Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Kinesis Data Streams

Amazon Kinesis Data Streams (service prefix: kinesis) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Kinesis Data Streams
Actions defined by Amazon Kinesis Data Streams
Permission-only actions for Amazon Kinesis Data Streams
Resource types defined by Amazon Kinesis Data Streams
Condition keys for Amazon Kinesis Data Streams

API operations defined by Amazon Kinesis Data Streams

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AddTagsToStream	kinesis:AddTagsToStream	Tagging, Write
CreateStream	kinesis:AddTagsToStream	Tagging, Write
CreateStream	kinesis:CreateStream	Write
DecreaseStreamRetentionPeriod	kinesis:DecreaseStreamRetentionPeriod	Write
DeleteResourcePolicy	kinesis:DeleteResourcePolicy	Write
DeleteStream	kinesis:DeleteStream	Write
DeregisterStreamConsumer	kinesis:DeregisterStreamConsumer	Write
DescribeAccountSettings	kinesis:DescribeAccountSettings	Read
DescribeLimits	kinesis:DescribeLimits	Read
DescribeStream	kinesis:DescribeStream	Read
DescribeStreamConsumer	kinesis:DescribeStreamConsumer	Read
DescribeStreamSummary	kinesis:DescribeStreamSummary	Read
DisableEnhancedMonitoring	kinesis:DisableEnhancedMonitoring	Write
EnableEnhancedMonitoring	kinesis:EnableEnhancedMonitoring	Write
GetRecords	kinesis:GetRecords	Read
GetResourcePolicy	kinesis:GetResourcePolicy	Read
GetShardIterator	kinesis:GetShardIterator	Read
IncreaseStreamRetentionPeriod	kinesis:IncreaseStreamRetentionPeriod	Write
ListShards	kinesis:ListShards	List
ListStreamConsumers	kinesis:ListStreamConsumers	List
ListStreams	kinesis:ListStreams	List
ListTagsForResource	kinesis:ListTagsForResource	Read
ListTagsForStream	kinesis:ListTagsForStream	Read
MergeShards	kinesis:MergeShards	Write
PutRecord	kinesis:PutRecord	Write
PutRecords	kinesis:PutRecords	Write
PutResourcePolicy	kinesis:PutResourcePolicy	Write
RegisterStreamConsumer	kinesis:RegisterStreamConsumer	Write
RegisterStreamConsumer	kinesis:TagResource	Tagging, Write
RemoveTagsFromStream	kinesis:RemoveTagsFromStream	Tagging, Write
SplitShard	kinesis:SplitShard	Write
StartStreamEncryption	kinesis:StartStreamEncryption	Write
StopStreamEncryption	kinesis:StopStreamEncryption	Write
SubscribeToShard	kinesis:SubscribeToShard	Read
TagResource	kinesis:TagResource	Tagging, Write
UntagResource	kinesis:UntagResource	Tagging, Write
UpdateAccountSettings	kinesis:UpdateAccountSettings	Write
UpdateMaxRecordSize	kinesis:UpdateMaxRecordSize	Write
UpdateShardCount	kinesis:UpdateShardCount	Write
UpdateStreamMode	kinesis:UpdateStreamMode	Write
UpdateStreamWarmThroughput	kinesis:UpdateStreamWarmThroughput	Write

Actions defined by Amazon Kinesis Data Streams

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AddTagsToStream	Grants permission to add or update tags for the specified Amazon Kinesis stream. Each stream can have up to 50 tags	stream*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
CreateStream	Grants permission to create a Amazon Kinesis stream	stream*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DecreaseStreamRetentionPeriod	Grants permission to decrease the stream's retention period, which is the length of time data records are accessible after they are added to the stream	stream*	aws:ResourceTag/${TagKey}	Write
DeleteResourcePolicy	Grants permission to delete a resource policy associated with a specified stream or consumer	consumer*	aws:ResourceTag/${TagKey}	Write
DeleteResourcePolicy		stream*	aws:ResourceTag/${TagKey}	Write
DeleteStream	Grants permission to delete a stream and all its shards and data	stream*	aws:ResourceTag/${TagKey}	Write
DeregisterStreamConsumer	Grants permission to deregister a stream consumer with a Kinesis data stream	consumer*	aws:ResourceTag/${TagKey}	Write
DescribeAccountSettings	Grants permission to describe the account-level settings for Amazon Kinesis Data Streams			Read
DescribeLimits	Grants permission to describe the shard limits and usage for the account			Read
DescribeStream	Grants permission to describe the specified stream	stream*	aws:ResourceTag/${TagKey}	Read
DescribeStreamConsumer	Grants permission to get the description of a registered stream consumer	consumer*	aws:ResourceTag/${TagKey}	Read
DescribeStreamSummary	Grants permission to provide a summarized description of the specified Kinesis data stream without the shard list	stream*	aws:ResourceTag/${TagKey}	Read
DisableEnhancedMonitoring	Grants permission to disables enhanced monitoring			Write
EnableEnhancedMonitoring	Grants permission to enable enhanced Kinesis data stream monitoring for shard-level metrics			Write
GetRecords	Grants permission to get data records from a shard	stream*	aws:ResourceTag/${TagKey}	Read
GetResourcePolicy	Grants permission to get a resource policy associated with a specified stream or consumer	consumer*	aws:ResourceTag/${TagKey}	Read
GetResourcePolicy		stream*	aws:ResourceTag/${TagKey}	Read
GetShardIterator	Grants permission to get a shard iterator. A shard iterator expires five minutes after it is returned to the requester	stream*	aws:ResourceTag/${TagKey}	Read
IncreaseStreamRetentionPeriod	Grants permission to increase the stream's retention period, which is the length of time data records are accessible after they are added to the stream	stream*	aws:ResourceTag/${TagKey}	Write
ListShards	Grants permission to list the shards in a stream and provides information about each shard	stream*	aws:ResourceTag/${TagKey}	List
ListStreamConsumers	Grants permission to list the stream consumers registered to receive data from a Kinesis stream using enhanced fan-out, and provides information about each consumer	stream*	aws:ResourceTag/${TagKey}	List
ListStreams	Grants permission to list your streams			List
ListTagsForResource	Grants permission to list the tags for the specified Amazon Kinesis resource	consumer*	aws:ResourceTag/${TagKey}	Read
ListTagsForResource		stream*	aws:ResourceTag/${TagKey}	Read
ListTagsForStream	Grants permission to list the tags for the specified Amazon Kinesis stream	stream*	aws:ResourceTag/${TagKey}	Read
MergeShards	Grants permission to merge two adjacent shards in a stream and combines them into a single shard to reduce the stream's capacity to ingest and transport data	stream*	aws:ResourceTag/${TagKey}	Write
PutRecord	Grants permission to write a single data record from a producer into an Amazon Kinesis stream	stream*	aws:ResourceTag/${TagKey}	Write
PutRecords	Grants permission to write multiple data records from a producer into an Amazon Kinesis stream in a single call (also referred to as a PutRecords request)	stream*	aws:ResourceTag/${TagKey}	Write
PutResourcePolicy	Grants permission to attach a resource policy to a specified stream or consumer	consumer*	aws:ResourceTag/${TagKey}	Write
PutResourcePolicy		stream*	aws:ResourceTag/${TagKey}	Write
RegisterStreamConsumer	Grants permission to register a stream consumer with a Kinesis data stream	stream*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
RemoveTagsFromStream	Grants permission to remove tags from the specified Kinesis data stream. Removed tags are deleted and cannot be recovered after this operation successfully completes	stream*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
SplitShard	Grants permission to split a shard into two new shards in the Kinesis data stream, to increase the stream's capacity to ingest and transport data	stream*	aws:ResourceTag/${TagKey}	Write
StartStreamEncryption	Grants permission to enable or update server-side encryption using an Amazon KMS key for a specified stream	kmsKey*	aws:ResourceTag/${TagKey}	Write
StartStreamEncryption		stream*	aws:ResourceTag/${TagKey}	Write
StopStreamEncryption	Grants permission to disable server-side encryption for a specified stream	kmsKey*	aws:ResourceTag/${TagKey}	Write
StopStreamEncryption		stream*	aws:ResourceTag/${TagKey}	Write
SubscribeToShard	Grants permission to listen to a specific shard with enhanced fan-out	consumer*	aws:ResourceTag/${TagKey}	Read
TagResource	Grants permission to add or update tags for the specified Amazon Kinesis resource. Each resource can have up to 50 tags	consumer*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource		stream*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from the specified Kinesis data resource. Removed tags are deleted and cannot be recovered after this operation successfully completes	consumer*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource		stream*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateAccountSettings	Grants permission to update the account-level settings for Amazon Kinesis Data Streams			Write
UpdateMaxRecordSize	Grants permission to update the maximum record size for a Kinesis data stream	stream*	aws:ResourceTag/${TagKey}	Write
UpdateShardCount	Grants permission to update the shard count of the specified stream to the specified number of shards			Write
UpdateStreamMode	Grants permission to update the capacity mode of the data stream			Write
UpdateStreamWarmThroughput	Grants permission to update the warm throughput for a Kinesis on-demand data stream	stream*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon Kinesis Data Streams

The following actions are defined by Amazon Kinesis Data Streams but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
InjectApiError	Grants permission to temporarily inject errors for target API requests		kinesis:FisActionId kinesis:FisInjectPercentage kinesis:FisTargetArns	Write

Actions

Description

Resource types (*required)

Condition keys

Access level

InjectApiError

Grants permission to temporarily inject errors for target API requests

kinesis:FisActionId

kinesis:FisInjectPercentage

kinesis:FisTargetArns

Write

Resource types defined by Amazon Kinesis Data Streams

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
consumer	arn:${Partition}:kinesis:${Region}:${Account}:${StreamType}/${StreamName}/consumer/${ConsumerName}:${ConsumerCreationTimpstamp}	aws:ResourceTag/${TagKey}
kmsKey	arn:${Partition}:kms:${Region}:${Account}:key/${KeyId}	aws:ResourceTag/${TagKey}
stream	arn:${Partition}:kinesis:${Region}:${Account}:stream/${StreamName}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Kinesis Data Streams

Amazon Kinesis Data Streams defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString
kinesis:FisActionId	Filters access by the ID of an Amazon FIS action	String
kinesis:FisInjectPercentage	Filters access by the percentage of calls being affected by an Amazon FIS action	Numeric
kinesis:FisTargetArns	Filters access by the ARN of an Amazon FIS target	ArrayOfARN

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Kinesis Analytics V2 (kinesisanalytics)

Amazon Kinesis Firehose (firehose)