Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon S3 Tables

Amazon S3 Tables (service prefix: s3tables) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon S3 Tables
Actions defined by Amazon S3 Tables
Permission-only actions for Amazon S3 Tables
Resource types defined by Amazon S3 Tables
Condition keys for Amazon S3 Tables

API operations defined by Amazon S3 Tables

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateNamespace	s3tables:CreateNamespace			Write
CreateTable	s3tables:CreateTable			Write
	s3tables:PutTableEncryption			Write
	s3tables:PutTableStorageClass			Write
	s3tables:TagResource			Tagging, Write
CreateTableBucket	s3tables:CreateTableBucket			Write
	s3tables:PutTableBucketEncryption			Write
	s3tables:PutTableBucketPolicy			Permissions management, Write
	s3tables:PutTableBucketStorageClass			Write
	s3tables:TagResource			Tagging, Write
DeleteNamespace	s3tables:DeleteNamespace			Write
DeleteTable	s3tables:DeleteTable			Write
DeleteTableBucket	s3tables:DeleteTableBucket			Write
DeleteTableBucketEncryption	s3tables:DeleteTableBucketEncryption			Write
DeleteTableBucketMetricsConfiguration	s3tables:DeleteTableBucketMetricsConfiguration			Write
DeleteTableBucketPolicy	s3tables:DeleteTableBucketPolicy			Permissions management, Write
DeleteTableBucketReplication	s3tables:DeleteTableBucketReplication			Write
DeleteTablePolicy	s3tables:DeleteTablePolicy			Permissions management, Write
DeleteTableReplication	s3tables:DeleteTableReplication			Write
GetNamespace	s3tables:GetNamespace			Read
GetTable	s3tables:GetTable			Read
GetTableBucket	s3tables:GetTableBucket			Read
GetTableBucketEncryption	s3tables:GetTableBucketEncryption			Read
GetTableBucketMaintenanceConfiguration	s3tables:GetTableBucketMaintenanceConfiguration			Read
GetTableBucketMetricsConfiguration	s3tables:GetTableBucketMetricsConfiguration			Read
GetTableBucketPolicy	s3tables:GetTableBucketPolicy			Read
GetTableBucketReplication	s3tables:GetTableBucketReplication			Read
GetTableBucketStorageClass	s3tables:GetTableBucketStorageClass			Read
GetTableEncryption	s3tables:GetTableEncryption			Read
GetTableMaintenanceConfiguration	s3tables:GetTableMaintenanceConfiguration			Read
GetTableMaintenanceJobStatus	s3tables:GetTableMaintenanceJobStatus			Read
GetTableMetadataLocation	s3tables:GetTableMetadataLocation			Read
GetTablePolicy	s3tables:GetTablePolicy			Read
GetTableRecordExpirationConfiguration	s3tables:GetTableRecordExpirationConfiguration			Read
GetTableRecordExpirationJobStatus	s3tables:GetTableRecordExpirationJobStatus			Read
GetTableReplication	s3tables:GetTableReplication			Read
GetTableReplicationStatus	s3tables:GetTableReplicationStatus			Read
GetTableStorageClass	s3tables:GetTableStorageClass			Read
ListNamespaces	s3tables:ListNamespaces			List
ListTableBuckets	s3tables:ListTableBuckets			List
ListTables	s3tables:ListTables			List
ListTagsForResource	s3tables:ListTagsForResource			List
PutTableBucketEncryption	s3tables:PutTableBucketEncryption			Write
PutTableBucketMaintenanceConfiguration	s3tables:PutTableBucketMaintenanceConfiguration			Write
PutTableBucketMetricsConfiguration	s3tables:PutTableBucketMetricsConfiguration			Write
PutTableBucketPolicy	s3tables:PutTableBucketPolicy			Permissions management, Write
PutTableBucketReplication	s3tables:PutTableBucketReplication			Write
PutTableBucketReplication	iam:PassRole	iam:PassedToService	replication.s3tables.amazonaws.com	Write
PutTableBucketStorageClass	s3tables:PutTableBucketStorageClass			Write
PutTableMaintenanceConfiguration	s3tables:PutTableMaintenanceConfiguration			Write
PutTablePolicy	s3tables:PutTablePolicy			Permissions management, Write
PutTableRecordExpirationConfiguration	s3tables:PutTableRecordExpirationConfiguration			Write
PutTableReplication	s3tables:PutTableReplication			Write
PutTableReplication	iam:PassRole	iam:PassedToService	replication.s3tables.amazonaws.com	Write
RenameTable	s3tables:RenameTable			Write
TagResource	s3tables:TagResource			Tagging, Write
UntagResource	s3tables:UntagResource			Tagging, Write
UpdateTableMetadataLocation	s3tables:UpdateTableMetadataLocation			Write

Actions defined by Amazon S3 Tables

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateNamespace	Grants permission to create a namespace	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Write
CreateTable	Grants permission to create a table	TableBucket*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3tables:KMSKeyArn s3tables:namespace s3tables:SSEAlgorithm s3tables:TableBucketTag/${TagKey}	Write
CreateTableBucket	Grants permission to create a table bucket	TableBucket*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3tables:KMSKeyArn s3tables:SSEAlgorithm s3tables:TableBucketTag/${TagKey}	Write
DeleteNamespace	Grants permission to delete a namespace	TableBucket*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey}	Write
DeleteTable	Grants permission to delete a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Write
DeleteTableBucket	Grants permission to delete a table bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Write
DeleteTableBucketEncryption	Grants permission to delete encryption configuration on a table bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Write
DeleteTableBucketMetricsConfiguration	Grants permission to delete a metrics configuration on a table bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Write
DeleteTableBucketPolicy	Grants permission to delete a policy on a table bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Permissions management, Write
DeleteTableBucketReplication	Grants permission to delete table bucket replication configuration on a bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Write
DeleteTablePolicy	Grants permission to delete a policy on a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Permissions management, Write
DeleteTableReplication	Grants permission to delete table replication configuration on a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Write
GetNamespace	Grants permission to get a namespace	TableBucket*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey}	Read
GetTable	Grants permission to retrieve a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Read
GetTableBucket	Grants permission to retrieve a table bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Read
GetTableBucketEncryption	Grants permission to retrieve encryption configuration on a table bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Read
GetTableBucketMaintenanceConfiguration	Grants permission to retrieve a maintenance configuration on a table bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Read
GetTableBucketMetricsConfiguration	Grants permission to retrieve a metrics configuration on a bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Read
GetTableBucketPolicy	Grants permission to retrieve a policy on a table bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Read
GetTableBucketReplication	Grants permission to retrieve a table bucket replication configuration on a bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Read
GetTableBucketStorageClass	Grants permission to retrieve the storage class configuration for a table bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Read
GetTableEncryption	Grants permission to retrieve encryption configuration on a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Read
GetTableMaintenanceConfiguration	Grants permission to retrieve a maintenance configuration on a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Read
GetTableMaintenanceJobStatus	Grants permission to retrieve the status of maintenance jobs on a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Read
GetTableMetadataLocation	Grants permission to retrieve the metadata location of a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Read
GetTablePolicy	Grants permission to retrieve a policy on a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Read
GetTableRecordExpirationConfiguration	Grants permission to retrieve a table maintenance configuration on a system table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Read
GetTableRecordExpirationJobStatus	Grants permission to retrieve the status of table record expiration jobs on a system table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Read
GetTableReplication	Grants permission to retrieve a table replication configuration on a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Read
GetTableReplicationStatus	Grants permission to retrieve a table replication status on a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Read
GetTableStorageClass	Grants permission to retrieve the storage class configuration for a specific table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Read
ListNamespaces	Grants permission to list namespaces	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	List
ListTableBuckets	Grants permission to list table buckets			List
ListTables	Grants permission to list tables	TableBucket*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey}	List
ListTagsForResource	Grants permission to list the tags for an S3 Tables resource	Table	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	List
ListTagsForResource		TableBucket	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	List
PutTableBucketEncryption	Grants permission to put or overwrite encryption configuration on a table bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:KMSKeyArn s3tables:SSEAlgorithm s3tables:TableBucketTag/${TagKey}	Write
PutTableBucketMaintenanceConfiguration	Grants permission to put a maintenance configuration on a table bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Write
PutTableBucketMetricsConfiguration	Grants permission to create or overwrite a metrics configuration on a table bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Write
PutTableBucketPolicy	Grants permission to create or overwrite a policy on a table bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Permissions management, Write
PutTableBucketReplication	Grants permission to put table bucket replication configuration on a bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}	Write
PutTableBucketStorageClass	Grants permission to set or update the storage class configuration for a table bucket	TableBucket*	aws:ResourceTag/${TagKey} s3tables:StorageClass s3tables:TableBucketTag/${TagKey}	Write
PutTableMaintenanceConfiguration	Grants permission to put a maintenance configuration on a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Write
PutTablePolicy	Grants permission to create or overwrite a policy on a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Permissions management, Write
PutTableRecordExpirationConfiguration	Grants permission to put a table record expiration configuration on a system table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Write
PutTableReplication	Grants permission to put table replication configuration on a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Write
PutTableStorageClass	Grants permission to set or update the storage class configuration for a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:StorageClass s3tables:TableBucketTag/${TagKey} s3tables:tableName	Write
RenameTable	Grants permission to rename a table or move a table across namespaces	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Write
TagResource	Grants permission to tag a S3 Tables resource	Table	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Tagging, Write
TagResource	Grants permission to tag a S3 Tables resource	TableBucket	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys s3tables:TableBucketTag/${TagKey}	Tagging, Write
UntagResource	Grants permission to untag a S3 Tables resource	Table	aws:ResourceTag/${TagKey} aws:TagKeys s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Tagging, Write
UntagResource	Grants permission to untag a S3 Tables resource	TableBucket	aws:ResourceTag/${TagKey} aws:TagKeys s3tables:TableBucketTag/${TagKey}	Tagging, Write
UpdateTableMetadataLocation	Grants permission to update the metadata location of a table	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Write

Permission-only actions for Amazon S3 Tables

The following actions are defined by Amazon S3 Tables but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
GetTableData	Grants permission to read metadata and data objects from a table storage endpoint using S3 APIs	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Read
PutTableData	Grants permission to write metadata and data objects to a table storage endpoint using S3 APIs	Table*	aws:ResourceTag/${TagKey} s3tables:namespace s3tables:TableBucketTag/${TagKey} s3tables:tableName	Write
PutTableEncryption	Grants permission to put encryption configuration on a table	Table*	aws:ResourceTag/${TagKey} s3tables:KMSKeyArn s3tables:namespace s3tables:SSEAlgorithm s3tables:TableBucketTag/${TagKey} s3tables:tableName	Write

Actions

Description

Resource types (*required)

Condition keys

Access level

GetTableData

Grants permission to read metadata and data objects from a table storage endpoint using S3 APIs

Table*

aws:ResourceTag/${TagKey}

s3tables:namespace

s3tables:TableBucketTag/${TagKey}

s3tables:tableName

Read

PutTableData

Grants permission to write metadata and data objects to a table storage endpoint using S3 APIs

Table*

aws:ResourceTag/${TagKey}

s3tables:namespace

s3tables:TableBucketTag/${TagKey}

s3tables:tableName

Write

PutTableEncryption

Grants permission to put encryption configuration on a table

Table*

aws:ResourceTag/${TagKey}

s3tables:KMSKeyArn

s3tables:namespace

s3tables:SSEAlgorithm

s3tables:TableBucketTag/${TagKey}

s3tables:tableName

Write

Resource types defined by Amazon S3 Tables

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
Table	arn:${Partition}:s3tables:${Region}:${Account}:bucket/${TableBucketName}/table/${TableID}	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey} s3tables:namespace s3tables:tableName
TableBucket	arn:${Partition}:s3tables:${Region}:${Account}:bucket/${TableBucketName}	aws:ResourceTag/${TagKey} s3tables:TableBucketTag/${TagKey}

Resource types

ARN

Condition keys

Table

arn:${Partition}:s3tables:${Region}:${Account}:bucket/${TableBucketName}/table/${TableID}

aws:ResourceTag/${TagKey}

s3tables:TableBucketTag/${TagKey}

s3tables:namespace

s3tables:tableName

TableBucket

arn:${Partition}:s3tables:${Region}:${Account}:bucket/${TableBucketName}

aws:ResourceTag/${TagKey}

s3tables:TableBucketTag/${TagKey}

Condition keys for Amazon S3 Tables

Amazon S3 Tables defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
s3tables:KMSKeyArn	Filters access by the Amazon KMS key ARN for the key used to encrypt a table	ARN
s3tables:SSEAlgorithm	Filters access by the server-side encryption algorithm used to encrypt a table	String
s3tables:StorageClass	Filters access by the storage class that can be set on tables under a table bucket	String
s3tables:TableBucketTag/${TagKey}	Filters access by the tags associated with the table bucket	String
s3tables:namespace	Filters access by the namespaces created in the table bucket	String
s3tables:tableName	Filters access by the name of the tables in the table bucket	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon S3 Object Lambda (s3-object-lambda)

Amazon SageMaker (sagemaker)