Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Batch

Amazon Batch (service prefix: batch) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by Amazon Batch

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CancelJob	batch:CancelJob			Write
CreateComputeEnvironment	batch:CreateComputeEnvironment			Write
	batch:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	batch.amazonaws.com, ec2.amazonaws.com, spotfleet.amazonaws.com	Write
CreateConsumableResource	batch:CreateConsumableResource			Write
CreateConsumableResource	batch:TagResource			Tagging, Write
CreateJobQueue	batch:CreateJobQueue			Write
CreateJobQueue	batch:TagResource			Tagging, Write
CreateQuotaShare	batch:CreateQuotaShare			Write
CreateQuotaShare	batch:TagResource			Tagging, Write
CreateSchedulingPolicy	batch:CreateSchedulingPolicy			Write
CreateSchedulingPolicy	batch:TagResource			Tagging, Write
CreateServiceEnvironment	batch:CreateServiceEnvironment			Write
CreateServiceEnvironment	batch:TagResource			Tagging, Write
DeleteComputeEnvironment	batch:DeleteComputeEnvironment			Write
DeleteConsumableResource	batch:DeleteConsumableResource			Write
DeleteJobQueue	batch:DeleteJobQueue			Write
DeleteQuotaShare	batch:DeleteQuotaShare			Write
DeleteSchedulingPolicy	batch:DeleteSchedulingPolicy			Write
DeleteServiceEnvironment	batch:DeleteServiceEnvironment			Write
DeregisterJobDefinition	batch:DeregisterJobDefinition			Write
DescribeComputeEnvironments	batch:DescribeComputeEnvironments			Read
DescribeConsumableResource	batch:DescribeConsumableResource			Read
DescribeJobDefinitions	batch:DescribeJobDefinitions			Read
DescribeJobQueues	batch:DescribeJobQueues			Read
DescribeJobs	batch:DescribeJobs			Read
DescribeQuotaShare	batch:DescribeQuotaShare			Read
DescribeSchedulingPolicies	batch:DescribeSchedulingPolicies			Read
DescribeServiceEnvironments	batch:DescribeServiceEnvironments			Read
DescribeServiceJob	batch:DescribeServiceJob			Read
GetJobQueueSnapshot	batch:GetJobQueueSnapshot			Read
ListConsumableResources	batch:ListConsumableResources			List
ListJobs	batch:ListJobs			List
ListJobsByConsumableResource	batch:ListJobsByConsumableResource			List
ListQuotaShares	batch:ListQuotaShares			List
ListSchedulingPolicies	batch:ListSchedulingPolicies			Read
ListServiceJobs	batch:ListServiceJobs			List
ListTagsForResource	batch:ListTagsForResource			Read
RegisterJobDefinition	batch:RegisterJobDefinition			Write
	batch:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ecs-tasks.amazonaws.com	Write
SubmitJob	batch:SubmitJob			Write
SubmitJob	batch:TagResource			Tagging, Write
SubmitServiceJob	batch:SubmitServiceJob			Write
	batch:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	sagemaker.amazonaws.com	Write
TagResource	batch:TagResource			Tagging, Write
TerminateJob	batch:TerminateJob			Write
TerminateServiceJob	batch:TerminateServiceJob			Write
UntagResource	batch:UntagResource			Tagging, Write
UpdateComputeEnvironment	batch:UpdateComputeEnvironment			Write
UpdateComputeEnvironment	iam:PassRole	iam:PassedToService	batch.amazonaws.com, ec2.amazonaws.com, ecs.amazonaws.com	Write
UpdateConsumableResource	batch:UpdateConsumableResource			Write
UpdateJobQueue	batch:UpdateJobQueue			Write
UpdateQuotaShare	batch:UpdateQuotaShare			Write
UpdateSchedulingPolicy	batch:UpdateSchedulingPolicy			Write
UpdateServiceEnvironment	batch:UpdateServiceEnvironment			Write
UpdateServiceJob	batch:UpdateServiceJob			Write

Actions defined by Amazon Batch

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CancelJob	Grants permission to cancel a job in an Amazon Batch job queue in your account	job*	aws:ResourceTag/${TagKey}	Write
CreateComputeEnvironment	Grants permission to create an Amazon Batch compute environment in your account	compute-environment*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConsumableResource	Grants permission to create an Amazon Batch consumable resource in your account	consumable-resource*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateJobQueue	Grants permission to create an Amazon Batch job queue in your account	compute-environment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		job-queue*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		scheduling-policy	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		service-environment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateQuotaShare	Grants permission to create an Amazon Batch quota share in your account	job-queue*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateQuotaShare		quota-share*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSchedulingPolicy	Grants permission to create an Amazon Batch scheduling policy in your account	scheduling-policy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateServiceEnvironment	Grants permission to create an Amazon Batch service environment in your account	service-environment*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteComputeEnvironment	Grants permission to delete an Amazon Batch compute environment in your account	compute-environment*	aws:ResourceTag/${TagKey}	Write
DeleteConsumableResource	Grants permission to delete an Amazon Batch consumable resource in your account	consumable-resource*	aws:ResourceTag/${TagKey}	Write
DeleteJobQueue	Grants permission to delete an Amazon Batch job queue in your account	job-queue*	aws:ResourceTag/${TagKey}	Write
DeleteQuotaShare	Grants permission to delete an Amazon Batch quota share in your account	quota-share*	aws:ResourceTag/${TagKey}	Write
DeleteSchedulingPolicy	Grants permission to delete an Amazon Batch scheduling policy in your account	scheduling-policy*	aws:ResourceTag/${TagKey}	Write
DeleteServiceEnvironment	Grants permission to delete an Amazon Batch service environment in your account	service-environment*	aws:ResourceTag/${TagKey}	Write
DeregisterJobDefinition	Grants permission to deregister an Amazon Batch job definition in your account	job-definition-revision*	aws:ResourceTag/${TagKey}	Write
DescribeComputeEnvironments	Grants permission to describe one or more Amazon Batch compute environments in your account			Read
DescribeConsumableResource	Grants permission to describe one or more Amazon Batch consumable resource in your account	consumable-resource*	aws:ResourceTag/${TagKey}	Read
DescribeJobDefinitions	Grants permission to describe one or more Amazon Batch job definitions in your account			Read
DescribeJobQueues	Grants permission to describe one or more Amazon Batch job queues in your account			Read
DescribeJobs	Grants permission to describe a list of Amazon Batch jobs in your account			Read
DescribeQuotaShare	Grants permission to describe an Amazon Batch quota share in your account	quota-share*	aws:ResourceTag/${TagKey}	Read
DescribeSchedulingPolicies	Grants permission to describe one or more Amazon Batch scheduling policies in your account			Read
DescribeServiceEnvironments	Grants permission to describe one or more Amazon Batch service environments in your account			Read
DescribeServiceJob	Grants permission to describe a Amazon Batch service job in your account			Read
GetJobQueueSnapshot	Grants permission to get a snapshot of an Amazon Batch job queue in your account	job-queue*	aws:ResourceTag/${TagKey}	Read
ListConsumableResources	Grants permission to list Amazon Batch consumable resources in your account			List
ListJobs	Grants permission to list jobs for a specified Amazon Batch job queue in your account			List
ListJobsByConsumableResource	Grants permission to list Amazon Batch jobs that require a specific consumable resource in your account	consumable-resource*	aws:ResourceTag/${TagKey}	List
ListQuotaShares	Grants permission to list Amazon Batch quota shares in your account	job-queue*	aws:ResourceTag/${TagKey}	List
ListSchedulingPolicies	Grants permission to list Amazon Batch scheduling policies in your account			Read
ListServiceJobs	Grants permission to list service jobs for a specified Amazon Batch job queue in your account			List
ListTagsForResource	Grants permission to list tags for an Amazon Batch resource in your account	compute-environment	aws:ResourceTag/${TagKey}	Read
		consumable-resource	aws:ResourceTag/${TagKey}
		job	aws:ResourceTag/${TagKey}
		job-definition-revision	aws:ResourceTag/${TagKey}
		job-queue	aws:ResourceTag/${TagKey}
		quota-share	aws:ResourceTag/${TagKey}
		scheduling-policy	aws:ResourceTag/${TagKey}
		service-environment	aws:ResourceTag/${TagKey}
		service-job	aws:ResourceTag/${TagKey}
RegisterJobDefinition	Grants permission to register an Amazon Batch job definition in your account	consumable-resource	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys batch:AWSLogsCreateGroup batch:AWSLogsGroup batch:AWSLogsRegion batch:AWSLogsStreamPrefix batch:EKSImage batch:EKSNamespace batch:EKSPrivileged batch:EKSRunAsGroup batch:EKSRunAsUser batch:EKSServiceAccountName batch:Image batch:LogDriver batch:Privileged batch:User	Write
RegisterJobDefinition		job-definition*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys batch:AWSLogsCreateGroup batch:AWSLogsGroup batch:AWSLogsRegion batch:AWSLogsStreamPrefix batch:EKSImage batch:EKSNamespace batch:EKSPrivileged batch:EKSRunAsGroup batch:EKSRunAsUser batch:EKSServiceAccountName batch:Image batch:LogDriver batch:Privileged batch:User	Write
SubmitJob	Grants permission to submit an Amazon Batch job from a job definition in your account	consumable-resource	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		job*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys batch:EKSImage batch:EKSNamespace batch:ShareIdentifier
		job-definition	aws:RequestTag/${TagKey} aws:TagKeys
		job-definition-revision	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		job-queue*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
SubmitServiceJob	Grants permission to submit an Amazon Batch service job	job-queue*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys batch:SchedulingPriority	Write
		quota-share	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys batch:SchedulingPriority
		service-job*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys batch:SchedulingPriority batch:ShareIdentifier
TagResource	Grants permission to tag an Amazon Batch resource in your account	compute-environment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		consumable-resource	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		job-definition-revision	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		job-queue	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		quota-share	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		scheduling-policy	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		service-environment	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		service-job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
TerminateJob	Grants permission to terminate a job in an Amazon Batch job queue in your account	job*	aws:ResourceTag/${TagKey}	Write
TerminateServiceJob	Grants permission to terminate a service job in an Amazon Batch job queue in your account	service-job*	aws:ResourceTag/${TagKey}	Write
UntagResource	Grants permission to untag an Amazon Batch resource in your account	compute-environment	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		consumable-resource	aws:ResourceTag/${TagKey} aws:TagKeys
		job	aws:ResourceTag/${TagKey} aws:TagKeys
		job-definition-revision	aws:ResourceTag/${TagKey} aws:TagKeys
		job-queue	aws:ResourceTag/${TagKey} aws:TagKeys
		quota-share	aws:ResourceTag/${TagKey} aws:TagKeys
		scheduling-policy	aws:ResourceTag/${TagKey} aws:TagKeys
		service-environment	aws:ResourceTag/${TagKey} aws:TagKeys
		service-job	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateComputeEnvironment	Grants permission to update an Amazon Batch compute environment in your account	compute-environment*	aws:ResourceTag/${TagKey}	Write
UpdateConsumableResource	Grants permission to update an Amazon Batch consumable resource in your account	consumable-resource*	aws:ResourceTag/${TagKey}	Write
UpdateJobQueue	Grants permission to update an Amazon Batch job queue in your account	compute-environment	aws:ResourceTag/${TagKey}	Write
		job-queue*	aws:ResourceTag/${TagKey}
		scheduling-policy	aws:ResourceTag/${TagKey}
UpdateQuotaShare	Grants permission to update an Amazon Batch quota share in your account	quota-share*	aws:ResourceTag/${TagKey}	Write
UpdateSchedulingPolicy	Grants permission to update an Amazon Batch scheduling policy in your account	scheduling-policy*	aws:ResourceTag/${TagKey}	Write
UpdateServiceEnvironment	Grants permission to update an Amazon Batch service environment in your account	service-environment*	aws:ResourceTag/${TagKey}	Write
UpdateServiceJob	Grants permission to update a service job in an Amazon Batch job queue in your account	service-job*	aws:ResourceTag/${TagKey} batch:SchedulingPriority	Write

Resource types defined by Amazon Batch

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
compute-environment	arn:${Partition}:batch:${Region}:${Account}:compute-environment/${ComputeEnvironmentName}	aws:ResourceTag/${TagKey}
consumable-resource	arn:${Partition}:batch:${Region}:${Account}:consumable-resource/${ConsumableResourceName}	aws:ResourceTag/${TagKey}
job	arn:${Partition}:batch:${Region}:${Account}:job/${JobId}	aws:ResourceTag/${TagKey}
job-definition	arn:${Partition}:batch:${Region}:${Account}:job-definition/${JobDefinitionName}
job-definition-revision	arn:${Partition}:batch:${Region}:${Account}:job-definition/${JobDefinitionName}:${Revision}	aws:ResourceTag/${TagKey}
job-queue	arn:${Partition}:batch:${Region}:${Account}:job-queue/${JobQueueName}	aws:ResourceTag/${TagKey}
quota-share	arn:${Partition}:batch:${Region}:${Account}:job-queue/${JobQueueName}/quota-share/${QuotaShareName}	aws:ResourceTag/${TagKey}
scheduling-policy	arn:${Partition}:batch:${Region}:${Account}:scheduling-policy/${SchedulingPolicyName}	aws:ResourceTag/${TagKey}
service-environment	arn:${Partition}:batch:${Region}:${Account}:service-environment/${ServiceEnvironmentName}	aws:ResourceTag/${TagKey}
service-job	arn:${Partition}:batch:${Region}:${Account}:service-job/${JobId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Batch

Amazon Batch defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
batch:AWSLogsCreateGroup	Filters access by the specified logging driver to determine whether awslogs group will be created for the logs	Bool
batch:AWSLogsGroup	Filters access by the awslogs group where the logs are located	String
batch:AWSLogsRegion	Filters access by the region where the logs are sent to	String
batch:AWSLogsStreamPrefix	Filters access by the awslogs log stream prefix	String
batch:EKSImage	Filters access by the image used to start a container for an Amazon EKS job	String
batch:EKSNamespace	Filters access by the namespace of a cluster used to run the pod for an Amazon EKS job	String
batch:EKSPrivileged	Filters access by the specified privileged parameter value that determines whether the container is given elevated privileges on the host container instance (similar to the root user) for an Amazon EKS job	Bool
batch:EKSRunAsGroup	Filters access by the specified group numeric ID (gid) used to start a container in an Amazon EKS job	Numeric
batch:EKSRunAsUser	Filters access by the specified user numeric ID (uid) used to start a a container in an Amazon EKS job	Numeric
batch:EKSServiceAccountName	Filters access by the name of the service account used to run the pod for an Amazon EKS job	String
batch:Image	Filters access by the image used to start a container	String
batch:LogDriver	Filters access by the log driver used for the container	String
batch:Privileged	Filters access by the specified privileged parameter value that determines whether the container is given elevated privileges on the host container instance (similar to the root user)	Bool
batch:SchedulingPriority	Filters access by the scheduling priority for jobs in the job queue	Numeric
batch:ShareIdentifier	Filters access by the shareIdentifier used inside submit job	String
batch:User	Filters access by user name or numeric uid used inside the container	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Backup storage (backup-storage)

Amazon Budget Service (budgets)