Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Budget Service

Amazon Budget Service (service prefix: budgets) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Budget Service
Actions defined by Amazon Budget Service
Resource types defined by Amazon Budget Service
Condition keys for Amazon Budget Service

API operations defined by Amazon Budget Service

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateBudget	budgets:ModifyBudget			Write
	budgets:TagResource			Tagging, Write
	aws-portal:ModifyBilling			Write
CreateBudgetAction	budgets:CreateBudgetAction			Write
	budgets:TagResource			Tagging, Write
	aws-portal:ModifyBilling			Write
	iam:PassRole	iam:PassedToService	budgets.amazonaws.com	Write
CreateNotification	budgets:ModifyBudget			Write
CreateNotification	aws-portal:ModifyBilling			Write
CreateSubscriber	budgets:ModifyBudget			Write
CreateSubscriber	aws-portal:ModifyBilling			Write
DeleteBudget	budgets:ModifyBudget			Write
DeleteBudget	aws-portal:ModifyBilling			Write
DeleteBudgetAction	budgets:DeleteBudgetAction			Write
DeleteBudgetAction	aws-portal:ModifyBilling			Write
DeleteNotification	budgets:ModifyBudget			Write
DeleteNotification	aws-portal:ModifyBilling			Write
DeleteSubscriber	budgets:ModifyBudget			Write
DeleteSubscriber	aws-portal:ModifyBilling			Write
DescribeBudget	budgets:ViewBudget			Read
DescribeBudget	aws-portal:ViewBilling			Read
DescribeBudgetAction	budgets:DescribeBudgetAction			Read
DescribeBudgetAction	aws-portal:ViewBilling			Read
DescribeBudgetActionHistories	budgets:DescribeBudgetActionHistories			Read
DescribeBudgetActionHistories	aws-portal:ViewBilling			Read
DescribeBudgetActionsForAccount	budgets:DescribeBudgetActionsForAccount			Read
DescribeBudgetActionsForAccount	aws-portal:ViewBilling			Read
DescribeBudgetActionsForBudget	budgets:DescribeBudgetActionsForBudget			Read
DescribeBudgetActionsForBudget	aws-portal:ViewBilling			Read
DescribeBudgetNotificationsForAccount	budgets:ViewBudget			Read
DescribeBudgetNotificationsForAccount	aws-portal:ViewBilling			Read
DescribeBudgetPerformanceHistory	budgets:ViewBudget			Read
DescribeBudgetPerformanceHistory	aws-portal:ViewBilling			Read
DescribeBudgets	budgets:ViewBudget			Read
DescribeBudgets	aws-portal:ViewBilling			Read
DescribeNotificationsForBudget	budgets:ViewBudget			Read
DescribeNotificationsForBudget	aws-portal:ViewBilling			Read
DescribeSubscribersForNotification	budgets:ViewBudget			Read
DescribeSubscribersForNotification	aws-portal:ViewBilling			Read
ExecuteBudgetAction	budgets:ExecuteBudgetAction			Write
ExecuteBudgetAction	aws-portal:ModifyBilling			Write
ListTagsForResource	budgets:ListTagsForResource			Read
ListTagsForResource	aws-portal:ViewBilling			Read
TagResource	budgets:TagResource			Tagging, Write
TagResource	aws-portal:ModifyBilling			Write
UntagResource	budgets:UntagResource			Tagging, Write
UntagResource	aws-portal:ModifyBilling			Write
UpdateBudget	budgets:ModifyBudget			Write
UpdateBudget	aws-portal:ModifyBilling			Write
UpdateBudgetAction	budgets:UpdateBudgetAction			Write
	aws-portal:ModifyBilling			Write
	iam:PassRole	iam:PassedToService	budgets.amazonaws.com	Write
UpdateNotification	budgets:ModifyBudget			Write
UpdateNotification	aws-portal:ModifyBilling			Write
UpdateSubscriber	budgets:ModifyBudget			Write
UpdateSubscriber	aws-portal:ModifyBilling			Write

Actions defined by Amazon Budget Service

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateBudgetAction	Grants permission to configure a response that executes once your budget exceeds a specific budget threshold. Creating a budget action with tags also requires the 'budgets:TagResource' permission	budgetAction*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteBudgetAction	Grants permission to delete an action that is associated with a specific budget	budgetAction*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DescribeBudgetAction	Grants permission to retrieve the details of a specific budget action associated with a budget	budgetAction*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
DescribeBudgetActionHistories	Grants permission to retrieve a historical view of the budget actions statuses associated with a particular budget action. These status include statues such as 'Standby', 'Pending' and 'Executed'	budgetAction*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
DescribeBudgetActionsForAccount	Grants permission to retrieve the details of all of the budget actions associated with your account			Read
DescribeBudgetActionsForBudget	Grants permission to retrieve the details of all of the budget actions associated with a budget	budget*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
ExecuteBudgetAction	Grants permission to initiate a pending budget action as well as reverse a previously executed budget action	budgetAction*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
ListTagsForResource	Grants permission to view resource tags for a budget or budget action	budget	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
ListTagsForResource		budgetAction	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read
ModifyBudget	Grants permission to create and modify budgets, and edit budget details. Creating a budget with tags also requires the 'budgets:TagResource' permission	budget*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
TagResource	Grants permission to apply resource tags to a budget or budget action. Also needed to create a budget or budget action with tags	budget	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource		budgetAction	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove resource tags from a budget or budget action	budget	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource		budgetAction	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateBudgetAction	Grants permission to update the details of a specific budget action associated with a budget	budgetAction*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
ViewBudget	Grants permission to view budgets and budget details	budget*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Read

Resource types defined by Amazon Budget Service

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
budget	arn:${Partition}:budgets::${Account}:budget/${BudgetName}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
budgetAction	arn:${Partition}:budgets::${Account}:budget/${BudgetName}/action/${ActionId}	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys

Resource types

ARN

Condition keys

budget

arn:${Partition}:budgets::${Account}:budget/${BudgetName}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

budgetAction

arn:${Partition}:budgets::${Account}:budget/${BudgetName}/action/${ActionId}

aws:RequestTag/${TagKey}

aws:ResourceTag/${TagKey}

aws:TagKeys

Condition keys for Amazon Budget Service

Amazon Budget Service defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access based on the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access based on the tags associated with the resource	String
aws:TagKeys	Filters access based on the tag keys that are passed in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Batch (batch)

Amazon Certificate Manager (acm)