Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Backup Gateway

Amazon Backup Gateway (service prefix: backup-gateway) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Backup Gateway
Actions defined by Amazon Backup Gateway
Resource types defined by Amazon Backup Gateway
Condition keys for Amazon Backup Gateway

API operations defined by Amazon Backup Gateway

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateGatewayToServer	backup-gateway:AssociateGatewayToServer			Write
CreateGateway	backup-gateway:CreateGateway			Write
CreateGateway	backup-gateway:TagResource			Tagging, Write
DeleteGateway	backup-gateway:DeleteGateway			Write
DeleteHypervisor	backup-gateway:DeleteHypervisor			Write
DisassociateGatewayFromServer	backup-gateway:DisassociateGatewayFromServer			Write
GetBandwidthRateLimitSchedule	backup-gateway:GetBandwidthRateLimitSchedule			Read
GetGateway	backup-gateway:GetGateway			Read
GetHypervisor	backup-gateway:GetHypervisor			Read
GetHypervisorPropertyMappings	backup-gateway:GetHypervisorPropertyMappings			Read
GetVirtualMachine	backup-gateway:GetVirtualMachine			Read
ImportHypervisorConfiguration	backup-gateway:ImportHypervisorConfiguration			Write
ImportHypervisorConfiguration	backup-gateway:TagResource			Tagging, Write
ListGateways	backup-gateway:ListGateways			Read
ListHypervisors	backup-gateway:ListHypervisors			Read
ListTagsForResource	backup-gateway:ListTagsForResource			Read
ListVirtualMachines	backup-gateway:ListVirtualMachines			Read
PutBandwidthRateLimitSchedule	backup-gateway:PutBandwidthRateLimitSchedule			Write
PutHypervisorPropertyMappings	backup-gateway:PutHypervisorPropertyMappings			Write
PutHypervisorPropertyMappings	iam:PassRole	iam:PassedToService	backup-gateway.amazonaws.com	Write
PutMaintenanceStartTime	backup-gateway:PutMaintenanceStartTime			Write
StartVirtualMachinesMetadataSync	backup-gateway:StartVirtualMachinesMetadataSync			Write
StartVirtualMachinesMetadataSync	iam:PassRole	iam:PassedToService	backup-gateway.amazonaws.com	Write
TagResource	backup-gateway:TagResource			Tagging, Write
TestHypervisorConfiguration	backup-gateway:TestHypervisorConfiguration			Write
UntagResource	backup-gateway:UntagResource			Tagging, Write
UpdateGatewayInformation	backup-gateway:UpdateGatewayInformation			Write
UpdateGatewaySoftwareNow	backup-gateway:UpdateGatewaySoftwareNow			Write
UpdateHypervisor	backup-gateway:UpdateHypervisor			Write

Actions defined by Amazon Backup Gateway

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateGatewayToServer	Grants permission to AssociateGatewayToServer	gateway*	aws:ResourceTag/${TagKey}	Write
AssociateGatewayToServer	Grants permission to AssociateGatewayToServer	hypervisor*	aws:ResourceTag/${TagKey}	Write
Backup	Grants permission to Backup	virtualmachine*	aws:ResourceTag/${TagKey}	Write
CreateGateway	Grants permission to to CreateGateway		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteGateway	Grants permission to DeleteGateway	gateway*	aws:ResourceTag/${TagKey}	Write
DeleteHypervisor	Grants permission to DeleteHypervisor	hypervisor*	aws:ResourceTag/${TagKey}	Write
DisassociateGatewayFromServer	Grants permission to DisassociateGatewayFromServer	gateway*	aws:ResourceTag/${TagKey}	Write
GetBandwidthRateLimitSchedule	Grants permission to GetBandwidthRateLimitSchedule	gateway*	aws:ResourceTag/${TagKey}	Read
GetGateway	Grants permission to GetGateway	gateway*	aws:ResourceTag/${TagKey}	Read
GetHypervisor	Grants permission to GetHypervisor	hypervisor*	aws:ResourceTag/${TagKey}	Read
GetHypervisorPropertyMappings	Grants permission to GetHypervisorPropertyMappings	hypervisor*	aws:ResourceTag/${TagKey}	Read
GetVirtualMachine	Grants permission to GetVirtualMachine	virtualmachine*	aws:ResourceTag/${TagKey}	Read
ImportHypervisorConfiguration	Grants permission to ImportHypervisorConfiguration		aws:RequestTag/${TagKey} aws:TagKeys	Write
ListGateways	Grants permission to ListGateways			Read
ListHypervisors	Grants permission to ListHypervisors			Read
ListTagsForResource	Grants permission to ListTagsForResource	gateway	aws:ResourceTag/${TagKey}	Read
		hypervisor	aws:ResourceTag/${TagKey}
		virtualmachine	aws:ResourceTag/${TagKey}
ListVirtualMachines	Grants permission to ListVirtualMachines			Read
PutBandwidthRateLimitSchedule	Grants permission to PutBandwidthRateLimitSchedule	gateway*	aws:ResourceTag/${TagKey}	Write
PutHypervisorPropertyMappings	Grants permission to PutHypervisorPropertyMappings	hypervisor*	aws:ResourceTag/${TagKey}	Write
PutMaintenanceStartTime	Grants permission to PutMaintenanceStartTime	gateway*	aws:ResourceTag/${TagKey}	Write
Restore	Grants permission to Restore	hypervisor*	aws:ResourceTag/${TagKey}	Write
StartVirtualMachinesMetadataSync	Grants permission to StartVirtualMachinesMetadataSync	hypervisor*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to TagResource	gateway	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		hypervisor	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		virtualmachine	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
TestHypervisorConfiguration	Grants permission to TestHypervisorConfiguration	gateway*	aws:ResourceTag/${TagKey}	Write
UntagResource	Grants permission to UntagResource	gateway	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		hypervisor	aws:ResourceTag/${TagKey} aws:TagKeys
		virtualmachine	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateGatewayInformation	Grants permission to UpdateGatewayInformation	gateway*	aws:ResourceTag/${TagKey}	Write
UpdateGatewaySoftwareNow	Grants permission to UpdateGatewaySoftwareNow	gateway*	aws:ResourceTag/${TagKey}	Write
UpdateHypervisor	Grants permission to UpdateHypervisor	gateway*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Backup Gateway

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
gateway	arn:${Partition}:backup-gateway:${Region}:${Account}:gateway/${GatewayId}	aws:ResourceTag/${TagKey}
hypervisor	arn:${Partition}:backup-gateway:${Region}:${Account}:hypervisor/${HypervisorId}	aws:ResourceTag/${TagKey}
virtualmachine	arn:${Partition}:backup-gateway:${Region}:${Account}:vm/${VirtualmachineId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Backup Gateway

Amazon Backup Gateway defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the allowed set of values for each of the tags	String
aws:ResourceTag/${TagKey}	Filters access by tag-value associated with the resource	String
aws:TagKeys	Filters access by the presence of mandatory tags in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Backup (backup)

Amazon Backup storage (backup-storage)