Actions, resources, and condition keys for Amazon IoT Events

Amazon IoT Events (service prefix: iotevents) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

Actions defined by Amazon IoT Events
Resource types defined by Amazon IoT Events
Condition keys for Amazon IoT Events

Actions defined by Amazon IoT Events

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchAcknowledgeAlarm	Grants permission to send one or more acknowledge action requests to Amazon IoT Events	alarmModel*	aws:ResourceTag/${TagKey}	Write
BatchDeleteDetector	Grants permission to delete a detector instance within the Amazon IoT Events system	detectorModel*	aws:ResourceTag/${TagKey}	Write
BatchDisableAlarm	Grants permission to disable one or more alarm instances	alarmModel*	aws:ResourceTag/${TagKey}	Write
BatchEnableAlarm	Grants permission to enable one or more alarm instances	alarmModel*	aws:ResourceTag/${TagKey}	Write
BatchPutMessage	Grants permission to send a set of messages to the Amazon IoT Events system	input*	aws:ResourceTag/${TagKey}	Write
BatchResetAlarm	Grants permission to reset one or more alarm instances	alarmModel*	aws:ResourceTag/${TagKey}	Write
BatchSnoozeAlarm	Grants permission to change one or more alarm instances to the snooze mode	alarmModel*	aws:ResourceTag/${TagKey}	Write
BatchUpdateDetector	Grants permission to update a detector instance within the Amazon IoT Events system	detectorModel*	aws:ResourceTag/${TagKey}	Write
CreateAlarmModel	Grants permission to create an alarm model to monitor an Amazon IoT Events input attribute or an Amazon IoT SiteWise asset property	alarmModel*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDetectorModel	Grants permission to create a detector model to monitor an Amazon IoT Events input attribute	detectorModel*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateInput	Grants permission to create an Input in IotEvents	input*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAlarmModel	Grants permission to delete an alarm model	alarmModel*	aws:ResourceTag/${TagKey}	Write
DeleteDetectorModel	Grants permission to delete a detector model	detectorModel*	aws:ResourceTag/${TagKey}	Write
DeleteInput	Grants permission to delete an input	input*	aws:ResourceTag/${TagKey}	Write
DescribeAlarm	Grants permission to retrieve information about an alarm instance	alarmModel*	aws:ResourceTag/${TagKey}	Read
DescribeAlarmModel	Grants permission to retrieve information about an alarm model	alarmModel*	aws:ResourceTag/${TagKey}	Read
DescribeDetector	Grants permission to retriev information about a detector instance	detectorModel*	aws:ResourceTag/${TagKey}	Read
DescribeDetectorModel	Grants permission to retrieve information about a detector model	detectorModel*	aws:ResourceTag/${TagKey}	Read
DescribeDetectorModelAnalysis	Grants permission to retrieve the detector model analysis information			Read
DescribeInput	Grants permission to retrieve an information about Input	input*	aws:ResourceTag/${TagKey}	Read
DescribeLoggingOptions	Grants permission to retrieve the current settings of the Amazon IoT Events logging options			Read
GetDetectorModelAnalysisResults	Grants permission to retrieve the detector model analysis results			Read
ListAlarmModelVersions	Grants permission to list all the versions of an alarm model	alarmModel*	aws:ResourceTag/${TagKey}	List
ListAlarmModels	Grants permission to list the alarm models that you created			List
ListAlarms	Grants permission to retrieve information about all alarm instances per alarmModel	alarmModel*	aws:ResourceTag/${TagKey}	List
ListDetectorModelVersions	Grants permission to list all the versions of a detector model	detectorModel*	aws:ResourceTag/${TagKey}	List
ListDetectorModels	Grants permission to list the detector models that you created			List
ListDetectors	Grants permission to retrieve information about all detector instances per detectormodel	detectorModel*	aws:ResourceTag/${TagKey}	List
ListInputRoutings	Grants permission to list one or more input routings			List
ListInputs	Grants permission to lists the inputs you have created			List
ListTagsForResource	Grants permission to list the tags (metadata) which you have assigned to the resource	alarmModel	aws:ResourceTag/${TagKey}	Read
		detectorModel	aws:ResourceTag/${TagKey}
		input	aws:ResourceTag/${TagKey}
PutLoggingOptions	Grants permission to set or update the Amazon IoT Events logging options			Write
StartDetectorModelAnalysis	Grants permission to start the detector model analysis			Write
TagResource	Grants permission to adds to or modifies the tags of the given resource.Tags are metadata which can be used to manage a resource	alarmModel	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		detectorModel	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		input	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove the given tags (metadata) from the resource	alarmModel	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		detectorModel	aws:ResourceTag/${TagKey} aws:TagKeys
		input	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAlarmModel	Grants permission to update an alarm model	alarmModel*	aws:ResourceTag/${TagKey}	Write
UpdateDetectorModel	Grants permission to update a detector model	detectorModel*	aws:ResourceTag/${TagKey}	Write
UpdateInput	Grants permission to update an input	input*	aws:ResourceTag/${TagKey}	Write
UpdateInputRouting	Grants permission to update input routing	input*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon IoT Events

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
alarmModel	arn:${Partition}:iotevents:${Region}:${Account}:alarmModel/${AlarmModelName}	aws:ResourceTag/${TagKey}
detectorModel	arn:${Partition}:iotevents:${Region}:${Account}:detectorModel/${DetectorModelName}	aws:ResourceTag/${TagKey}
input	arn:${Partition}:iotevents:${Region}:${Account}:input/${InputName}	aws:ResourceTag/${TagKey}

Condition keys for Amazon IoT Events

Amazon IoT Events defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags attached to the resource	String
aws:TagKeys	Filters actions by the tag keys in the request	ArrayOfString
iotevents:keyValue	Filters access by the instanceId (key-value) of the message	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon IoT Analytics (iotanalytics)

Amazon IoT Greengrass (greengrass)