Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon CloudWatch Synthetics

Amazon CloudWatch Synthetics (service prefix: synthetics) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon CloudWatch Synthetics
Actions defined by Amazon CloudWatch Synthetics
Resource types defined by Amazon CloudWatch Synthetics
Condition keys for Amazon CloudWatch Synthetics

API operations defined by Amazon CloudWatch Synthetics

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateResource	synthetics:AssociateResource			Write
CreateCanary	synthetics:CreateCanary			Write
	synthetics:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	synthetics.amazonaws.com	Write
CreateGroup	synthetics:CreateGroup			Write
CreateGroup	synthetics:TagResource			Tagging, Write
DeleteCanary	synthetics:DeleteCanary			Write
DeleteGroup	synthetics:DeleteGroup			Write
DescribeCanaries	synthetics:DescribeCanaries			Read
DescribeCanaries	synthetics:ListTagsForResource			Read
DescribeCanariesLastRun	synthetics:DescribeCanariesLastRun			Read
DescribeRuntimeVersions	synthetics:DescribeRuntimeVersions			Read
DisassociateResource	synthetics:DisassociateResource			Write
GetCanary	synthetics:GetCanary			Read
GetCanaryRuns	synthetics:GetCanaryRuns			Read
GetGroup	synthetics:GetGroup			Read
GetGroup	synthetics:ListTagsForResource			Read
ListAssociatedGroups	synthetics:ListAssociatedGroups			List
ListGroupResources	synthetics:ListGroupResources			List
ListGroups	synthetics:ListGroups			List
ListTagsForResource	synthetics:ListTagsForResource			Read
StartCanary	synthetics:StartCanary			Write
StartCanaryDryRun	synthetics:StartCanaryDryRun			Write
StartCanaryDryRun	iam:PassRole	iam:PassedToService	synthetics.amazonaws.com	Write
StopCanary	synthetics:StopCanary			Write
TagResource	synthetics:TagResource			Tagging, Write
UntagResource	synthetics:UntagResource			Tagging, Write
UpdateCanary	synthetics:UpdateCanary			Write
UpdateCanary	iam:PassRole	iam:PassedToService	synthetics.amazonaws.com	Write

Actions defined by Amazon CloudWatch Synthetics

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateResource	Grants permission to associate a resource with a group	group*	aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCanary	Grants permission to create a canary		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateGroup	Grants permission to create a group		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteCanary	Grants permission to delete a canary. Amazon Synthetics deletes all the resources except for the Lambda function and the CloudWatch Alarms if you created one	canary*	aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteGroup	Grants permission to delete a group	group*	aws:ResourceTag/${TagKey} aws:TagKeys	Write
DescribeCanaries	Grants permission to list information of all canaries		synthetics:Names	Read
DescribeCanariesLastRun	Grants permission to list information about the last test run associated with all canaries		synthetics:Names	Read
DescribeRuntimeVersions	Grants permission to list information about Synthetics canary runtime versions			Read
DisassociateResource	Grants permission to disassociate a resource from a group	group*	aws:ResourceTag/${TagKey} aws:TagKeys	Write
GetCanary	Grants permission to view the details of a canary	canary*	aws:ResourceTag/${TagKey} aws:TagKeys	Read
GetCanaryRuns	Grants permission to list information about all the test runs associated with a canary	canary*	aws:ResourceTag/${TagKey} aws:TagKeys	Read
GetGroup	Grants permission to view the details of a group	group*	aws:ResourceTag/${TagKey} aws:TagKeys	Read
ListAssociatedGroups	Grants permission to list information about the associated groups of a canary	canary*	aws:ResourceTag/${TagKey} aws:TagKeys	List
ListGroupResources	Grants permission to list information about canaries in a group	group*	aws:ResourceTag/${TagKey} aws:TagKeys	List
ListGroups	Grants permission to list information of all groups			List
ListTagsForResource	Grants permission to list all tags and values associated with a resource	canary	aws:ResourceTag/${TagKey}	Read
ListTagsForResource		group	aws:ResourceTag/${TagKey}	Read
StartCanary	Grants permission to start a canary, so that Amazon CloudWatch Synthetics starts monitoring a website	canary*	aws:ResourceTag/${TagKey} aws:TagKeys	Write
StartCanaryDryRun	Grants permission to start a canary dry run, so that Amazon CloudWatch Synthetics can execute a test execution of a canary with provided parameters	canary*	aws:ResourceTag/${TagKey} aws:TagKeys	Write
StopCanary	Grants permission to stop a canary	canary*	aws:ResourceTag/${TagKey} aws:TagKeys	Write
TagResource	Grants permission to add one or more tags to a resource	canary	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource	Grants permission to add one or more tags to a resource	group	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove one or more tags from a resource	canary	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource		group	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateCanary	Grants permission to update a canary	canary*	aws:ResourceTag/${TagKey} aws:TagKeys	Write

Resource types defined by Amazon CloudWatch Synthetics

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
canary	arn:${Partition}:synthetics:${Region}:${Account}:canary:${CanaryName}	aws:ResourceTag/${TagKey}
group	arn:${Partition}:synthetics:${Region}:${Account}:group:${GroupId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon CloudWatch Synthetics

Amazon CloudWatch Synthetics defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access based on the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access based on the tags associated with the resource	String
aws:TagKeys	Filters access based on the tag keys that are passed in the request	ArrayOfString
synthetics:Names	Filters access based on the name of the canary	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon CloudWatch Observability Access Manager (oam)

Amazon Cognito Identity (cognito-identity)