${Account}:domain/${DomainName}	aws:ResourceTag/${TagKey}
es_role	arn:${Partition}:iam::${Account}:role/aws-service-role/es.amazonaws.com/AWSServiceRoleForAmazonOpenSearchService	aws:ResourceTag/${TagKey}
opensearchservice_role	arn:${Partition}:iam::${Account}:role/aws-service-role/opensearchservice.amazonaws.com/AWSServiceRoleForAmazonOpenSearchService	aws:ResourceTag/${TagKey}

Condition keys for Amazon OpenSearch Service

Amazon OpenSearch Service defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access based on the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access based on the tags associated with the resource	String
aws:TagKeys	Filters access based on the tag keys that are passed in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Neptune (neptune-db)

Amazon Personalize (personalize)