Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon S3 Glacier

Amazon S3 Glacier (service prefix: glacier) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon S3 Glacier
Actions defined by Amazon S3 Glacier
Resource types defined by Amazon S3 Glacier
Condition keys for Amazon S3 Glacier

API operations defined by Amazon S3 Glacier

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AbortMultipartUpload	glacier:AbortMultipartUpload	Write
AbortVaultLock	glacier:AbortVaultLock	Permissions management, Write
AddTagsToVault	glacier:AddTagsToVault	Tagging, Write
CompleteMultipartUpload	glacier:CompleteMultipartUpload	Write
CompleteVaultLock	glacier:CompleteVaultLock	Permissions management, Write
CreateVault	glacier:CreateVault	Write
DeleteArchive	glacier:DeleteArchive	Write
DeleteVault	glacier:DeleteVault	Write
DeleteVaultAccessPolicy	glacier:DeleteVaultAccessPolicy	Permissions management, Write
DeleteVaultNotifications	glacier:DeleteVaultNotifications	Write
DescribeJob	glacier:DescribeJob	Read
DescribeVault	glacier:DescribeVault	Read
GetDataRetrievalPolicy	glacier:GetDataRetrievalPolicy	Read
GetJobOutput	glacier:GetJobOutput	Read
GetVaultAccessPolicy	glacier:GetVaultAccessPolicy	Read
GetVaultLock	glacier:GetVaultLock	Read
GetVaultNotifications	glacier:GetVaultNotifications	Read
InitiateJob	glacier:GetJobOutput	Read
InitiateJob	glacier:InitiateJob	Write
InitiateMultipartUpload	glacier:InitiateMultipartUpload	Write
InitiateVaultLock	glacier:InitiateVaultLock	Permissions management, Write
ListJobs	glacier:ListJobs	List
ListMultipartUploads	glacier:ListMultipartUploads	List
ListParts	glacier:ListParts	List
ListProvisionedCapacity	glacier:ListProvisionedCapacity	List
ListTagsForVault	glacier:ListTagsForVault	List
ListVaults	glacier:ListVaults	List
PurchaseProvisionedCapacity	glacier:PurchaseProvisionedCapacity	Write
RemoveTagsFromVault	glacier:RemoveTagsFromVault	Tagging, Write
SetDataRetrievalPolicy	glacier:SetDataRetrievalPolicy	Permissions management, Write
SetVaultAccessPolicy	glacier:SetVaultAccessPolicy	Permissions management, Write
SetVaultNotifications	glacier:SetVaultNotifications	Write
UploadArchive	glacier:UploadArchive	Write
UploadMultipartPart	glacier:UploadMultipartPart	Write

Actions defined by Amazon S3 Glacier

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AbortMultipartUpload	Grants permission to abort a multipart upload identified by the upload ID	vault*		Write
AbortVaultLock	Grants permission to abort the vault locking process if the vault lock is not in the Locked state	vault*		Permissions management, Write
AddTagsToVault	Grants permission to add the specified tags to a vault	vault*		Tagging, Write
CompleteMultipartUpload	Grants permission to complete a multipart upload process	vault*		Write
CompleteVaultLock	Grants permission to complete the vault locking process	vault*		Permissions management, Write
CreateVault	Grants permission to create a new vault with the specified name	vault*		Write
DeleteArchive	Grants permission to delete an archive from a vault	vault*	glacier:ArchiveAgeInDays	Write
DeleteVault	Grants permission to delete a vault	vault*		Write
DeleteVaultAccessPolicy	Grants permission to delete the access policy associated with the specified vault	vault*		Permissions management, Write
DeleteVaultNotifications	Grants permission to delete the notification configuration set for a vault	vault*		Write
DescribeJob	Grants permission to get information about a job previously initiated	vault*		Read
DescribeVault	Grants permission to get information about a vault	vault*		Read
GetDataRetrievalPolicy	Grants permission to get the data retrieval policy			Read
GetJobOutput	Grants permission to download the output of the job specified	vault*		Read
GetVaultAccessPolicy	Grants permission to retrieve the access-policy subresource set on the vault	vault*		Read
GetVaultLock	Grants permission to retrieve attributes from the lock-policy subresource set on the specified vault	vault*		Read
GetVaultNotifications	Grants permission to retrieve the notification-configuration subresource set on the vault	vault*		Read
InitiateJob	Grants permission to initiate a job of the specified type	vault*	glacier:ArchiveAgeInDays	Write
InitiateMultipartUpload	Grants permission to initiate a multipart upload	vault*		Write
InitiateVaultLock	Grants permission to initiate the vault locking process	vault*		Permissions management, Write
ListJobs	Grants permission to list jobs for a vault that are in-progress and jobs that have recently finished	vault*		List
ListMultipartUploads	Grants permission to list in-progress multipart uploads for the specified vault	vault*		List
ListParts	Grants permission to list the parts of an archive that have been uploaded in a specific multipart upload	vault*		List
ListProvisionedCapacity	Grants permission to list the provisioned capacity for the specified Amazon Web Services account			List
ListTagsForVault	Grants permission to list all the tags attached to a vault	vault*		List
ListVaults	Grants permission to list all vaults			List
PurchaseProvisionedCapacity	Grants permission to purchases a provisioned capacity unit for an Amazon Web Services account			Write
RemoveTagsFromVault	Grants permission to remove one or more tags from the set of tags attached to a vault	vault*		Tagging, Write
SetDataRetrievalPolicy	Grants permission to set and then enacts a data retrieval policy in the region specified in the PUT request			Permissions management, Write
SetVaultAccessPolicy	Grants permission to configure an access policy for a vault; will overwrite an existing policy	vault*		Permissions management, Write
SetVaultNotifications	Grants permission to configure vault notifications	vault*		Write
UploadArchive	Grants permission to upload an archive to a vault	vault*		Write
UploadMultipartPart	Grants permission to upload a part of an archive	vault*		Write

Resource types defined by Amazon S3 Glacier

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
vault	arn:${Partition}:glacier:${Region}:${Account}:vaults/${VaultName}

Condition keys for Amazon S3 Glacier

Amazon S3 Glacier defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
glacier:ArchiveAgeInDays	Filters access by how long an archive has been stored in the vault, in days	String
glacier:ResourceTag/	Filters access by a customer-defined tag	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon S3 Files (s3files)

Amazon S3 Object Lambda (s3-object-lambda)