Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Redshift Serverless

Amazon Redshift Serverless (service prefix: redshift-serverless) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Redshift Serverless
Actions defined by Amazon Redshift Serverless
Permission-only actions for Amazon Redshift Serverless
Resource types defined by Amazon Redshift Serverless
Condition keys for Amazon Redshift Serverless

API operations defined by Amazon Redshift Serverless

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
ConvertRecoveryPointToSnapshot	redshift-serverless:ConvertRecoveryPointToSnapshot			Write
ConvertRecoveryPointToSnapshot	redshift-serverless:TagResource			Tagging, Write
CreateCustomDomainAssociation	redshift-serverless:CreateCustomDomainAssociation			Write
CreateEndpointAccess	redshift-serverless:CreateEndpointAccess			Write
CreateNamespace	redshift-serverless:CreateNamespace			Write
	redshift-serverless:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	redshift-serverless.amazonaws.com	Write
CreateReservation	redshift-serverless:CreateReservation			Write
CreateScheduledAction	redshift-serverless:CreateScheduledAction			Write
	redshift-serverless:CreateSnapshot			Write
	iam:PassRole	iam:PassedToService	redshift-serverless.amazonaws.com	Write
CreateSnapshot	redshift-serverless:CreateSnapshot			Write
CreateSnapshot	redshift-serverless:TagResource			Tagging, Write
CreateSnapshotCopyConfiguration	redshift-serverless:CreateSnapshotCopyConfiguration			Write
CreateUsageLimit	redshift-serverless:CreateUsageLimit			Write
CreateWorkgroup	redshift-serverless:CreateWorkgroup			Write
CreateWorkgroup	redshift-serverless:TagResource			Tagging, Write
DeleteCustomDomainAssociation	redshift-serverless:DeleteCustomDomainAssociation			Write
DeleteEndpointAccess	redshift-serverless:DeleteEndpointAccess			Write
DeleteNamespace	redshift-serverless:DeleteNamespace			Write
DeleteResourcePolicy	redshift-serverless:DeleteResourcePolicy			Write
DeleteScheduledAction	redshift-serverless:DeleteScheduledAction			Write
DeleteSnapshot	redshift-serverless:DeleteSnapshot			Write
DeleteSnapshotCopyConfiguration	redshift-serverless:DeleteSnapshotCopyConfiguration			Write
DeleteUsageLimit	redshift-serverless:DeleteUsageLimit			Write
DeleteWorkgroup	redshift-serverless:DeleteWorkgroup			Write
GetCredentials	redshift-serverless:GetCredentials			Write
GetCustomDomainAssociation	redshift-serverless:GetCustomDomainAssociation			Read
GetEndpointAccess	redshift-serverless:GetEndpointAccess			Read
GetIdentityCenterAuthToken	redshift-serverless:GetIdentityCenterAuthToken			Read
GetNamespace	redshift-serverless:GetNamespace			Read
GetRecoveryPoint	redshift-serverless:GetRecoveryPoint			Read
GetReservation	redshift-serverless:GetReservation			Read
GetReservationOffering	redshift-serverless:GetReservationOffering			Read
GetResourcePolicy	redshift-serverless:GetResourcePolicy			Read
GetScheduledAction	redshift-serverless:GetScheduledAction			Read
GetSnapshot	redshift-serverless:GetSnapshot			Read
GetTableRestoreStatus	redshift-serverless:GetTableRestoreStatus			Read
GetTrack	redshift-serverless:GetTrack			Read
GetUsageLimit	redshift-serverless:GetUsageLimit			Read
GetWorkgroup	redshift-serverless:GetWorkgroup			Read
ListCustomDomainAssociations	redshift-serverless:ListCustomDomainAssociations			List
ListEndpointAccess	redshift-serverless:ListEndpointAccess			List
ListManagedWorkgroups	redshift-serverless:ListManagedWorkgroups			List
ListNamespaces	redshift-serverless:ListNamespaces			List
ListRecoveryPoints	redshift-serverless:ListRecoveryPoints			List
ListReservationOfferings	redshift-serverless:ListReservationOfferings			List
ListReservations	redshift-serverless:ListReservations			List
ListScheduledActions	redshift-serverless:ListScheduledActions			List
ListSnapshotCopyConfigurations	redshift-serverless:ListSnapshotCopyConfigurations			List
ListSnapshots	redshift-serverless:ListSnapshots			List
ListTableRestoreStatus	redshift-serverless:ListTableRestoreStatus			List
ListTagsForResource	redshift-serverless:ListTagsForResource			List
ListTracks	redshift-serverless:ListTracks			List
ListUsageLimits	redshift-serverless:ListUsageLimits			List
ListWorkgroups	redshift-serverless:ListWorkgroups			List
PutResourcePolicy	redshift-serverless:PutResourcePolicy			Write
RestoreFromRecoveryPoint	redshift-serverless:RestoreFromRecoveryPoint			Write
RestoreFromSnapshot	redshift-serverless:RestoreFromSnapshot			Write
RestoreTableFromRecoveryPoint	redshift-serverless:RestoreTableFromRecoveryPoint			Write
RestoreTableFromSnapshot	redshift-serverless:RestoreTableFromSnapshot			Write
TagResource	redshift-serverless:TagResource			Tagging, Write
UntagResource	redshift-serverless:UntagResource			Tagging, Write
UpdateCustomDomainAssociation	redshift-serverless:UpdateCustomDomainAssociation			Write
UpdateEndpointAccess	redshift-serverless:UpdateEndpointAccess			Write
UpdateLakehouseConfiguration	iam:PassRole	iam:PassedToService	redshift-serverless.amazonaws.com	Write
	redshift:AssociateDataShareConsumer			Write
	redshift:DeregisterNamespace			Write
	redshift:RegisterNamespace			Write
UpdateNamespace	redshift-serverless:UpdateNamespace			Write
UpdateNamespace	iam:PassRole	iam:PassedToService	redshift-serverless.amazonaws.com	Write
UpdateScheduledAction	redshift-serverless:CreateSnapshot			Write
	redshift-serverless:UpdateScheduledAction			Write
	iam:PassRole	iam:PassedToService	redshift-serverless.amazonaws.com	Write
UpdateSnapshot	redshift-serverless:UpdateSnapshot			Write
UpdateSnapshotCopyConfiguration	redshift-serverless:UpdateSnapshotCopyConfiguration			Write
UpdateUsageLimit	redshift-serverless:UpdateUsageLimit			Write
UpdateWorkgroup	redshift-serverless:UpdateWorkgroup			Write

Actions defined by Amazon Redshift Serverless

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
ConvertRecoveryPointToSnapshot	Grants permission to convert a recovery point to a snapshot	recoveryPoint*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
ConvertRecoveryPointToSnapshot	Grants permission to convert a recovery point to a snapshot	snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCustomDomainAssociation	Grants permission to create a custom domain association in Amazon Redshift Serverless	workgroup*	aws:ResourceTag/${TagKey}	Write
CreateEndpointAccess	Grants permission to create an Amazon Redshift Serverless managed VPC endpoint	endpointAccess*		Write
CreateNamespace	Grants permission to create an Amazon Redshift Serverless namespace	namespace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateReservation	Grants permission to purchase a capacity reservation according to a specific reservation offering, for a specified number of RPUs			Write
CreateScheduledAction	Grants permission to create a scheduled action for a specified Amazon Redshift Serverless namespace	namespace*	aws:ResourceTag/${TagKey}	Write
CreateSnapshot	Grants permission to create a snapshot of all databases in a namespace	namespace*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSnapshot		snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSnapshotCopyConfiguration	Grants permission to create a snapshot copy configuration for a specified Amazon Redshift Serverless namespace	namespace*	aws:ResourceTag/${TagKey}	Write
CreateUsageLimit	Grants permission to create a usage limit for a specified Amazon Redshift Serverless usage type			Write
CreateWorkgroup	Grants permission to create a workgroup in Amazon Redshift Serverless	workgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteCustomDomainAssociation	Grants permission to delete a custom domain association	workgroup*	aws:ResourceTag/${TagKey}	Write
DeleteEndpointAccess	Grants permission to delete an Amazon Redshift Serverless managed VPC endpoint	endpointAccess*		Write
DeleteNamespace	Grants permission to delete a namespace from Amazon Redshift Serverless	namespace*	aws:ResourceTag/${TagKey}	Write
DeleteResourcePolicy	Grants permission to delete the specified resource policy			Write
DeleteScheduledAction	Grants permission to delete a scheduled action from Amazon Redshift Serverless			Write
DeleteSnapshot	Grants permission to delete a snapshot from Amazon Redshift Serverless	snapshot*	aws:ResourceTag/${TagKey}	Write
DeleteSnapshotCopyConfiguration	Grants permission to delete a snapshot copy configuration for a Amazon Redshift Serverless namespace			Write
DeleteUsageLimit	Grants permission to delete a usage limit from Amazon Redshift Serverless			Write
DeleteWorkgroup	Grants permission to delete a workgroup	workgroup*	aws:ResourceTag/${TagKey}	Write
GetCredentials	Grants permission to get a database user name and temporary password with temporary authorization to log on to Amazon Redshift Serverless	workgroup*	aws:ResourceTag/${TagKey}	Write
GetCustomDomainAssociation	Grants permission to get information about a specific custom domain association	workgroup*	aws:ResourceTag/${TagKey}	Read
GetEndpointAccess	Grants permission to create an Amazon Redshift Serverless managed VPC endpoint	endpointAccess*		Read
GetIdentityCenterAuthToken	Grants permission to get an authorized token for Identity Center users to access Redshift Serverless workgroups	workgroup*	aws:ResourceTag/${TagKey}	Read
GetManagedWorkgroup	Grants permission to create a Amazon Redshift Managed Serverless workgroup with the specified configuration settings	managed-workgroup*		Read
GetNamespace	Grants permission to get information about a namespace in Amazon Redshift Serverless	namespace*	aws:ResourceTag/${TagKey}	Read
GetRecoveryPoint	Grants permission to get information about a recovery point	recoveryPoint*	aws:ResourceTag/${TagKey}	Read
GetReservation	Grants permission to get a particular reservation object			Read
GetReservationOffering	Grants permission to get a particular reservation offering			Read
GetResourcePolicy	Grants permission to get a resource policy			Read
GetScheduledAction	Grants permission to get information about a specific scheduled action			Read
GetSnapshot	Grants permission to get information about a specific snapshot	snapshot*	aws:ResourceTag/${TagKey}	Read
GetTableRestoreStatus	Grants permission to get table restore status about a specific snapshot			Read
GetTrack	Grants permission to get information about a track in Amazon Redshift Serverless			Read
GetUsageLimit	Grants permission to get information about a usage limit in Amazon Redshift Serverless			Read
GetWorkgroup	Grants permission to get information about a specific workgroup	workgroup*	aws:ResourceTag/${TagKey}	Read
ListCustomDomainAssociations	Grants permission to list custom domain associations in Amazon Redshift Serverless			List
ListEndpointAccess	Grants permission to list EndpointAccess objects and relevant information	endpointAccess*		List
ListManagedWorkgroups	Grants permission to list managed workgroups in Amazon Redshift Serverless			List
ListNamespaces	Grants permission to list namespaces in Amazon Redshift Serverless			List
ListRecoveryPoints	Grants permission to list an array of recovery points	recoveryPoint*	aws:ResourceTag/${TagKey}	List
ListReservationOfferings	Grants permission to list all available capacity reservation offerings			List
ListReservations	Grants permission to list all reservations			List
ListScheduledActions	Grants permission to list scheduled actions			List
ListSnapshotCopyConfigurations	Grants permission to list SnapshotCopyConfiguration objects and relevant information	namespace	aws:ResourceTag/${TagKey}	List
ListSnapshots	Grants permission to list snapshots	snapshot*	aws:ResourceTag/${TagKey}	List
ListTableRestoreStatus	Grants permission to list table restore status			List
ListTagsForResource	Grants permission to list the tags assigned to a resource	namespace	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list the tags assigned to a resource	workgroup	aws:ResourceTag/${TagKey}	List
ListTracks	Grants permission to list tracks available in Amazon Redshift Serverless			List
ListUsageLimits	Grants permission to list all usage limits within Amazon Redshift Serverless			List
ListWorkgroups	Grants permission to list workgroups in Amazon Redshift Serverless			List
PutResourcePolicy	Grants permission to create or update a resource policy			Write
RestoreFromRecoveryPoint	Grants permission to restore the data from a recovery point	recoveryPoint*	aws:ResourceTag/${TagKey}	Write
RestoreFromSnapshot	Grants permission to restore a namespace from a snapshot	snapshot*	aws:ResourceTag/${TagKey}	Write
RestoreTableFromRecoveryPoint	Grants permission to restore a table from a recovery point	namespace*	aws:ResourceTag/${TagKey}	Write
RestoreTableFromRecoveryPoint	Grants permission to restore a table from a recovery point	recoveryPoint*	aws:ResourceTag/${TagKey}	Write
RestoreTableFromSnapshot	Grants permission to restore a table from a snapshot	namespace*	aws:ResourceTag/${TagKey}	Write
RestoreTableFromSnapshot	Grants permission to restore a table from a snapshot	snapshot*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to assign one or more tags to a resource	namespace	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		recoveryPoint	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove a tag or set of tags from a resource	namespace	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		recoveryPoint	aws:ResourceTag/${TagKey} aws:TagKeys
		snapshot	aws:ResourceTag/${TagKey} aws:TagKeys
		workgroup	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateCustomDomainAssociation	Grants permission to update a certificate associated with a custom domain	workgroup*	aws:ResourceTag/${TagKey}	Write
UpdateEndpointAccess	Grants permission to update an Amazon Redshift Serverless managed VPC endpoint	endpointAccess*		Write
UpdateNamespace	Grants permission to update a namespace with the specified configuration settings	namespace*	aws:ResourceTag/${TagKey}	Write
UpdateScheduledAction	Grants permission to update a scheduled action			Write
UpdateSnapshot	Grants permission to update a snapshot	snapshot*	aws:ResourceTag/${TagKey}	Write
UpdateSnapshotCopyConfiguration	Grants permission to update a snapshot copy configuration for a Amazon Redshift Serverless namespace			Write
UpdateUsageLimit	Grants permission to update a usage limit in Amazon Redshift Serverless			Write
UpdateWorkgroup	Grants permission to update an Amazon Redshift Serverless workgroup with the specified configuration settings	workgroup*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon Redshift Serverless

The following actions are defined by Amazon Redshift Serverless but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
DescribeOneTimeCredit	Grants permission to see on the Amazon Redshift Serverless console the remaining number of free trial credits and their expiration date			Read
ListAutonomicsDenylist	Grants permission to list the resources that are denylisted from global autonomics decisions for a specified workgroup	workgroup*	aws:ResourceTag/${TagKey}	Read
UpdateAutonomicsDenylist	Grants permission to add or remove resources from the global autonomics denylist for a specified workgroup	workgroup*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Redshift Serverless

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
endpointAccess	arn:${Partition}:redshift-serverless:${Region}:${Account}:managedvpcendpoint/${EndpointAccessId}
managed-workgroup	arn:${Partition}:redshift-serverless:${Region}:${Account}:managed-workgroup/${ManagedWorkgroupName}
namespace	arn:${Partition}:redshift-serverless:${Region}:${Account}:namespace/${NamespaceId}	aws:ResourceTag/${TagKey}
recoveryPoint	arn:${Partition}:redshift-serverless:${Region}:${Account}:recoverypoint/${RecoveryPointId}	aws:ResourceTag/${TagKey}
snapshot	arn:${Partition}:redshift-serverless:${Region}:${Account}:snapshot/${SnapshotId}	aws:ResourceTag/${TagKey}
workgroup	arn:${Partition}:redshift-serverless:${Region}:${Account}:workgroup/${WorkgroupId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Redshift Serverless

Amazon Redshift Serverless defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
redshift-serverless:endpointAccessId	Filters access by the endpoint access identifier	String
redshift-serverless:managedWorkgroupName	Filters access by the managed workgroup identifier	String
redshift-serverless:namespaceId	Filters access by the namespace identifier	String
redshift-serverless:recoveryPointId	Filters access by the recovery point identifier	String
redshift-serverless:snapshotId	Filters access by the snapshot identifier	String
redshift-serverless:tableRestoreRequestId	Filters access by the table restore request identifier	String
redshift-serverless:workgroupId	Filters access by the workgroup identifier	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Redshift Data API (redshift-data)

Amazon Resource Group Tagging API (tag)