Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon CloudFormation

Amazon CloudFormation (service prefix: cloudformation) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon CloudFormation
Actions defined by Amazon CloudFormation
Permission-only actions for Amazon CloudFormation
Resource types defined by Amazon CloudFormation
Condition keys for Amazon CloudFormation

API operations defined by Amazon CloudFormation

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
ActivateOrganizationsAccess	cloudformation:ActivateOrganizationsAccess			Write
	iam:CreateServiceLinkedRole			Write
	iam:GetRole			Read
ActivateType	cloudformation:ActivateType			Write
ActivateType	iam:PassRole	iam:PassedToService	resources.cloudformation.amazonaws.com	Write
BatchDescribeTypeConfigurations	cloudformation:BatchDescribeTypeConfigurations			Read
CancelUpdateStack	cloudformation:CancelUpdateStack			Write
ContinueUpdateRollback	cloudformation:ContinueUpdateRollback			Write
ContinueUpdateRollback	iam:PassRole	iam:PassedToService	cloudformation.amazonaws.com	Write
CreateChangeSet	cloudformation:CreateChangeSet			Write
	cloudformation:TagResource			Tagging, Write
	cloudformation:UntagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	cloudformation.amazonaws.com	Write
CreateGeneratedTemplate	cloudformation:CreateGeneratedTemplate			Write
CreateStack	cloudformation:CreateStack			Write
	cloudformation:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	cloudformation.amazonaws.com	Write
CreateStackInstances	cloudformation:CreateStackInstances			Write
CreateStackRefactor	cloudformation:CreateStackRefactor			Write
CreateStackSet	cloudformation:CreateStackSet			Write
	cloudformation:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	cloudformation.amazonaws.com	Write
DeactivateOrganizationsAccess	cloudformation:DeactivateOrganizationsAccess			Write
DeactivateType	cloudformation:DeactivateType			Write
DeleteChangeSet	cloudformation:DeleteChangeSet			Write
DeleteGeneratedTemplate	cloudformation:DeleteGeneratedTemplate			Write
DeleteStack	cloudformation:DeleteStack			Write
DeleteStack	iam:PassRole	iam:PassedToService	cloudformation.amazonaws.com	Write
DeleteStackInstances	cloudformation:DeleteStackInstances			Write
DeleteStackSet	cloudformation:DeleteStackSet			Write
DeregisterType	cloudformation:DeregisterType			Write
DescribeAccountLimits	cloudformation:DescribeAccountLimits			Read
DescribeChangeSet	cloudformation:DescribeChangeSet			Read
DescribeChangeSetHooks	cloudformation:DescribeChangeSetHooks			Read
DescribeEvents	cloudformation:DescribeEvents			Read
DescribeGeneratedTemplate	cloudformation:DescribeGeneratedTemplate			Read
DescribeOrganizationsAccess	cloudformation:DescribeOrganizationsAccess			Read
DescribePublisher	cloudformation:DescribePublisher			Read
DescribeResourceScan	cloudformation:DescribeResourceScan			Read
DescribeStackDriftDetectionStatus	cloudformation:DescribeStackDriftDetectionStatus			Read
DescribeStackEvents	cloudformation:DescribeStackEvents			Read
DescribeStackInstance	cloudformation:DescribeStackInstance			Read
DescribeStackRefactor	cloudformation:DescribeStackRefactor			Read
DescribeStackResource	cloudformation:DescribeStackResource			Read
DescribeStackResourceDrifts	cloudformation:DescribeStackResourceDrifts			Read
DescribeStackResources	cloudformation:DescribeStackResources			Read
DescribeStackSet	cloudformation:DescribeStackSet			Read
DescribeStackSetOperation	cloudformation:DescribeStackSetOperation			Read
DescribeStacks	cloudformation:DescribeStacks			List
DescribeStacks	cloudformation:ListStacks			List
DescribeType	cloudformation:DescribeType			Read
DescribeTypeRegistration	cloudformation:DescribeTypeRegistration			Read
DetectStackDrift	cloudformation:DetectStackDrift			Read
DetectStackDrift	cloudformation:DetectStackResourceDrift			Read
DetectStackResourceDrift	cloudformation:DetectStackResourceDrift			Read
DetectStackSetDrift	cloudformation:DetectStackSetDrift			Read
EstimateTemplateCost	cloudformation:EstimateTemplateCost			Read
ExecuteChangeSet	cloudformation:ExecuteChangeSet			Write
	cloudformation:TagResource			Tagging, Write
	cloudformation:UntagResource			Tagging, Write
ExecuteStackRefactor	cloudformation:ExecuteStackRefactor			Write
GetGeneratedTemplate	cloudformation:GetGeneratedTemplate			Read
GetHookResult	cloudformation:GetHookResult			Read
GetStackPolicy	cloudformation:GetStackPolicy			Read
GetTemplate	cloudformation:GetTemplate			Read
GetTemplateSummary	cloudformation:GetTemplateSummary			Read
ImportStacksToStackSet	cloudformation:ImportStacksToStackSet			Write
ListChangeSets	cloudformation:ListChangeSets			List
ListExports	cloudformation:ListExports			List
ListGeneratedTemplates	cloudformation:ListGeneratedTemplates			List
ListHookResults	cloudformation:ListAllHookResults			List
ListHookResults	cloudformation:ListHookResults			List
ListImports	cloudformation:ListImports			List
ListResourceScanRelatedResources	cloudformation:ListResourceScanRelatedResources			List
ListResourceScanResources	cloudformation:ListResourceScanResources			List
ListResourceScans	cloudformation:ListResourceScans			List
ListStackInstanceResourceDrifts	cloudformation:ListStackInstanceResourceDrifts			List
ListStackInstances	cloudformation:ListStackInstances			List
ListStackRefactorActions	cloudformation:ListStackRefactorActions			List
ListStackRefactors	cloudformation:ListStackRefactors			List
ListStackResources	cloudformation:ListStackResources			List
ListStackSetAutoDeploymentTargets	cloudformation:ListStackSetAutoDeploymentTargets			List
ListStackSetOperationResults	cloudformation:ListStackSetOperationResults			List
ListStackSetOperations	cloudformation:ListStackSetOperations			List
ListStackSets	cloudformation:ListStackSets			List
ListStacks	cloudformation:ListStacks			List
ListTypeRegistrations	cloudformation:ListTypeRegistrations			List
ListTypeVersions	cloudformation:ListTypeVersions			List
ListTypes	cloudformation:ListTypes			List
PublishType	cloudformation:PublishType			Write
RecordHandlerProgress	cloudformation:RecordHandlerProgress			Write
RegisterPublisher	cloudformation:RegisterPublisher			Write
RegisterType	cloudformation:RegisterType			Write
RegisterType	iam:PassRole	iam:PassedToService	resources.cloudformation.amazonaws.com	Write
RollbackStack	cloudformation:RollbackStack			Write
RollbackStack	iam:PassRole	iam:PassedToService	cloudformation.amazonaws.com	Write
SetStackPolicy	cloudformation:SetStackPolicy			Permissions management, Write
SetTypeConfiguration	cloudformation:SetTypeConfiguration			Write
SetTypeDefaultVersion	cloudformation:SetTypeDefaultVersion			Write
SignalResource	cloudformation:SignalResource			Write
StartResourceScan	cloudformation:StartResourceScan			Write
StopStackSetOperation	cloudformation:StopStackSetOperation			Write
TestType	cloudformation:TestType			Write
UpdateGeneratedTemplate	cloudformation:UpdateGeneratedTemplate			Write
UpdateStack	cloudformation:SetStackPolicy			Permissions management, Write
	cloudformation:TagResource			Tagging, Write
	cloudformation:UntagResource			Tagging, Write
	cloudformation:UpdateStack			Write
	iam:PassRole	iam:PassedToService	cloudformation.amazonaws.com	Write
UpdateStackInstances	cloudformation:UpdateStackInstances			Write
UpdateStackSet	cloudformation:TagResource			Tagging, Write
	cloudformation:UntagResource			Tagging, Write
	cloudformation:UpdateStackSet			Write
	iam:PassRole	iam:PassedToService	cloudformation.amazonaws.com	Write
UpdateTerminationProtection	cloudformation:UpdateTerminationProtection			Write
ValidateTemplate	cloudformation:ValidateTemplate			Read

Actions defined by Amazon CloudFormation

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
ActivateOrganizationsAccess	Grants permission to activate trusted access between StackSets and Organizations. With trusted access between StackSets and Organizations activated, the management account has permissions to create and manage StackSets for your organization			Write
ActivateType	Grants permission to activate a public third-party extension, making it available for use in stack templates			Write
BatchDescribeTypeConfigurations	Grants permission to return configuration data for the specified CloudFormation extensions			Read
CancelUpdateStack	Grants permission to cancel an update on the specified stack	stack*	aws:ResourceTag/${TagKey}	Write
ContinueUpdateRollback	Grants permission to continue rolling back a stack that is in the UPDATE_ROLLBACK_FAILED state to the UPDATE_ROLLBACK_COMPLETE state	stack*	aws:ResourceTag/${TagKey} cloudformation:RoleArn	Write
CreateChangeSet	Grants permission to create a list of changes for a stack	stack*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys cloudformation:ChangeSetName cloudformation:ImportResourceTypes cloudformation:ResourceTypes cloudformation:RoleArn cloudformation:StackPolicyUrl cloudformation:TemplateUrl	Write
CreateGeneratedTemplate	Grants permission to create a template from existing resources that are not already managed with CloudFormation			Write
CreateStack	Grants permission to create a stack as specified in the template	stack*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys cloudformation:ResourceTypes cloudformation:RoleArn cloudformation:StackPolicyUrl cloudformation:TemplateUrl	Write
CreateStackInstances	Grants permission to create stack instances for the specified accounts, within the specified regions	stackset*	aws:ResourceTag/${TagKey} aws:TagKeys cloudformation:TargetRegion	Write
		stackset-target	aws:TagKeys cloudformation:TargetRegion
		type	aws:TagKeys cloudformation:TargetRegion
CreateStackRefactor	Grants permission to create a stack refactor	stack*	aws:ResourceTag/${TagKey}	Write
CreateStackSet	Grants permission to create a stackset as specified in the template		aws:RequestTag/${TagKey} aws:TagKeys cloudformation:RoleArn cloudformation:TemplateUrl	Write
DeactivateOrganizationsAccess	Grants permission to deactivate trusted access between StackSets and Organizations. If trusted access is deactivated, the management account does not have permissions to create and manage service-managed StackSets for your organization			Write
DeactivateType	Grants permission to deactivate a public extension that was previously activated in this account and region			Write
DeleteChangeSet	Grants permission to delete the specified change set. Deleting change sets ensures that no one executes the wrong change set	stack*	aws:ResourceTag/${TagKey} cloudformation:ChangeSetName	Write
DeleteGeneratedTemplate	Grants permission to delete a generated template			Write
DeleteStack	Grants permission to delete a specified stack	stack*	aws:ResourceTag/${TagKey} cloudformation:RoleArn	Write
DeleteStackInstances	Grants permission to delete stack instances for the specified accounts, in the specified regions	stackset*	aws:ResourceTag/${TagKey} cloudformation:TargetRegion	Write
		stackset-target	cloudformation:TargetRegion
		type	cloudformation:TargetRegion
DeleteStackSet	Grants permission to delete a specified stackset	stackset*	aws:ResourceTag/${TagKey}	Write
DeregisterType	Grants permission to deregister an existing CloudFormation type or type version			Write
DescribeAccountLimits	Grants permission to retrieve your account's Amazon CloudFormation limits			Read
DescribeChangeSet	Grants permission to return the description for the specified change set	stack*	aws:ResourceTag/${TagKey} cloudformation:ChangeSetName	Read
DescribeChangeSetHooks	Grants permission to return the Hook invocation information for the specified change set	stack*	aws:ResourceTag/${TagKey} cloudformation:ChangeSetName	Read
DescribeEvents	Grants permission to return all related events for a specified operation	changeset	aws:ResourceTag/${TagKey}	Read
DescribeEvents		stack	aws:ResourceTag/${TagKey}	Read
DescribeGeneratedTemplate	Grants permission to describe a generated template. The output includes details about the progress of the creation of a generated template			Read
DescribeOrganizationsAccess	Grants permission to return information about the account's OrganizationAccess status			Read
DescribePublisher	Grants permission to return information about a CloudFormation extension publisher			Read
DescribeResourceScan	Grants permission to describe details of a resource scan			Read
DescribeStackDriftDetectionStatus	Grants permission to return information about a stack drift detection operation			Read
DescribeStackEvents	Grants permission to return all stack related events for a specified stack	stack*	aws:ResourceTag/${TagKey}	Read
DescribeStackInstance	Grants permission to return the stack instance that's associated with the specified stack set, Amazon Web Services account, and region	stackset*	aws:ResourceTag/${TagKey}	Read
DescribeStackRefactor	Grants permission to return the description for the specified stack refactor	stack*	aws:ResourceTag/${TagKey}	Read
DescribeStackResource	Grants permission to return a description of the specified resource in the specified stack	stack*	aws:ResourceTag/${TagKey}	Read
DescribeStackResourceDrifts	Grants permission to return drift information for the resources that have been checked for drift in the specified stack	stack*	aws:ResourceTag/${TagKey}	Read
DescribeStackResources	Grants permission to return Amazon resource descriptions for running and deleted stacks	stack*	aws:ResourceTag/${TagKey}	Read
DescribeStackSet	Grants permission to return the description of the specified stack set	stackset*	aws:ResourceTag/${TagKey}	Read
DescribeStackSetOperation	Grants permission to return the description of the specified stack set operation	stackset*	aws:ResourceTag/${TagKey}	Read
DescribeStacks	Grants permission to return the description for the specified stack, and to all stacks when used in combination with the ListStacks action	stack	aws:ResourceTag/${TagKey}	List
DescribeType	Grants permission to return information about the CloudFormation type requested			Read
DescribeTypeRegistration	Grants permission to return information about the registration process for a CloudFormation type			Read
DetectStackDrift	Grants permission to detects whether a stack's actual configuration differs, or has drifted, from it's expected configuration, as defined in the stack template and any values specified as template parameters	stack*	aws:ResourceTag/${TagKey}	Read
DetectStackResourceDrift	Grants permission to return information about whether a resource's actual configuration differs, or has drifted, from it's expected configuration, as defined in the stack template and any values specified as template parameters	stack*	aws:ResourceTag/${TagKey}	Read
DetectStackSetDrift	Grants permission to enable users to detect drift on a stack set and the stack instances that belong to that stack set	stackset*	aws:ResourceTag/${TagKey}	Read
EstimateTemplateCost	Grants permission to return the estimated monthly cost of a template		cloudformation:TemplateUrl	Read
ExecuteChangeSet	Grants permission to update a stack using the input information that was provided when the specified change set was created	stack*	aws:ResourceTag/${TagKey} cloudformation:ChangeSetName	Write
ExecuteStackRefactor	Grants permission to execute a stack refactor using the input information that was provided when the specified stack refactor was created	stack*	aws:ResourceTag/${TagKey}	Write
GetGeneratedTemplate	Grants permission to retrieve a generated template			Read
GetHookResult	Grants permission to return detailed information about a specific hook invocation result		cloudformation:TypeArn	Read
GetStackPolicy	Grants permission to return the stack policy for a specified stack	stack*	aws:ResourceTag/${TagKey}	Read
GetTemplate	Grants permission to return the template body for a specified stack	stack*	aws:ResourceTag/${TagKey}	Read
GetTemplateSummary	Grants permission to return information about a new or existing template	stack	aws:ResourceTag/${TagKey} cloudformation:TemplateUrl	Read
GetTemplateSummary		stackset	aws:ResourceTag/${TagKey} cloudformation:TemplateUrl	Read
ImportStacksToStackSet	Grants permission to enable users to import existing stacks to a new or existing stackset	stackset*	aws:ResourceTag/${TagKey}	Write
ListAllHookResults	Grants permission to return Hook invocations result information for a specified Hook, a combination of Hook and status, or all Hooks		cloudformation:TypeArn	List
ListChangeSets	Grants permission to return the ID and status of each active change set for a stack. For example, Amazon CloudFormation lists change sets that are in the CREATE_IN_PROGRESS or CREATE_PENDING state	stack*	aws:ResourceTag/${TagKey}	List
ListExports	Grants permission to list all exported output values in the account and region in which you call this action			List
ListGeneratedTemplates	Grants permission to list your generated templates in this Region			List
ListHookResults	Grants permission to return Hook invocations result information for the specified target	stack	aws:ResourceTag/${TagKey} cloudformation:ChangeSetName	List
ListImports	Grants permission to list all stacks that are importing an exported output value			List
ListResourceScanRelatedResources	Grants permission to list the related resources for a list of resources from a resource scan. The response indicates whether each returned resource is already managed by CloudFormation			List
ListResourceScanResources	Grants permission to list the resources from a resource scan. The results can be filtered by resource identifier, resource type prefix, tag key, and tag value			List
ListResourceScans	Grants permission to list the resource scans from newest to oldest. By default it will return up to 10 resource scans			List
ListStackInstanceResourceDrifts	Grants permission to return drift information for the resources that have been checked for drift in the specified stack instance	stackset*	aws:ResourceTag/${TagKey}	List
ListStackInstances	Grants permission to return summary information about stack instances that are associated with the specified stack set	stackset*	aws:ResourceTag/${TagKey}	List
ListStackRefactorActions	Grants permission to return the list of actions of the specified stack refactor	stack*	aws:ResourceTag/${TagKey}	List
ListStackRefactors	Grants permission to return the ID and status of each active stack refactor	stack*	aws:ResourceTag/${TagKey}	List
ListStackResources	Grants permission to return descriptions of all resources of the specified stack	stack*	aws:ResourceTag/${TagKey}	List
ListStackSetAutoDeploymentTargets	Grants permission to return summary information about StackSet Auto Deployment Targets	stackset*	aws:ResourceTag/${TagKey}	List
ListStackSetOperationResults	Grants permission to return summary information about the results of a stack set operation	stackset*	aws:ResourceTag/${TagKey}	List
ListStackSetOperations	Grants permission to return summary information about operations performed on a stack set	stackset*	aws:ResourceTag/${TagKey}	List
ListStackSets	Grants permission to return summary information about stack sets that are associated with the user			List
ListStacks	Grants permission to return the summary information for stacks whose status matches the specified StackStatusFilter. In combination with the DescribeStacks action, grants permission to list descriptions for stacks			List
ListTypeRegistrations	Grants permission to list CloudFormation type registration attempts			List
ListTypeVersions	Grants permission to list versions of a particular CloudFormation type			List
ListTypes	Grants permission to list available CloudFormation types			List
PublishType	Grants permission to publish the specified extension to the CloudFormation registry as a public extension in this region			Write
RecordHandlerProgress	Grants permission to record the handler progress	stack*	aws:ResourceTag/${TagKey}	Write
RegisterPublisher	Grants permission to register account as a publisher of public extensions in the CloudFormation registry			Write
RegisterType	Grants permission to register a new CloudFormation type			Write
RollbackStack	Grants permission to rollback the stack to the last stable state	stack*	aws:ResourceTag/${TagKey} cloudformation:RoleArn	Write
SetStackPolicy	Grants permission to set a stack policy for a specified stack	stack*	aws:ResourceTag/${TagKey} cloudformation:StackPolicyUrl	Permissions management, Write
SetTypeConfiguration	Grants permission to set the configuration data for a registered CloudFormation extension, in the given account and region			Write
SetTypeDefaultVersion	Grants permission to set which version of a CloudFormation type applies to CloudFormation operations			Write
SignalResource	Grants permission to send a signal to the specified resource with a success or failure status	stack*	aws:ResourceTag/${TagKey}	Write
StartResourceScan	Grants permission to start a scan of the resources in this account in this Region			Write
StopStackSetOperation	Grants permission to stop an in-progress operation on a stack set and its associated stack instances	stackset*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag cloudformation resources	changeset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys cloudformation:CreateAction	Tagging, Write
		stack	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys cloudformation:CreateAction
		stackset	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys cloudformation:CreateAction
TestType	Grants permission to test a registered extension to make sure it meets all necessary requirements for being published in the CloudFormation registry			Write
UntagResource	Grants permission to untag cloudformation resources	changeset	aws:ResourceTag/${TagKey} aws:TagKeys cloudformation:CreateAction	Tagging, Write
		stack	aws:ResourceTag/${TagKey} aws:TagKeys cloudformation:CreateAction
		stackset	aws:ResourceTag/${TagKey} aws:TagKeys cloudformation:CreateAction
UpdateGeneratedTemplate	Grants permission to update a generated template. This can be used to change the name, add and remove resources, refresh resources, and change the DeletionPolicy and UpdateReplacePolicy settings			Write
UpdateStack	Grants permission to update a stack as specified in the template	stack*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys cloudformation:ResourceTypes cloudformation:RoleArn cloudformation:StackPolicyUrl cloudformation:TemplateUrl	Write
UpdateStackInstances	Grants permission to update the parameter values for stack instances for the specified accounts, within the specified regions	stackset*	aws:ResourceTag/${TagKey} cloudformation:TargetRegion	Write
		stackset-target	cloudformation:TargetRegion
		type	cloudformation:TargetRegion
UpdateStackSet	Grants permission to update a stackset as specified in the template	stackset*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys cloudformation:RoleArn cloudformation:TargetRegion cloudformation:TemplateUrl	Write
		stackset-target	aws:RequestTag/${TagKey} aws:TagKeys cloudformation:RoleArn cloudformation:TargetRegion cloudformation:TemplateUrl
		type	aws:RequestTag/${TagKey} aws:TagKeys cloudformation:RoleArn cloudformation:TargetRegion cloudformation:TemplateUrl
UpdateTerminationProtection	Grants permission to update termination protection for the specified stack	stack*	aws:ResourceTag/${TagKey}	Write
ValidateTemplate	Grants permission to validate a specified template		cloudformation:TemplateUrl	Read

Permission-only actions for Amazon CloudFormation

The following actions are defined by Amazon CloudFormation but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateUploadBucket	Grants permission to upload templates to Amazon S3 buckets. Used only by the Amazon CloudFormation console and is not documented in the API reference			Write

Resource types defined by Amazon CloudFormation

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
changeset	arn:${Partition}:cloudformation:${Region}:${Account}:changeSet/${ChangeSetName}/${Id}	aws:ResourceTag/${TagKey}
generatedtemplate	arn:${Partition}:cloudformation:${Region}:${Account}:generatedTemplate/${Id}
resourcescan	arn:${Partition}:cloudformation:${Region}:${Account}:resourceScan/${Id}
stack	arn:${Partition}:cloudformation:${Region}:${Account}:stack/${StackName}/${Id}	aws:ResourceTag/${TagKey}
stackset	arn:${Partition}:cloudformation:${Region}:${Account}:stackset/${StackSetName}:${Id}	aws:ResourceTag/${TagKey}
stackset-target	arn:${Partition}:cloudformation:${Region}:${Account}:stackset-target/${StackSetTarget}
type	arn:${Partition}:cloudformation:${Region}:${Account}:type/resource/${Type}
typeHook	arn:${Partition}:cloudformation:${Region}:${Account}:type/hook/${Type}

Condition keys for Amazon CloudFormation

Amazon CloudFormation defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
cloudformation:ChangeSetName	Filters access by an Amazon CloudFormation change set name. Use to control which change sets IAM users can execute or delete	String
cloudformation:CreateAction	Filters access by the name of a resource-mutating API action. Use to control which APIs IAM users can use to add or remove tags on a stack or stack set	String
cloudformation:ImportResourceTypes	Filters access by the template resource types, such as Amazon::EC2::Instance. Use to control which resource types IAM users can work with when they want to import a resource into a stack	String
cloudformation:ResourceTypes	Filters access by the template resource types, such as Amazon::EC2::Instance. Use to control which resource types IAM users can work with when they create or update a stack	ArrayOfString
cloudformation:RoleArn	Filters access by the ARN of an IAM service role. Use to control which service role IAM users can use to work with stacks or change sets	ARN
cloudformation:StackPolicyUrl	Filters access by an Amazon S3 stack policy URL. Use to control which stack policies IAM users can associate with a stack during a create or update stack action	String
cloudformation:TargetRegion	Filters access by stack set target region. Use to control which regions IAM users can use when they create or update stack sets	ArrayOfString
cloudformation:TemplateUrl	Filters access by an Amazon S3 template URL. Use to control which templates IAM users can use when they create or update stacks	String
cloudformation:TypeArn	Filters access by the ARN of a CloudFormation extension	ARN

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Certificate Manager (acm)

Amazon CloudTrail (cloudtrail)