Simplified Amazon Web Services service information for programmatic access - Service Authorization Reference
Additional field definitions
Services or capabilities described in Amazon Web Services documentation might vary by Region. To see the differences applicable to the China Regions, see Getting Started with Amazon Web Services in China (PDF).

Simplified Amazon Web Services service information for programmatic access

Amazon provides service reference information in JSON format to streamline the automation of policy management workflows. With the service reference information, you can access available actions, resources, and condition keys across Amazon Web Services services from machine-readable files. Security administrators can establish guardrails and developers can ensure appropriate access to applications by identifying the available actions, resources, and condition keys for each Amazon Web Services service. Amazon provides service reference information for Amazon Web Services services to allow you to incorporate the metadata into your policy management workflows.

For an inventory of actions, resources, and condition keys for use in IAM policies, see the Service Authorization Reference page for the Amazon Web Services service.

Actions, resources, and condition keys for services that share a service prefix may be split across multiple pages in the Service Authorization Reference.

The content presented in the Service Authorization Reference may be presented differently or contain different metadata. For more information, see Additional field definitions.

Note

Changes to the service reference information may take up to 24 hours to be reflected in the list of metadata for the service.

Accessing Amazon Web Services service reference information

  1. Navigate to the service reference information to access the list of Amazon Web Services services for which reference information is available.

    The following example shows a partial list of services and URLs for their respective reference information:

    [ 
    { 
        "service": "s3", 
        "url": "https://servicereference.us-east-1.amazonaws.com/v1/s3/s3.json" 
    }, 
    { 
        "service": "dynamodb", 
        "url": "https://servicereference.us-east-1.amazonaws.com/v1/dynamodb/dynamodb.json" 
    }, 
    …
]

  2. Choose a service and navigate to the service information page in the url field for the service to view a list of actions, resources, and condition keys for the service.

    The following example shows a partial list of service reference information for Amazon S3:

    {
    "Name": "s3",
    "Actions": [
        {
            "Name": "GetObject",
            "ActionConditionKeys": [
                "s3:AccessGrantsInstanceArn",
                "s3:AccessPointNetworkOrigin",
                "s3:DataAccessPointAccount",
                "s3:DataAccessPointArn",
                "s3:ExistingObjectTag/key",
                "s3:ResourceAccount",
                "s3:TlsVersion",
                "s3:authType",
                "s3:if-match",
                "s3:if-none-match",
                "s3:signatureAge",
                "s3:signatureversion",
                "s3:x-amz-content-sha256"
            ],
            "Annotations" : {
                "Properties" : {
                    "IsList" : false,
                    "IsPermissionManagement" : false,
                    "IsTaggingOnly" : false,
                    "IsWrite" : false
                }
            },
            "Resources": [
                {
                    "Name": "object"
                }
            ]
        },
        {
            "Name": "ListBucket",
            "ActionConditionKeys": [
                "s3:AccessGrantsInstanceArn",
                "s3:AccessPointNetworkOrigin",
                "s3:DataAccessPointAccount",
                "s3:DataAccessPointArn",
                "s3:ResourceAccount",
                "s3:TlsVersion",
                "s3:authType",
                "s3:delimiter",
                "s3:max-keys",
                "s3:prefix",
                "s3:signatureAge",
                "s3:signatureversion",
                "s3:x-amz-content-sha256"
            ],
            "Annotations" : {
                "Properties" : {
                    "IsList" : true,
                    "IsPermissionManagement" : false,
                    "IsTaggingOnly" : false,
                    "IsWrite" : false
                }
            },
            "Resources": [
                {
                    "Name": "bucket"
                }
            ]
        },
        ...
    ],
    "ConditionKeys": [
        {
            "Name": "s3:TlsVersion",
            "Types": [
                "Numeric"
            ]
        },
        {
            "Name": "s3:authType",
            "Types": [
                "String"
            ]
        },
        ...
    ],
    "Resources": [
        {
            "Name": "accesspoint",
            "ARNFormats": [
                "arn:${Partition}:s3:${Region}:${Account}:accesspoint/${AccessPointName}"
            ]
        },
        {
            "Name": "bucket",
            "ARNFormats": [
                "arn:${Partition}:s3:::${BucketName}"
            ]
        }
        ...
    ],
    "Version": "v1.2"
}

  3. Download the JSON file from the service URL to use in your policy authoring workflows.

Additional field definitions

Action properties provide additional metadata about service actions to help categorize them based on their permission scope. These properties are found under the Annotations field for each action. The metadata consists of four boolean values:

  • IsList – Provides permissions to discover and list resources, including basic metadata, without accessing resource contents.

    Example – This property is true for the Amazon S3 ListBucket action, allowing users to view bucket listings without accessing the objects themselves.

  • IsPermissionManagement – Provides permissions to modify IAM permissions or access credentials.

    Example – This property is true for most IAM and Amazon Organizations actions, as well as Amazon S3 actions like PutBucketPolicy and DeleteBucketPolicy.

  • IsTaggingOnly – Provides permissions only for modifying tags.

    Example – This property is true for IAM actions TagRole and UntagRole, while this property is false for CreateRole since it provides broader permissions beyond tagging.

  • IsWrite – Provides permissions to modify resources, which may include tag modifications.

    Example – This property is true for Amazon S3 actions CreateBucket, DeleteBucket, and PutObject since they allow resource modification.

Note

These properties are not mutually exclusive. An action may have multiple properties set to true.

It's also possible for all properties to be false, as seen with Amazon S3's GetObject action. This indicates the action only grants read permissions on an object.

These properties can be used to generate insights for services. The following example shows which permissions with the s3 prefix allow mutating resources:

> curl https://servicereference.us-east-1.amazonaws.com/v1/s3/s3.json | \
    jq '.Actions[] | select(.Annotations.Properties.IsWrite == true) | .Name'

"AssociateAccessGrantsIdentityCenter"
"BypassGovernanceRetention"
"CreateAccessGrant"
"CreateAccessGrantsInstance"
"CreateAccessGrantsLocation"
...

The following example shows which action condition keys with the lambda prefix you can use to limit access to permission management actions:

> curl https://servicereference.us-east-1.amazonaws.com/v1/lambda/lambda.json | \
    jq '.Actions[] | select(.Annotations.Properties.IsPermissionManagement == true) | {Name: .Name, ActionConditionKeys: (.ActionConditionKeys // [])}'
 
{
   "Name": "AddLayerVersionPermission",
    "ActionConditionKeys": []
}
{
    "Name": "AddPermission",
    "ActionConditionKeys": [
        "lambda:FunctionUrlAuthType",
        "lambda:Principal"
    ]
}
{
    "Name": "DisableReplication",
    "ActionConditionKeys": []
}
{
    "Name": "EnableReplication",
    "ActionConditionKeys": []
}
{
    "Name": "RemoveLayerVersionPermission",
    "ActionConditionKeys": []
}
{
    "Name": "RemovePermission",
    "ActionConditionKeys": [
        "lambda:FunctionUrlAuthType",
        "lambda:Principal"
    ]
}