Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon IoT Greengrass

Amazon IoT Greengrass (service prefix: greengrass) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon IoT Greengrass
Actions defined by Amazon IoT Greengrass
Resource types defined by Amazon IoT Greengrass
Condition keys for Amazon IoT Greengrass

API operations defined by Amazon IoT Greengrass

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateRoleToGroup	greengrass:AssociateRoleToGroup			Write
AssociateRoleToGroup	iam:PassRole	iam:PassedToService	greengrass.amazonaws.com	Write
AssociateServiceRoleToAccount	greengrass:AssociateServiceRoleToAccount			Permissions management, Write
AssociateServiceRoleToAccount	iam:PassRole	iam:PassedToService	greengrass.amazonaws.com	Write
CreateConnectorDefinition	greengrass:CreateConnectorDefinition			Write
CreateConnectorDefinition	greengrass:TagResource			Tagging, Write
CreateConnectorDefinitionVersion	greengrass:CreateConnectorDefinitionVersion			Write
CreateCoreDefinition	greengrass:CreateCoreDefinition			Write
CreateCoreDefinition	greengrass:TagResource			Tagging, Write
CreateCoreDefinitionVersion	greengrass:CreateCoreDefinitionVersion			Write
CreateDeployment	greengrass:CreateDeployment			Write
CreateDeployment	greengrass:TagResource			Tagging, Write
CreateDeviceDefinition	greengrass:CreateDeviceDefinition			Write
CreateDeviceDefinition	greengrass:TagResource			Tagging, Write
CreateDeviceDefinitionVersion	greengrass:CreateDeviceDefinitionVersion			Write
CreateFunctionDefinition	greengrass:CreateFunctionDefinition			Write
CreateFunctionDefinition	greengrass:TagResource			Tagging, Write
CreateFunctionDefinitionVersion	greengrass:CreateFunctionDefinitionVersion			Write
CreateGroup	greengrass:CreateGroup			Write
CreateGroup	greengrass:TagResource			Tagging, Write
CreateGroupCertificateAuthority	greengrass:CreateGroupCertificateAuthority			Write
CreateGroupVersion	greengrass:CreateGroupVersion			Write
CreateLoggerDefinition	greengrass:CreateLoggerDefinition			Write
CreateLoggerDefinition	greengrass:TagResource			Tagging, Write
CreateLoggerDefinitionVersion	greengrass:CreateLoggerDefinitionVersion			Write
CreateResourceDefinition	greengrass:CreateResourceDefinition			Write
CreateResourceDefinition	greengrass:TagResource			Tagging, Write
CreateResourceDefinitionVersion	greengrass:CreateResourceDefinitionVersion			Write
CreateSoftwareUpdateJob	greengrass:CreateSoftwareUpdateJob			Write
CreateSoftwareUpdateJob	iam:PassRole	iam:PassedToService	greengrass.amazonaws.com	Write
CreateSubscriptionDefinition	greengrass:CreateSubscriptionDefinition			Write
CreateSubscriptionDefinition	greengrass:TagResource			Tagging, Write
CreateSubscriptionDefinitionVersion	greengrass:CreateSubscriptionDefinitionVersion			Write
DeleteConnectorDefinition	greengrass:DeleteConnectorDefinition			Write
DeleteCoreDefinition	greengrass:DeleteCoreDefinition			Write
DeleteDeviceDefinition	greengrass:DeleteDeviceDefinition			Write
DeleteFunctionDefinition	greengrass:DeleteFunctionDefinition			Write
DeleteGroup	greengrass:DeleteGroup			Write
DeleteLoggerDefinition	greengrass:DeleteLoggerDefinition			Write
DeleteResourceDefinition	greengrass:DeleteResourceDefinition			Write
DeleteSubscriptionDefinition	greengrass:DeleteSubscriptionDefinition			Write
DisassociateRoleFromGroup	greengrass:DisassociateRoleFromGroup			Write
DisassociateServiceRoleFromAccount	greengrass:DisassociateServiceRoleFromAccount			Write
GetAssociatedRole	greengrass:GetAssociatedRole			Read
GetBulkDeploymentStatus	greengrass:GetBulkDeploymentStatus			Read
GetConnectivityInfo	greengrass:GetConnectivityInfo			Read
GetConnectorDefinition	greengrass:GetConnectorDefinition			Read
GetConnectorDefinitionVersion	greengrass:GetConnectorDefinitionVersion			Read
GetCoreDefinition	greengrass:GetCoreDefinition			Read
GetCoreDefinitionVersion	greengrass:GetCoreDefinitionVersion			Read
GetDeploymentStatus	greengrass:GetDeploymentStatus			Read
GetDeviceDefinition	greengrass:GetDeviceDefinition			Read
GetDeviceDefinitionVersion	greengrass:GetDeviceDefinitionVersion			Read
GetFunctionDefinition	greengrass:GetFunctionDefinition			Read
GetFunctionDefinitionVersion	greengrass:GetFunctionDefinitionVersion			Read
GetGroup	greengrass:GetGroup			Read
GetGroupCertificateAuthority	greengrass:GetGroupCertificateAuthority			Read
GetGroupCertificateConfiguration	greengrass:GetGroupCertificateConfiguration			Read
GetGroupVersion	greengrass:GetGroupVersion			Read
GetLoggerDefinition	greengrass:GetLoggerDefinition			Read
GetLoggerDefinitionVersion	greengrass:GetLoggerDefinitionVersion			Read
GetResourceDefinition	greengrass:GetResourceDefinition			Read
GetResourceDefinitionVersion	greengrass:GetResourceDefinitionVersion			Read
GetServiceRoleForAccount	greengrass:GetServiceRoleForAccount			Read
GetSubscriptionDefinition	greengrass:GetSubscriptionDefinition			Read
GetSubscriptionDefinitionVersion	greengrass:GetSubscriptionDefinitionVersion			Read
GetThingRuntimeConfiguration	greengrass:GetThingRuntimeConfiguration			Read
ListBulkDeploymentDetailedReports	greengrass:ListBulkDeploymentDetailedReports			Read
ListBulkDeployments	greengrass:ListBulkDeployments			List
ListConnectorDefinitionVersions	greengrass:ListConnectorDefinitionVersions			List
ListConnectorDefinitions	greengrass:ListConnectorDefinitions			List
ListCoreDefinitionVersions	greengrass:ListCoreDefinitionVersions			List
ListCoreDefinitions	greengrass:ListCoreDefinitions			List
ListDeployments	greengrass:ListDeployments			List
ListDeviceDefinitionVersions	greengrass:ListDeviceDefinitionVersions			List
ListDeviceDefinitions	greengrass:ListDeviceDefinitions			List
ListFunctionDefinitionVersions	greengrass:ListFunctionDefinitionVersions			List
ListFunctionDefinitions	greengrass:ListFunctionDefinitions			List
ListGroupCertificateAuthorities	greengrass:ListGroupCertificateAuthorities			List
ListGroupVersions	greengrass:ListGroupVersions			List
ListGroups	greengrass:ListGroups			List
ListLoggerDefinitionVersions	greengrass:ListLoggerDefinitionVersions			List
ListLoggerDefinitions	greengrass:ListLoggerDefinitions			List
ListResourceDefinitionVersions	greengrass:ListResourceDefinitionVersions			List
ListResourceDefinitions	greengrass:ListResourceDefinitions			List
ListSubscriptionDefinitionVersions	greengrass:ListSubscriptionDefinitionVersions			List
ListSubscriptionDefinitions	greengrass:ListSubscriptionDefinitions			List
ListTagsForResource	greengrass:ListTagsForResource			Read
ResetDeployments	greengrass:ResetDeployments			Write
StartBulkDeployment	greengrass:StartBulkDeployment			Write
	greengrass:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	greengrass.amazonaws.com	Write
StopBulkDeployment	greengrass:StopBulkDeployment			Write
TagResource	greengrass:TagResource			Tagging, Write
UntagResource	greengrass:UntagResource			Tagging, Write
UpdateConnectivityInfo	greengrass:UpdateConnectivityInfo			Write
UpdateConnectorDefinition	greengrass:UpdateConnectorDefinition			Write
UpdateCoreDefinition	greengrass:UpdateCoreDefinition			Write
UpdateDeviceDefinition	greengrass:UpdateDeviceDefinition			Write
UpdateFunctionDefinition	greengrass:UpdateFunctionDefinition			Write
UpdateGroup	greengrass:UpdateGroup			Write
UpdateGroupCertificateConfiguration	greengrass:UpdateGroupCertificateConfiguration			Write
UpdateLoggerDefinition	greengrass:UpdateLoggerDefinition			Write
UpdateResourceDefinition	greengrass:UpdateResourceDefinition			Write
UpdateSubscriptionDefinition	greengrass:UpdateSubscriptionDefinition			Write
UpdateThingRuntimeConfiguration	greengrass:UpdateThingRuntimeConfiguration			Write

Actions defined by Amazon IoT Greengrass

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateRoleToGroup	Grants permission to associate a role with a group. The role's permissions must allow Greengrass core Lambda functions and connectors to perform actions in other Amazon services	group*	aws:ResourceTag/${TagKey}	Write
AssociateServiceRoleToAccount	Grants permission to associate a role with your account. Amazon IoT Greengrass uses this role to access your Lambda functions and Amazon IoT resources			Permissions management, Write
CreateConnectorDefinition	Grants permission to create a connector definition		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateConnectorDefinitionVersion	Grants permission to create a version of an existing connector definition	connectorDefinition*	aws:ResourceTag/${TagKey}	Write
CreateCoreDefinition	Grants permission to create a core definition		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateCoreDefinitionVersion	Grants permission to create a version of an existing core definition. Greengrass groups must each contain exactly one Greengrass core	coreDefinition*	aws:ResourceTag/${TagKey}	Write
CreateDeployment	Grants permission to create a deployment	group*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDeviceDefinition	Grants permission to create a device definition		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDeviceDefinitionVersion	Grants permission to create a version of an existing device definition	deviceDefinition*	aws:ResourceTag/${TagKey}	Write
CreateFunctionDefinition	Grants permission to create a Lambda function definition to be used in a group that contains a list of Lambda functions and their configurations		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateFunctionDefinitionVersion	Grants permission to create a version of an existing Lambda function definition	functionDefinition*	aws:ResourceTag/${TagKey}	Write
CreateGroup	Grants permission to create a group		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateGroupCertificateAuthority	Grants permission to create a CA for the group, or rotate the existing CA	group*	aws:ResourceTag/${TagKey}	Write
CreateGroupVersion	Grants permission to create a version of a group that has already been defined	group*	aws:ResourceTag/${TagKey}	Write
CreateLoggerDefinition	Grants permission to create a logger definition		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLoggerDefinitionVersion	Grants permission to create a version of an existing logger definition	loggerDefinition*	aws:ResourceTag/${TagKey}	Write
CreateResourceDefinition	Grants permission to create a resource definition that contains a list of resources to be used in a group		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateResourceDefinitionVersion	Grants permission to create a version of an existing resource definition	resourceDefinition*	aws:ResourceTag/${TagKey}	Write
CreateSoftwareUpdateJob	Grants permission to create an Amazon IoT job that will trigger your Greengrass cores to update the software they are running			Write
CreateSubscriptionDefinition	Grants permission to create a subscription definition		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateSubscriptionDefinitionVersion	Grants permission to create a version of an existing subscription definition	subscriptionDefinition*	aws:ResourceTag/${TagKey}	Write
DeleteConnectorDefinition	Grants permission to delete a connector definition	connectorDefinition*	aws:ResourceTag/${TagKey}	Write
DeleteCoreDefinition	Grants permission to delete a core definition. Deleting a definition that is currently in use in a deployment affects future deployments	coreDefinition*	aws:ResourceTag/${TagKey}	Write
DeleteDeviceDefinition	Grants permission to delete a device definition. Deleting a definition that is currently in use in a deployment affects future deployments	deviceDefinition*	aws:ResourceTag/${TagKey}	Write
DeleteFunctionDefinition	Grants permission to delete a Lambda function definition. Deleting a definition that is currently in use in a deployment affects future deployments	functionDefinition*	aws:ResourceTag/${TagKey}	Write
DeleteGroup	Grants permission to delete a group that is not currently in use in a deployment	group*	aws:ResourceTag/${TagKey}	Write
DeleteLoggerDefinition	Grants permission to delete a logger definition. Deleting a definition that is currently in use in a deployment affects future deployments	loggerDefinition*	aws:ResourceTag/${TagKey}	Write
DeleteResourceDefinition	Grants permission to delete a resource definition	resourceDefinition*	aws:ResourceTag/${TagKey}	Write
DeleteSubscriptionDefinition	Grants permission to delete a subscription definition. Deleting a definition that is currently in use in a deployment affects future deployments	subscriptionDefinition*	aws:ResourceTag/${TagKey}	Write
DisassociateRoleFromGroup	Grants permission to disassociate the role from a group	group*	aws:ResourceTag/${TagKey}	Write
DisassociateServiceRoleFromAccount	Grants permission to disassociate the service role from an account. Without a service role, deployments will not work			Write
Discover	Grants permission to retrieve information required to connect to a Greengrass core	thing*		Read
GetAssociatedRole	Grants permission to retrieve the role associated with a group	group*	aws:ResourceTag/${TagKey}	Read
GetBulkDeploymentStatus	Grants permission to return the status of a bulk deployment	bulkDeployment*	aws:ResourceTag/${TagKey}	Read
GetConnectivityInfo	Grants permission to retrieve the connectivity information for a core	connectivityInfo*		Read
GetConnectorDefinition	Grants permission to retrieve information about a connector definition	connectorDefinition*	aws:ResourceTag/${TagKey}	Read
GetConnectorDefinitionVersion	Grants permission to retrieve information about a connector definition version	connectorDefinition*	aws:ResourceTag/${TagKey}	Read
GetConnectorDefinitionVersion		connectorDefinitionVersion*		Read
GetCoreDefinition	Grants permission to retrieve information about a core definition	coreDefinition*	aws:ResourceTag/${TagKey}	Read
GetCoreDefinitionVersion	Grants permission to retrieve information about a core definition version	coreDefinition*	aws:ResourceTag/${TagKey}	Read
GetCoreDefinitionVersion		coreDefinitionVersion*		Read
GetDeploymentStatus	Grants permission to return the status of a deployment	deployment*	aws:ResourceTag/${TagKey}	Read
GetDeploymentStatus	Grants permission to return the status of a deployment	group*	aws:ResourceTag/${TagKey}	Read
GetDeviceDefinition	Grants permission to retrieve information about a device definition	deviceDefinition*	aws:ResourceTag/${TagKey}	Read
GetDeviceDefinitionVersion	Grants permission to retrieve information about a device definition version	deviceDefinition*	aws:ResourceTag/${TagKey}	Read
GetDeviceDefinitionVersion		deviceDefinitionVersion*		Read
GetFunctionDefinition	Grants permission to retrieve information about a Lambda function definition, such as its creation time and latest version	functionDefinition*	aws:ResourceTag/${TagKey}	Read
GetFunctionDefinitionVersion	Grants permission to retrieve information about a Lambda function definition version, such as which Lambda functions are included in the version and their configurations	functionDefinition*	aws:ResourceTag/${TagKey}	Read
GetFunctionDefinitionVersion		functionDefinitionVersion*		Read
GetGroup	Grants permission to retrieve information about a group	group*	aws:ResourceTag/${TagKey}	Read
GetGroupCertificateAuthority	Grants permission to return the public key of the CA associated with a group	certificateAuthority*		Read
GetGroupCertificateAuthority		group*	aws:ResourceTag/${TagKey}	Read
GetGroupCertificateConfiguration	Grants permission to retrieve the current configuration for the CA used by a group	group*	aws:ResourceTag/${TagKey}	Read
GetGroupVersion	Grants permission to retrieve information about a group version	group*	aws:ResourceTag/${TagKey}	Read
GetGroupVersion		groupVersion*		Read
GetLoggerDefinition	Grants permission to retrieve information about a logger definition	loggerDefinition*	aws:ResourceTag/${TagKey}	Read
GetLoggerDefinitionVersion	Grants permission to retrieve information about a logger definition version	loggerDefinition*	aws:ResourceTag/${TagKey}	Read
GetLoggerDefinitionVersion		loggerDefinitionVersion*		Read
GetResourceDefinition	Grants permission to retrieve information about a resource definition, such as its creation time and latest version	resourceDefinition*	aws:ResourceTag/${TagKey}	Read
GetResourceDefinitionVersion	Grants permission to retrieve information about a resource definition version, such as which resources are included in the version	resourceDefinition*	aws:ResourceTag/${TagKey}	Read
GetResourceDefinitionVersion		resourceDefinitionVersion*		Read
GetServiceRoleForAccount	Grants permission to retrieve the service role that is attached to an account			Read
GetSubscriptionDefinition	Grants permission to retrieve information about a subscription definition	subscriptionDefinition*	aws:ResourceTag/${TagKey}	Read
GetSubscriptionDefinitionVersion	Grants permission to retrieve information about a subscription definition version	subscriptionDefinition*	aws:ResourceTag/${TagKey}	Read
GetSubscriptionDefinitionVersion		subscriptionDefinitionVersion*		Read
GetThingRuntimeConfiguration	Grants permission to retrieve runtime configuration of a thing	thingRuntimeConfig*		Read
ListBulkDeploymentDetailedReports	Grants permission to retrieve a paginated list of the deployments that have been started in a bulk deployment operation and their current deployment status	bulkDeployment*	aws:ResourceTag/${TagKey}	Read
ListBulkDeployments	Grants permission to retrieve a list of bulk deployments			List
ListConnectorDefinitionVersions	Grants permission to list the versions of a connector definition	connectorDefinition*	aws:ResourceTag/${TagKey}	List
ListConnectorDefinitions	Grants permission to retrieve a list of connector definitions			List
ListCoreDefinitionVersions	Grants permission to list the versions of a core definition	coreDefinition*	aws:ResourceTag/${TagKey}	List
ListCoreDefinitions	Grants permission to retrieve a list of core definitions			List
ListDeployments	Grants permission to retrieve a list of all deployments for a group	group*	aws:ResourceTag/${TagKey}	List
ListDeviceDefinitionVersions	Grants permission to list the versions of a device definition	deviceDefinition*	aws:ResourceTag/${TagKey}	List
ListDeviceDefinitions	Grants permission to retrieve a list of device definitions			List
ListFunctionDefinitionVersions	Grants permission to list the versions of a Lambda function definition	functionDefinition*	aws:ResourceTag/${TagKey}	List
ListFunctionDefinitions	Grants permission to retrieve a list of Lambda function definitions			List
ListGroupCertificateAuthorities	Grants permission to retrieve a list of current CAs for a group	group*	aws:ResourceTag/${TagKey}	List
ListGroupVersions	Grants permission to list the versions of a group	group*	aws:ResourceTag/${TagKey}	List
ListGroups	Grants permission to retrieve a list of groups			List
ListLoggerDefinitionVersions	Grants permission to list the versions of a logger definition	loggerDefinition*	aws:ResourceTag/${TagKey}	List
ListLoggerDefinitions	Grants permission to retrieve a list of logger definitions			List
ListResourceDefinitionVersions	Grants permission to list the versions of a resource definition	resourceDefinition*	aws:ResourceTag/${TagKey}	List
ListResourceDefinitions	Grants permission to retrieve a list of resource definitions			List
ListSubscriptionDefinitionVersions	Grants permission to list the versions of a subscription definition	subscriptionDefinition*	aws:ResourceTag/${TagKey}	List
ListSubscriptionDefinitions	Grants permission to retrieve a list of subscription definitions			List
ListTagsForResource	Grants permission to list the tags for a resource	bulkDeployment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
		connectorDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		coreDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		deployment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		deviceDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		functionDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		group	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		loggerDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		resourceDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		subscriptionDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
ResetDeployments	Grants permission to reset a group's deployments	group*	aws:ResourceTag/${TagKey}	Write
StartBulkDeployment	Grants permission to deploy multiple groups in one operation		aws:RequestTag/${TagKey} aws:TagKeys	Write
StopBulkDeployment	Grants permission to stop the execution of a bulk deployment	bulkDeployment*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add tags to a resource	bulkDeployment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		connectorDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		coreDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		deployment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		deviceDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		functionDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		group	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		loggerDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		resourceDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		subscriptionDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from a resource	bulkDeployment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		connectorDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		coreDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		deployment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		deviceDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		functionDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		group	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		loggerDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		resourceDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		subscriptionDefinition	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UpdateConnectivityInfo	Grants permission to update the connectivity information for a Greengrass core. Any devices that belong to the group that has this core will receive this information in order to find the location of the core and connect to it	connectivityInfo*		Write
UpdateConnectorDefinition	Grants permission to update a connector definition	connectorDefinition*	aws:ResourceTag/${TagKey}	Write
UpdateCoreDefinition	Grants permission to update a core definition	coreDefinition*	aws:ResourceTag/${TagKey}	Write
UpdateDeviceDefinition	Grants permission to update a device definition	deviceDefinition*	aws:ResourceTag/${TagKey}	Write
UpdateFunctionDefinition	Grants permission to update a Lambda function definition	functionDefinition*	aws:ResourceTag/${TagKey}	Write
UpdateGroup	Grants permission to update a group	group*	aws:ResourceTag/${TagKey}	Write
UpdateGroupCertificateConfiguration	Grants permission to update the certificate expiry time for a group	group*	aws:ResourceTag/${TagKey}	Write
UpdateLoggerDefinition	Grants permission to update a logger definition	loggerDefinition*	aws:ResourceTag/${TagKey}	Write
UpdateResourceDefinition	Grants permission to update a resource definition	resourceDefinition*	aws:ResourceTag/${TagKey}	Write
UpdateSubscriptionDefinition	Grants permission to update a subscription definition	subscriptionDefinition*	aws:ResourceTag/${TagKey}	Write
UpdateThingRuntimeConfiguration	Grants permission to update runtime configuration of a thing	thingRuntimeConfig*		Write

Resource types defined by Amazon IoT Greengrass

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
bulkDeployment	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/bulk/deployments/${BulkDeploymentId}	aws:ResourceTag/${TagKey}
certificateAuthority	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/groups/${GroupId}/certificateauthorities/${CertificateAuthorityId}
connectivityInfo	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/things/${ThingName}/connectivityInfo
connectorDefinition	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/connectors/${ConnectorDefinitionId}	aws:ResourceTag/${TagKey}
connectorDefinitionVersion	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/connectors/${ConnectorDefinitionId}/versions/${VersionId}
coreDefinition	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/cores/${CoreDefinitionId}	aws:ResourceTag/${TagKey}
coreDefinitionVersion	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/cores/${CoreDefinitionId}/versions/${VersionId}
deployment	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/groups/${GroupId}/deployments/${DeploymentId}, arn:${Partition}:greengrass:${Region}:${Account}:deployments:${DeploymentId}	aws:ResourceTag/${TagKey}
deviceDefinition	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/devices/${DeviceDefinitionId}	aws:ResourceTag/${TagKey}
deviceDefinitionVersion	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/devices/${DeviceDefinitionId}/versions/${VersionId}
functionDefinition	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/functions/${FunctionDefinitionId}	aws:ResourceTag/${TagKey}
functionDefinitionVersion	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/functions/${FunctionDefinitionId}/versions/${VersionId}
group	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/groups/${GroupId}	aws:ResourceTag/${TagKey}
groupVersion	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/groups/${GroupId}/versions/${VersionId}
loggerDefinition	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/loggers/${LoggerDefinitionId}	aws:ResourceTag/${TagKey}
loggerDefinitionVersion	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/loggers/${LoggerDefinitionId}/versions/${VersionId}
resourceDefinition	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/resources/${ResourceDefinitionId}	aws:ResourceTag/${TagKey}
resourceDefinitionVersion	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/resources/${ResourceDefinitionId}/versions/${VersionId}
subscriptionDefinition	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/subscriptions/${SubscriptionDefinitionId}	aws:ResourceTag/${TagKey}
subscriptionDefinitionVersion	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/definition/subscriptions/${SubscriptionDefinitionId}/versions/${VersionId}
thing	arn:${Partition}:iot:${Region}:${Account}:thing/${ThingName}
thingRuntimeConfig	arn:${Partition}:greengrass:${Region}:${Account}:/greengrass/things/${ThingName}/runtimeconfig

Condition keys for Amazon IoT Greengrass

Amazon IoT Greengrass defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the allowed set of values for each of the mandatory tags	String
aws:ResourceTag/${TagKey}	Filters access by the tag value associated with the resource	String
aws:TagKeys	Filters access by the presence of mandatory tags in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon IoT Events (iotevents)

Amazon IoT Greengrass V2 (greengrass)