Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon X-Ray

Amazon X-Ray (service prefix: xray) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by Amazon X-Ray

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
BatchGetTraces	xray:BatchGetTraces	List
CancelTraceRetrieval	xray:CancelTraceRetrieval	Read
CreateGroup	xray:CreateGroup	Write
CreateGroup	xray:TagResource	Tagging, Write
CreateSamplingRule	xray:CreateSamplingRule	Write
CreateSamplingRule	xray:TagResource	Tagging, Write
DeleteGroup	xray:DeleteGroup	Write
DeleteResourcePolicy	xray:DeleteResourcePolicy	Write
DeleteSamplingRule	xray:DeleteSamplingRule	Write
GetEncryptionConfig	xray:GetEncryptionConfig	Read
GetGroup	xray:GetGroup	Read
GetGroups	xray:GetGroups	Read
GetIndexingRules	xray:GetIndexingRules	Read
GetInsight	xray:GetInsight	Read
GetInsightEvents	xray:GetInsightEvents	Read
GetInsightImpactGraph	xray:GetInsightImpactGraph	Read
GetInsightSummaries	xray:GetInsightSummaries	Read
GetRetrievedTracesGraph	xray:GetRetrievedTracesGraph	Read
GetSamplingRules	xray:GetSamplingRules	Read
GetSamplingStatisticSummaries	xray:GetSamplingStatisticSummaries	Read
GetSamplingTargets	xray:GetSamplingTargets	Read
GetServiceGraph	xray:GetServiceGraph	Read
GetTimeSeriesServiceStatistics	xray:GetTimeSeriesServiceStatistics	Read
GetTraceGraph	xray:GetTraceGraph	Read
GetTraceSegmentDestination	xray:GetTraceSegmentDestination	Read
GetTraceSummaries	xray:GetTraceSummaries	Read
ListResourcePolicies	xray:ListResourcePolicies	List
ListRetrievedTraces	xray:ListRetrievedTraces	List
ListTagsForResource	xray:ListTagsForResource	List
PutEncryptionConfig	xray:PutEncryptionConfig	Permissions management, Write
PutResourcePolicy	xray:PutResourcePolicy	Write
PutTelemetryRecords	xray:PutTelemetryRecords	Write
PutTraceSegments	xray:PutTraceSegments	Write
StartTraceRetrieval	xray:StartTraceRetrieval	Read
TagResource	xray:TagResource	Tagging, Write
UntagResource	xray:UntagResource	Tagging, Write
UpdateGroup	xray:UpdateGroup	Write
UpdateIndexingRule	xray:UpdateIndexingRule	Write
UpdateSamplingRule	xray:UpdateSamplingRule	Write
UpdateTraceSegmentDestination	xray:UpdateTraceSegmentDestination	Write

Actions defined by Amazon X-Ray

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchGetTraces	Grants permission to retrieve a list of traces specified by ID. Each trace is a collection of segment documents that originates from a single request. Use GetTraceSummaries to get a list of trace IDs			List
CancelTraceRetrieval	Grants permission to cancel an ongoing trace retrieval job initiated by StartTraceRetrieval using the provided RetrievalToken. A successful cancellation will return an HTTP 200 response			Read
CreateGroup	Grants permission to create a group resource with a name and a filter expression	group*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSamplingRule	Grants permission to create a rule to control sampling behavior for instrumented applications	sampling-rule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteGroup	Grants permission to delete a group resource	group*	aws:ResourceTag/${TagKey}	Write
DeleteResourcePolicy	Grants permission to delete resource policies		xray:ResourcePolicyName	Write
DeleteSamplingRule	Grants permission to delete a sampling rule	sampling-rule*	aws:ResourceTag/${TagKey}	Write
GetEncryptionConfig	Grants permission to retrieve the current encryption configuration for X-Ray data			Read
GetGroup	Grants permission to retrieve group resource details	group*	aws:ResourceTag/${TagKey}	Read
GetGroups	Grants permission to retrieve all active group details			Read
GetIndexingRules	Grants permission to retrieve all indexing rules. Indexing rules are used to determine the server-side sampling rate for spans ingested through the CloudWatchLogs destination and indexed by X-Ray			Read
GetInsight	Grants permission to retrieve the details of a specific insight			Read
GetInsightEvents	Grants permission to retrieve the events of a specific insight			Read
GetInsightImpactGraph	Grants permission to retrieve the part of the service graph which is impacted for a specific insight			Read
GetInsightSummaries	Grants permission to retrieve the summary of all insights for a group and time range with optional filters			Read
GetRetrievedTracesGraph	Grants permission to retrieve a service graph for traces based on the specified RetrievalToken from the Transaction Search CloudWatch log group			Read
GetSamplingRules	Grants permission to retrieve all sampling rules			Read
GetSamplingStatisticSummaries	Grants permission to retrieve information about recent sampling results for all sampling rules			Read
GetSamplingTargets	Grants permission to request a sampling quota for rules that the service is using to sample requests			Read
GetServiceGraph	Grants permission to retrieve a document that describes services that process incoming requests, and downstream services that they call as a result			Read
GetTimeSeriesServiceStatistics	Grants permission to retrieve an aggregation of service statistics defined by a specific time range bucketed into time intervals			Read
GetTraceGraph	Grants permission to retrieve a service graph for one or more specific trace IDs			Read
GetTraceSegmentDestination	Grants permission to retrieve the current destination of data sent to PutTraceSegments and OpenTelemetry API			Read
GetTraceSummaries	Grants permission to retrieve IDs and metadata for traces available for a specified time frame using an optional filter. To get the full traces, pass the trace IDs to BatchGetTraces			Read
ListResourcePolicies	Grants permission to list resource policies			List
ListRetrievedTraces	Grants permission to retrieve a list of traces for a given RetrievalToken from the Transaction Search CloudWatch log group			List
ListTagsForResource	Grants permission to list tags for an X-Ray resource	group	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags for an X-Ray resource	sampling-rule	aws:ResourceTag/${TagKey}	List
PutEncryptionConfig	Grants permission to update the encryption configuration for X-Ray data			Permissions management, Write
PutResourcePolicy	Grants permission to create or update resource policies		xray:ResourcePolicyName	Write
PutSpans	Grants permission to upload OpenTelemetry spans to Amazon X-Ray		logs:LogGeneratingResourceArns	Write
PutTelemetryRecords	Grants permission to send Amazon X-Ray daemon telemetry to the service			Write
PutTraceSegments	Grants permission to upload segment documents to Amazon X-Ray. The X-Ray SDK generates segment documents and sends them to the X-Ray daemon, which uploads them in batches		logs:LogGeneratingResourceArns	Write
StartTraceRetrieval	Grants permission to initiate a trace retrieval process using the specified time range and for the given trace IDs on the Transaction Search CloudWatch log group			Read
TagResource	Grants permission to add tags to an X-Ray resource	group	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource	Grants permission to add tags to an X-Ray resource	sampling-rule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from an X-Ray resource	group	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from an X-Ray resource	sampling-rule	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateGroup	Grants permission to update a group resource	group*	aws:ResourceTag/${TagKey}	Write
UpdateIndexingRule	Grants permission to modify an indexing rule's configuration			Write
UpdateSamplingRule	Grants permission to modify a sampling rule's configuration	sampling-rule*	aws:ResourceTag/${TagKey}	Write
UpdateTraceSegmentDestination	Grants permission to modify the destination of data sent to PutTraceSegments and OpenTelemetry API		xray:TraceSegmentDestination	Write

Permission-only actions for Amazon X-Ray

The following actions are defined by Amazon X-Ray but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Access level
BatchGetTraceSummaryById	Grants permission to retrieve metadata for a list of traces specified by ID	Read
GetDistinctTraceGraphs	Grants permission to retrieve distinct service graphs for one or more specific trace IDs	Read
Link	Grants permission to share X-Ray resources with a monitoring account	Write
PutSpansForIndexing	Grants permission to upload spans to Amazon X-Ray to be indexed	Write

Resource types defined by Amazon X-Ray

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
group	arn:${Partition}:xray:${Region}:${Account}:group/${GroupName}/${Id}	aws:ResourceTag/${TagKey}
sampling-rule	arn:${Partition}:xray:${Region}:${Account}:sampling-rule/${SamplingRuleName}	aws:ResourceTag/${TagKey}

Condition keys for Amazon X-Ray

Amazon X-Ray defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
logs:LogGeneratingResourceArns	Filters access by LogGeneratingResourceArn in the request	ArrayOfARN
xray:ResourcePolicyName	Filters access by PolicyName in the request	String
xray:TraceSegmentDestination	Filters access by TraceSegmentDestination type in the request	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon WAF V2 (wafv2)

Amazon Billing (billing)