Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon CloudFront

Amazon CloudFront (service prefix: cloudfront) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon CloudFront
Actions defined by Amazon CloudFront
Permission-only actions for Amazon CloudFront
Resource types defined by Amazon CloudFront
Condition keys for Amazon CloudFront

API operations defined by Amazon CloudFront

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateAlias	cloudfront:AssociateAlias			Write
AssociateAlias	cloudfront:UpdateDistribution			Write
AssociateDistributionTenantWebACL	cloudfront:AssociateDistributionTenantWebACL			Write
AssociateDistributionWebACL	cloudfront:AssociateDistributionWebACL			Write
AssociateDistributionWebACL	cloudfront:GetVpcOrigin			Read
CopyDistribution	cloudfront:CopyDistribution			Write
	cloudfront:CreateDistribution			Write
	cloudfront:GetDistribution			Read
	cloudfront:GetVpcOrigin			Read
CreateAnycastIpList	cloudfront:CreateAnycastIpList			Write
CreateAnycastIpList	cloudfront:TagResource			Tagging, Write
CreateCachePolicy	cloudfront:CreateCachePolicy			Write
CreateCloudFrontOriginAccessIdentity	cloudfront:CreateCloudFrontOriginAccessIdentity			Write
CreateConnectionFunction	cloudfront:CreateConnectionFunction			Write
CreateConnectionFunction	cloudfront:TagResource			Tagging, Write
CreateConnectionGroup	cloudfront:CreateConnectionGroup			Write
CreateConnectionGroup	cloudfront:TagResource			Tagging, Write
CreateContinuousDeploymentPolicy	cloudfront:CreateContinuousDeploymentPolicy			Write
CreateDistribution	cloudfront:CreateConnectionGroup			Write
	cloudfront:CreateDistribution			Write
	cloudfront:GetVpcOrigin			Read
CreateDistributionTenant	cloudfront:CreateDistributionTenant			Write
	cloudfront:GetVpcOrigin			Read
	cloudfront:TagResource			Tagging, Write
CreateDistributionWithTags	cloudfront:CreateConnectionGroup			Write
	cloudfront:CreateDistribution			Write
	cloudfront:GetVpcOrigin			Read
	cloudfront:TagResource			Tagging, Write
CreateFieldLevelEncryptionConfig	cloudfront:CreateFieldLevelEncryptionConfig			Write
CreateFieldLevelEncryptionProfile	cloudfront:CreateFieldLevelEncryptionProfile			Write
CreateFunction	cloudfront:CreateFunction			Write
CreateFunction	cloudfront:TagResource			Tagging, Write
CreateInvalidation	cloudfront:CreateInvalidation			Write
CreateInvalidationForDistributionTenant	cloudfront:CreateInvalidationForDistributionTenant			Write
CreateKeyGroup	cloudfront:CreateKeyGroup			Write
CreateKeyValueStore	cloudfront:CreateKeyValueStore			Write
CreateKeyValueStore	cloudfront:TagResource			Tagging, Write
CreateMonitoringSubscription	cloudfront:CreateMonitoringSubscription			Write
CreateOriginAccessControl	cloudfront:CreateOriginAccessControl			Write
CreateOriginRequestPolicy	cloudfront:CreateOriginRequestPolicy			Write
CreatePublicKey	cloudfront:CreatePublicKey			Write
CreateRealtimeLogConfig	cloudfront:CreateRealtimeLogConfig			Write
CreateRealtimeLogConfig	iam:PassRole	iam:PassedToService	cloudfront.amazonaws.com	Write
CreateResponseHeadersPolicy	cloudfront:CreateResponseHeadersPolicy			Write
CreateTrustStore	cloudfront:CreateTrustStore			Write
CreateTrustStore	cloudfront:TagResource			Tagging, Write
CreateVpcOrigin	cloudfront:CreateVpcOrigin			Write
CreateVpcOrigin	cloudfront:TagResource			Tagging, Write
DeleteAnycastIpList	cloudfront:DeleteAnycastIpList			Write
DeleteCachePolicy	cloudfront:DeleteCachePolicy			Write
DeleteCloudFrontOriginAccessIdentity	cloudfront:DeleteCloudFrontOriginAccessIdentity			Write
DeleteConnectionFunction	cloudfront:DeleteConnectionFunction			Write
DeleteConnectionGroup	cloudfront:DeleteConnectionGroup			Write
DeleteContinuousDeploymentPolicy	cloudfront:DeleteContinuousDeploymentPolicy			Write
DeleteDistribution	cloudfront:DeleteDistribution			Write
DeleteDistributionTenant	cloudfront:DeleteDistributionTenant			Write
DeleteFieldLevelEncryptionConfig	cloudfront:DeleteFieldLevelEncryptionConfig			Write
DeleteFieldLevelEncryptionProfile	cloudfront:DeleteFieldLevelEncryptionProfile			Write
DeleteFunction	cloudfront:DeleteFunction			Write
DeleteKeyGroup	cloudfront:DeleteKeyGroup			Write
DeleteKeyValueStore	cloudfront:DeleteKeyValueStore			Write
DeleteMonitoringSubscription	cloudfront:DeleteMonitoringSubscription			Write
DeleteOriginAccessControl	cloudfront:DeleteOriginAccessControl			Write
DeleteOriginRequestPolicy	cloudfront:DeleteOriginRequestPolicy			Write
DeletePublicKey	cloudfront:DeletePublicKey			Write
DeleteRealtimeLogConfig	cloudfront:DeleteRealtimeLogConfig			Write
DeleteResourcePolicy	cloudfront:DeleteResourcePolicy			Write
DeleteResponseHeadersPolicy	cloudfront:DeleteResponseHeadersPolicy			Write
DeleteStreamingDistribution	cloudfront:DeleteStreamingDistribution			Write
DeleteTrustStore	cloudfront:DeleteTrustStore			Write
DeleteVpcOrigin	cloudfront:DeleteVpcOrigin			Write
DescribeConnectionFunction	cloudfront:DescribeConnectionFunction			Read
DescribeFunction	cloudfront:DescribeFunction			Read
DescribeKeyValueStore	cloudfront:DescribeKeyValueStore			Read
DisassociateDistributionTenantWebACL	cloudfront:DisassociateDistributionTenantWebACL			Write
DisassociateDistributionWebACL	cloudfront:DisassociateDistributionWebACL			Write
GetAnycastIpList	cloudfront:GetAnycastIpList			Read
GetCachePolicy	cloudfront:GetCachePolicy			Read
GetCachePolicyConfig	cloudfront:GetCachePolicyConfig			Read
GetCloudFrontOriginAccessIdentity	cloudfront:GetCloudFrontOriginAccessIdentity			Read
GetCloudFrontOriginAccessIdentityConfig	cloudfront:GetCloudFrontOriginAccessIdentityConfig			Read
GetConnectionFunction	cloudfront:GetConnectionFunction			Read
GetConnectionGroup	cloudfront:GetConnectionGroup			Read
GetConnectionGroupByRoutingEndpoint	cloudfront:GetConnectionGroupByRoutingEndpoint			Read
GetContinuousDeploymentPolicy	cloudfront:GetContinuousDeploymentPolicy			Read
GetContinuousDeploymentPolicyConfig	cloudfront:GetContinuousDeploymentPolicyConfig			Read
GetDistribution	cloudfront:GetDistribution			Read
GetDistributionConfig	cloudfront:GetDistributionConfig			Read
GetDistributionTenant	cloudfront:GetDistributionTenant			Read
GetDistributionTenantByDomain	cloudfront:GetDistributionTenantByDomain			Read
GetFieldLevelEncryption	cloudfront:GetFieldLevelEncryption			Read
GetFieldLevelEncryptionConfig	cloudfront:GetFieldLevelEncryptionConfig			Read
GetFieldLevelEncryptionProfile	cloudfront:GetFieldLevelEncryptionProfile			Read
GetFieldLevelEncryptionProfileConfig	cloudfront:GetFieldLevelEncryptionProfileConfig			Read
GetFunction	cloudfront:GetFunction			Read
GetInvalidation	cloudfront:GetInvalidation			Read
GetInvalidationForDistributionTenant	cloudfront:GetInvalidationForDistributionTenant			Read
GetKeyGroup	cloudfront:GetKeyGroup			Read
GetKeyGroupConfig	cloudfront:GetKeyGroupConfig			Read
GetManagedCertificateDetails	cloudfront:GetManagedCertificateDetails			Read
GetMonitoringSubscription	cloudfront:GetMonitoringSubscription			Read
GetOriginAccessControl	cloudfront:GetOriginAccessControl			Read
GetOriginAccessControlConfig	cloudfront:GetOriginAccessControlConfig			Read
GetOriginRequestPolicy	cloudfront:GetOriginRequestPolicy			Read
GetOriginRequestPolicyConfig	cloudfront:GetOriginRequestPolicyConfig			Read
GetPublicKey	cloudfront:GetPublicKey			Read
GetPublicKeyConfig	cloudfront:GetPublicKeyConfig			Read
GetRealtimeLogConfig	cloudfront:GetRealtimeLogConfig			Read
GetResourcePolicy	cloudfront:GetResourcePolicy			Read
GetResponseHeadersPolicy	cloudfront:GetResponseHeadersPolicy			Read
GetResponseHeadersPolicyConfig	cloudfront:GetResponseHeadersPolicyConfig			Read
GetStreamingDistribution	cloudfront:GetStreamingDistribution			Read
GetStreamingDistributionConfig	cloudfront:GetStreamingDistributionConfig			Read
GetTrustStore	cloudfront:GetTrustStore			Read
GetVpcOrigin	cloudfront:GetVpcOrigin			Read
ListAnycastIpLists	cloudfront:ListAnycastIpLists			List
ListCachePolicies	cloudfront:ListCachePolicies			List
ListCloudFrontOriginAccessIdentities	cloudfront:ListCloudFrontOriginAccessIdentities			List
ListConflictingAliases	cloudfront:GetDistribution			Read
ListConflictingAliases	cloudfront:ListConflictingAliases			List
ListConnectionFunctions	cloudfront:ListConnectionFunctions			List
ListConnectionGroups	cloudfront:ListConnectionGroups			List
ListContinuousDeploymentPolicies	cloudfront:ListContinuousDeploymentPolicies			List
ListDistributionTenants	cloudfront:ListDistributionTenants			List
ListDistributionTenantsByCustomization	cloudfront:ListDistributionTenantsByCustomization			List
ListDistributions	cloudfront:ListDistributions			List
ListDistributionsByAnycastIpListId	cloudfront:ListDistributionsByAnycastIpListId			List
ListDistributionsByCachePolicyId	cloudfront:ListDistributionsByCachePolicyId			List
ListDistributionsByConnectionFunction	cloudfront:ListDistributionsByConnectionFunction			List
ListDistributionsByConnectionMode	cloudfront:ListDistributionsByConnectionMode			List
ListDistributionsByKeyGroup	cloudfront:ListDistributionsByKeyGroup			List
ListDistributionsByOriginRequestPolicyId	cloudfront:ListDistributionsByOriginRequestPolicyId			List
ListDistributionsByRealtimeLogConfig	cloudfront:ListDistributionsByRealtimeLogConfig			List
ListDistributionsByResponseHeadersPolicyId	cloudfront:ListDistributionsByResponseHeadersPolicyId			List
ListDistributionsByTrustStore	cloudfront:ListDistributionsByTrustStore			List
ListDistributionsByVpcOriginId	cloudfront:ListDistributionsByVpcOriginId			List
ListDistributionsByWebACLId	cloudfront:ListDistributionsByWebACLId			List
ListDomainConflicts	cloudfront:GetDistribution			Read
	cloudfront:GetDistributionTenant			Read
	cloudfront:ListDomainConflicts			List
ListFieldLevelEncryptionConfigs	cloudfront:ListFieldLevelEncryptionConfigs			List
ListFieldLevelEncryptionProfiles	cloudfront:ListFieldLevelEncryptionProfiles			List
ListFunctions	cloudfront:ListFunctions			List
ListInvalidations	cloudfront:ListInvalidations			List
ListInvalidationsForDistributionTenant	cloudfront:ListInvalidationsForDistributionTenant			List
ListKeyGroups	cloudfront:ListKeyGroups			List
ListKeyValueStores	cloudfront:ListKeyValueStores			List
ListOriginAccessControls	cloudfront:ListOriginAccessControls			List
ListOriginRequestPolicies	cloudfront:ListOriginRequestPolicies			List
ListPublicKeys	cloudfront:ListPublicKeys			List
ListRealtimeLogConfigs	cloudfront:ListRealtimeLogConfigs			List
ListResponseHeadersPolicies	cloudfront:ListResponseHeadersPolicies			List
ListStreamingDistributions	cloudfront:ListStreamingDistributions			List
ListTagsForResource	cloudfront:ListTagsForResource			Read
ListTrustStores	cloudfront:ListTrustStores			List
ListVpcOrigins	cloudfront:ListVpcOrigins			List
PublishConnectionFunction	cloudfront:PublishConnectionFunction			Write
PublishFunction	cloudfront:PublishFunction			Write
PutResourcePolicy	cloudfront:PutResourcePolicy			Write
TagResource	cloudfront:TagResource			Tagging, Write
TestConnectionFunction	cloudfront:TestConnectionFunction			Write
TestFunction	cloudfront:TestFunction			Write
UntagResource	cloudfront:UntagResource			Tagging, Write
UpdateAnycastIpList	cloudfront:UpdateAnycastIpList			Write
UpdateCachePolicy	cloudfront:UpdateCachePolicy			Write
UpdateCloudFrontOriginAccessIdentity	cloudfront:UpdateCloudFrontOriginAccessIdentity			Write
UpdateConnectionFunction	cloudfront:UpdateConnectionFunction			Write
UpdateConnectionGroup	cloudfront:UpdateConnectionGroup			Write
UpdateContinuousDeploymentPolicy	cloudfront:UpdateContinuousDeploymentPolicy			Write
UpdateDistribution	cloudfront:GetVpcOrigin			Read
UpdateDistribution	cloudfront:UpdateDistribution			Write
UpdateDistributionTenant	cloudfront:GetVpcOrigin			Read
UpdateDistributionTenant	cloudfront:UpdateDistributionTenant			Write
UpdateDistributionWithStagingConfig	cloudfront:GetDistribution			Read
	cloudfront:GetVpcOrigin			Read
	cloudfront:UpdateDistribution			Write
UpdateDomainAssociation	cloudfront:UpdateDistribution			Write
	cloudfront:UpdateDistributionTenant			Write
	cloudfront:UpdateDomainAssociation			Write
UpdateFieldLevelEncryptionConfig	cloudfront:UpdateFieldLevelEncryptionConfig			Write
UpdateFieldLevelEncryptionProfile	cloudfront:UpdateFieldLevelEncryptionProfile			Write
UpdateFunction	cloudfront:UpdateFunction			Write
UpdateKeyGroup	cloudfront:UpdateKeyGroup			Write
UpdateKeyValueStore	cloudfront:UpdateKeyValueStore			Write
UpdateOriginAccessControl	cloudfront:UpdateOriginAccessControl			Write
UpdateOriginRequestPolicy	cloudfront:UpdateOriginRequestPolicy			Write
UpdatePublicKey	cloudfront:UpdatePublicKey			Write
UpdateRealtimeLogConfig	cloudfront:UpdateRealtimeLogConfig			Write
UpdateRealtimeLogConfig	iam:PassRole	iam:PassedToService	cloudfront.amazonaws.com	Write
UpdateResponseHeadersPolicy	cloudfront:UpdateResponseHeadersPolicy			Write
UpdateTrustStore	cloudfront:UpdateTrustStore			Write
UpdateVpcOrigin	cloudfront:UpdateVpcOrigin			Write
VerifyDnsConfiguration	cloudfront:VerifyDnsConfiguration			Read

Actions defined by Amazon CloudFront

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateAlias	Grants permission to associate an alias to a CloudFront distribution	distribution*	aws:ResourceTag/${TagKey}	Write
AssociateDistributionTenantWebACL	Grants permission to associate a distribution tenant with an Amazon WAF web ACL	distribution-tenant*	aws:ResourceTag/${TagKey}	Write
AssociateDistributionWebACL	Grants permission to associate a distribution with an Amazon WAF web ACL	distribution*	aws:ResourceTag/${TagKey}	Write
CopyDistribution	Grants permission to copy an existing distribution and create a new web distribution	distribution*	aws:ResourceTag/${TagKey}	Write
CreateAnycastIpList	Grants permission to create an Anycast static IP list		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateCachePolicy	Grants permission to add a new cache policy to CloudFront			Write
CreateCloudFrontOriginAccessIdentity	Grants permission to create a new CloudFront origin access identity			Write
CreateConnectionFunction	Grants permission to create a connection function		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateConnectionGroup	Grants permission to create a connection group		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateContinuousDeploymentPolicy	Grants permission to add a new continuous-deployment policy to CloudFront			Write
CreateDistribution	Grants permission to create a new web distribution		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDistributionTenant	Grants permission to create a distribution tenant		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateFieldLevelEncryptionConfig	Grants permission to create a new field-level encryption configuration			Write
CreateFieldLevelEncryptionProfile	Grants permission to create a field-level encryption profile			Write
CreateFunction	Grants permission to create a CloudFront function		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateInvalidation	Grants permission to create a new invalidation batch request	distribution*	aws:ResourceTag/${TagKey}	Write
CreateInvalidationForDistributionTenant	Grants permission to create an invalidation for a distribution tenant	distribution-tenant*	aws:ResourceTag/${TagKey}	Write
CreateKeyGroup	Grants permission to add a new key group to CloudFront			Write
CreateKeyValueStore	Grants permission to create a CloudFront KeyValueStore		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateMonitoringSubscription	Grants permission to enable additional CloudWatch metrics for the specified CloudFront distribution. The additional metrics incur an additional cost			Write
CreateOriginAccessControl	Grants permission to create a new origin access control			Write
CreateOriginRequestPolicy	Grants permission to add a new origin request policy to CloudFront			Write
CreatePublicKey	Grants permission to add a new public key to CloudFront			Write
CreateRealtimeLogConfig	Grants permission to create a real-time log configuration			Write
CreateResponseHeadersPolicy	Grants permission to add a new response headers policy to CloudFront			Write
CreateStreamingDistribution	Grants permission to create a new RTMP distribution			Write
CreateStreamingDistributionWithTags	Grants permission to create a new RTMP distribution with tags		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateTrustStore	Grants permission to create a trust store		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateVpcOrigin	Grants permission to create a VPC origin		aws:RequestTag/${TagKey} aws:TagKeys	Write
DeleteAnycastIpList	Grants permission to delete an Anycast static IP list	anycast-ip-list*	aws:ResourceTag/${TagKey}	Write
DeleteCachePolicy	Grants permission to delete a cache policy	cache-policy*		Write
DeleteCloudFrontOriginAccessIdentity	Grants permission to delete a CloudFront origin access identity	origin-access-identity*		Write
DeleteConnectionFunction	Grants permission to delete a connection function	connection-function*	aws:ResourceTag/${TagKey}	Write
DeleteConnectionGroup	Grants permission to delete a connection group	connection-group*	aws:ResourceTag/${TagKey}	Write
DeleteContinuousDeploymentPolicy	Grants permission to delete a continuous-deployment policy	continuous-deployment-policy*		Write
DeleteDistribution	Grants permission to delete a web distribution	distribution*	aws:ResourceTag/${TagKey}	Write
DeleteDistributionTenant	Grants permission to delete a distribution tenant	distribution-tenant*	aws:ResourceTag/${TagKey}	Write
DeleteFieldLevelEncryptionConfig	Grants permission to delete a field-level encryption configuration	field-level-encryption-config*		Write
DeleteFieldLevelEncryptionProfile	Grants permission to delete a field-level encryption profile	field-level-encryption-profile*		Write
DeleteFunction	Grants permission to delete a CloudFront function	function*	aws:ResourceTag/${TagKey}	Write
DeleteKeyGroup	Grants permission to delete a key group			Write
DeleteKeyValueStore	Grants permission to delete a CloudFront KeyValueStore	key-value-store*	aws:ResourceTag/${TagKey}	Write
DeleteMonitoringSubscription	Grants permission to disable additional CloudWatch metrics for the specified CloudFront distribution			Write
DeleteOriginAccessControl	Grants permission to delete an origin access control	origin-access-control*		Write
DeleteOriginRequestPolicy	Grants permission to delete an origin request policy	origin-request-policy*		Write
DeletePublicKey	Grants permission to delete a public key from CloudFront			Write
DeleteRealtimeLogConfig	Grants permission to delete a real-time log configuration	realtime-log-config*		Write
DeleteResourcePolicy	Grants permission to delete a resource's policy document	vpcorigin	aws:ResourceTag/${TagKey}	Write
DeleteResponseHeadersPolicy	Grants permission to delete a response headers policy	response-headers-policy*		Write
DeleteStreamingDistribution	Grants permission to delete an RTMP distribution	streaming-distribution*	aws:ResourceTag/${TagKey}	Write
DeleteTrustStore	Grants permission to delete a trust store	trust-store*	aws:ResourceTag/${TagKey}	Write
DeleteVpcOrigin	Grants permission to delete a VPC origin	vpcorigin*	aws:ResourceTag/${TagKey}	Write
DescribeConnectionFunction	Grants permission to get a connection function summary	connection-function*	aws:ResourceTag/${TagKey}	Read
DescribeFunction	Grants permission to get a CloudFront function summary	function*	aws:ResourceTag/${TagKey}	Read
DescribeKeyValueStore	Grants permission to get a CloudFront KeyValueStore summary	key-value-store*	aws:ResourceTag/${TagKey}	Read
DisassociateDistributionTenantWebACL	Grants permission to disassociate a distribution tenant from an Amazon WAF web ACL	distribution-tenant*	aws:ResourceTag/${TagKey}	Write
DisassociateDistributionWebACL	Grants permission to disassociate a distribution from an Amazon WAF web ACL	distribution*	aws:ResourceTag/${TagKey}	Write
GetAnycastIpList	Grants permission to get an Anycast static IP list	anycast-ip-list*	aws:ResourceTag/${TagKey}	Read
GetCachePolicy	Grants permission to get the cache policy	cache-policy*		Read
GetCachePolicyConfig	Grants permission to get the cache policy configuration	cache-policy*		Read
GetCloudFrontOriginAccessIdentity	Grants permission to get the information about a CloudFront origin access identity	origin-access-identity*		Read
GetCloudFrontOriginAccessIdentityConfig	Grants permission to get the configuration information about a Cloudfront origin access identity	origin-access-identity*		Read
GetConnectionFunction	Grants permission to get a connection function's code	connection-function*	aws:ResourceTag/${TagKey}	Read
GetConnectionGroup	Grants permission to get information about a connection group	connection-group*	aws:ResourceTag/${TagKey}	Read
GetConnectionGroupByRoutingEndpoint	Grants permission to get information about a connection group by the specified routing endpoint	connection-group*	aws:ResourceTag/${TagKey}	Read
GetContinuousDeploymentPolicy	Grants permission to get the continuous-deployment policy	continuous-deployment-policy*		Read
GetContinuousDeploymentPolicyConfig	Grants permission to get the continuous-deployment policy configuration	continuous-deployment-policy*		Read
GetDistribution	Grants permission to get the information about a web distribution	distribution*	aws:ResourceTag/${TagKey}	Read
GetDistributionConfig	Grants permission to get the configuration information about a distribution	distribution*	aws:ResourceTag/${TagKey}	Read
GetDistributionTenant	Grants permission to get information about a distribution tenant	distribution-tenant*	aws:ResourceTag/${TagKey}	Read
GetDistributionTenantByDomain	Grants permission to get information about a distribution tenant by the associated domain	distribution-tenant*	aws:ResourceTag/${TagKey}	Read
GetFieldLevelEncryption	Grants permission to get the field-level encryption configuration information	field-level-encryption-config*		Read
GetFieldLevelEncryptionConfig	Grants permission to get the field-level encryption configuration information	field-level-encryption-config*		Read
GetFieldLevelEncryptionProfile	Grants permission to get the field-level encryption configuration information	field-level-encryption-profile*		Read
GetFieldLevelEncryptionProfileConfig	Grants permission to get the field-level encryption profile configuration information	field-level-encryption-profile*		Read
GetFunction	Grants permission to get a CloudFront function's code	function*	aws:ResourceTag/${TagKey}	Read
GetInvalidation	Grants permission to get the information about an invalidation	distribution*	aws:ResourceTag/${TagKey}	Read
GetInvalidationForDistributionTenant	Grants permission to get information about an invalidation for a distribution tenant	distribution-tenant*	aws:ResourceTag/${TagKey}	Read
GetKeyGroup	Grants permission to get a key group			Read
GetKeyGroupConfig	Grants permission to get a key group configuration			Read
GetManagedCertificateDetails	Grants permission to get details about a CloudFront managed certificate	distribution-tenant*	aws:ResourceTag/${TagKey}	Read
GetMonitoringSubscription	Grants permission to get information about whether additional CloudWatch metrics are enabled for the specified CloudFront distribution			Read
GetOriginAccessControl	Grants permission to get the origin access control	origin-access-control*		Read
GetOriginAccessControlConfig	Grants permission to get the origin access control configuration	origin-access-control*		Read
GetOriginRequestPolicy	Grants permission to get the origin request policy	origin-request-policy*		Read
GetOriginRequestPolicyConfig	Grants permission to get the origin request policy configuration	origin-request-policy*		Read
GetPublicKey	Grants permission to get the public key information			Read
GetPublicKeyConfig	Grants permission to get the public key configuration information			Read
GetRealtimeLogConfig	Grants permission to get a real-time log configuration	realtime-log-config*		Read
GetResourcePolicy	Grants permission to get the information about a resource's policy document	vpcorigin	aws:ResourceTag/${TagKey}	Read
GetResponseHeadersPolicy	Grants permission to get the response headers policy	response-headers-policy*		Read
GetResponseHeadersPolicyConfig	Grants permission to get the response headers policy configuration	response-headers-policy*		Read
GetStreamingDistribution	Grants permission to get the information about an RTMP distribution	streaming-distribution*	aws:ResourceTag/${TagKey}	Read
GetStreamingDistributionConfig	Grants permission to get the configuration information about a streaming distribution	streaming-distribution*	aws:ResourceTag/${TagKey}	Read
GetTrustStore	Grants permission to get information about a trust store	trust-store*	aws:ResourceTag/${TagKey}	Read
GetVpcOrigin	Grants permission to get the information about a VPC origin	vpcorigin*	aws:ResourceTag/${TagKey}	Read
ListAnycastIpLists	Grants permission to list your Anycast static IP lists			List
ListCachePolicies	Grants permission to list all cache policies that have been created in CloudFront for this account			List
ListCloudFrontOriginAccessIdentities	Grants permission to list your CloudFront origin access identities			List
ListConflictingAliases	Grants permission to list all aliases that conflict with the given alias in CloudFront	distribution*	aws:ResourceTag/${TagKey}	List
ListConnectionFunctions	Grants permission to list the connection functions in your Amazon Web Services account			List
ListConnectionGroups	Grants permission to list the connection groups in your Amazon Web Services account			List
ListContinuousDeploymentPolicies	Grants permission to list all continuous-deployment policies in the account			List
ListDistributionTenants	Grants permission to list the distribution tenants in your Amazon Web Services account			List
ListDistributionTenantsByCustomization	Grants permission to list the distribution tenants by the customization that you specify			List
ListDistributions	Grants permission to list the distributions associated with your Amazon Web Services account			List
ListDistributionsByAnycastIpListId	Grants permission to list the distributions in your account that are associated with the specified AnycastIpListId			List
ListDistributionsByCachePolicyId	Grants permission to list distribution IDs for distributions that have a cache behavior that's associated with the specified cache policy			List
ListDistributionsByConnectionFunction	Grants permission to list summaries for distributions associated with the specified connection function	connection-function*	aws:ResourceTag/${TagKey}	List
ListDistributionsByConnectionMode	Grants permission to list the distributions by the specified connection mode			List
ListDistributionsByKeyGroup	Grants permission to list distribution IDs for distributions that have a cache behavior that's associated with the specified key group			List
ListDistributionsByOriginRequestPolicyId	Grants permission to list distribution IDs for distributions that have a cache behavior that's associated with the specified origin request policy			List
ListDistributionsByRealtimeLogConfig	Grants permission to get a list of distributions that have a cache behavior that's associated with the specified real-time log configuration			List
ListDistributionsByResponseHeadersPolicyId	Grants permission to list distribution IDs for distributions that have a cache behavior that's associated with the specified response headers policy			List
ListDistributionsByTrustStore	Grants permission to list summaries for distributions associated with the specified trust store	trust-store*	aws:ResourceTag/${TagKey}	List
ListDistributionsByVpcOriginId	Grants permission to list IDs for distributions associated with the specified VPC origin			List
ListDistributionsByWebACLId	Grants permission to list the distributions associated with your Amazon Web Services account with given Amazon WAF web ACL			List
ListDomainConflicts	Grants permission to list domain conflicts for a specified domain	distribution	aws:ResourceTag/${TagKey}	List
ListDomainConflicts		distribution-tenant	aws:ResourceTag/${TagKey}	List
ListFieldLevelEncryptionConfigs	Grants permission to list all field-level encryption configurations that have been created in CloudFront for this account			List
ListFieldLevelEncryptionProfiles	Grants permission to list all field-level encryption profiles that have been created in CloudFront for this account			List
ListFunctions	Grants permission to get a list of CloudFront functions			List
ListInvalidations	Grants permission to list your invalidation batches	distribution*	aws:ResourceTag/${TagKey}	List
ListInvalidationsForDistributionTenant	Grants permission to list the invalidations for a distribution tenant	distribution-tenant*	aws:ResourceTag/${TagKey}	List
ListKeyGroups	Grants permission to list all key groups that have been created in CloudFront for this account			List
ListKeyValueStores	Grants permission to get a list of CloudFront KeyValueStores			List
ListOriginAccessControls	Grants permission to list all origin access controls in the account			List
ListOriginRequestPolicies	Grants permission to list all origin request policies that have been created in CloudFront for this account			List
ListPublicKeys	Grants permission to list all public keys that have been added to CloudFront for this account			List
ListRealtimeLogConfigs	Grants permission to get a list of real-time log configurations			List
ListResponseHeadersPolicies	Grants permission to list all response headers policies that have been created in CloudFront for this account			List
ListStreamingDistributions	Grants permission to list your RTMP distributions			List
ListTagsForResource	Grants permission to list tags for a CloudFront resource	anycast-ip-list	aws:ResourceTag/${TagKey}	Read
		connection-function	aws:ResourceTag/${TagKey}
		connection-group	aws:ResourceTag/${TagKey}
		distribution	aws:ResourceTag/${TagKey}
		distribution-tenant	aws:ResourceTag/${TagKey}
		function	aws:ResourceTag/${TagKey}
		key-value-store	aws:ResourceTag/${TagKey}
		trust-store	aws:ResourceTag/${TagKey}
		vpcorigin	aws:ResourceTag/${TagKey}
ListTrustStores	Grants permission to list the trust stores in your Amazon Web Services account			List
ListVpcOrigins	Grants permission to list VPC origins			List
PublishConnectionFunction	Grants permission to publish a connection function	connection-function*	aws:ResourceTag/${TagKey}	Write
PublishFunction	Grants permission to publish a CloudFront function	function*	aws:ResourceTag/${TagKey}	Write
PutResourcePolicy	Grants permission to update or create a resource's policy document	vpcorigin	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add tags to a CloudFront resource	anycast-ip-list	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		connection-function	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		connection-group	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		distribution	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		distribution-tenant	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		function	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		key-value-store	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		streaming-distribution	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		trust-store	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		vpcorigin	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
TestConnectionFunction	Grants permission to test a connection function	connection-function*	aws:ResourceTag/${TagKey}	Write
TestFunction	Grants permission to test a CloudFront function	function*	aws:ResourceTag/${TagKey}	Write
UntagResource	Grants permission to remove tags from a CloudFront resource	anycast-ip-list	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		connection-function	aws:ResourceTag/${TagKey} aws:TagKeys
		connection-group	aws:ResourceTag/${TagKey} aws:TagKeys
		distribution	aws:ResourceTag/${TagKey} aws:TagKeys
		distribution-tenant	aws:ResourceTag/${TagKey} aws:TagKeys
		function	aws:ResourceTag/${TagKey} aws:TagKeys
		key-value-store	aws:ResourceTag/${TagKey} aws:TagKeys
		streaming-distribution	aws:ResourceTag/${TagKey} aws:TagKeys
		trust-store	aws:ResourceTag/${TagKey} aws:TagKeys
		vpcorigin	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAnycastIpList	Grants permission to update an Anycast static IP list	anycast-ip-list*	aws:ResourceTag/${TagKey}	Write
UpdateCachePolicy	Grants permission to update a cache policy	cache-policy*		Write
UpdateCloudFrontOriginAccessIdentity	Grants permission to set the configuration for a CloudFront origin access identity	origin-access-identity*		Write
UpdateConnectionFunction	Grants permission to update a connection function	connection-function*	aws:ResourceTag/${TagKey}	Write
UpdateConnectionGroup	Grants permission to update a connection group	connection-group*	aws:ResourceTag/${TagKey}	Write
UpdateContinuousDeploymentPolicy	Grants permission to update a continuous-deployment policy	continuous-deployment-policy*		Write
UpdateDistribution	Grants permission to update the configuration for a web distribution	distribution*	aws:ResourceTag/${TagKey}	Write
UpdateDistributionTenant	Grants permission to update a distribution tenant	distribution-tenant*	aws:ResourceTag/${TagKey}	Write
UpdateDistributionWithStagingConfig	Grants permission to copy the configuration from a staging web distribution to its corresponding primary web distribution	distribution*	aws:ResourceTag/${TagKey}	Write
UpdateDomainAssociation	Grants permission to update a domain association	distribution	aws:ResourceTag/${TagKey}	Write
UpdateDomainAssociation	Grants permission to update a domain association	distribution-tenant	aws:ResourceTag/${TagKey}	Write
UpdateFieldLevelEncryptionConfig	Grants permission to update a field-level encryption configuration			Write
UpdateFieldLevelEncryptionProfile	Grants permission to update a field-level encryption profile	field-level-encryption-profile*		Write
UpdateFunction	Grants permission to update a CloudFront function	function*	aws:ResourceTag/${TagKey}	Write
UpdateKeyGroup	Grants permission to update a key group			Write
UpdateKeyValueStore	Grants permission to update a CloudFront KeyValueStore	key-value-store*	aws:ResourceTag/${TagKey}	Write
UpdateOriginAccessControl	Grants permission to update an origin access control	origin-access-control*		Write
UpdateOriginRequestPolicy	Grants permission to update an origin request policy	origin-request-policy*		Write
UpdatePublicKey	Grants permission to update public key information			Write
UpdateRealtimeLogConfig	Grants permission to update a real-time log configuration	realtime-log-config*		Write
UpdateResponseHeadersPolicy	Grants permission to update a response headers policy	response-headers-policy*		Write
UpdateStreamingDistribution	Grants permission to update the configuration for an RTMP distribution	streaming-distribution*	aws:ResourceTag/${TagKey}	Write
UpdateTrustStore	Grants permission to update a trust store	trust-store*	aws:ResourceTag/${TagKey}	Write
UpdateVpcOrigin	Grants permission to update a VPC origin	vpcorigin*	aws:ResourceTag/${TagKey}	Write
VerifyDnsConfiguration	Grants permission to verify the DNS configuration for a specified domain	distribution-tenant	aws:ResourceTag/${TagKey}	Read

Permission-only actions for Amazon CloudFront

The following actions are defined by Amazon CloudFront but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AllowVendedLogDeliveryForResource	Grants permission to configure vended log delivery for a distribution	distribution	aws:ResourceTag/${TagKey}	Permissions management, Write
CreateSavingsPlan	Grants permission to create a new savings plan			Write
GetSavingsPlan	Grants permission to get a savings plan			Read
ListDistributionsByLambdaFunction	Grants permission to list the distributions associated a Lambda function			List
ListRateCards	Grants permission to list CloudFront rate cards for the account			List
ListSavingsPlans	Grants permission to list savings plans in the account			List
ListUsages	Grants permission to list CloudFront usage			List
UpdateSavingsPlan	Grants permission to update a savings plan			Write

Resource types defined by Amazon CloudFront

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
anycast-ip-list	arn:${Partition}:cloudfront::${Account}:anycast-ip-list/${Id}	aws:ResourceTag/${TagKey}
cache-policy	arn:${Partition}:cloudfront::${Account}:cache-policy/${Id}
connection-function	arn:${Partition}:cloudfront::${Account}:connection-function/${Id}	aws:ResourceTag/${TagKey}
connection-group	arn:${Partition}:cloudfront::${Account}:connection-group/${Id}	aws:ResourceTag/${TagKey}
continuous-deployment-policy	arn:${Partition}:cloudfront::${Account}:continuous-deployment-policy/${Id}
distribution	arn:${Partition}:cloudfront::${Account}:distribution/${DistributionId}	aws:ResourceTag/${TagKey}
distribution-tenant	arn:${Partition}:cloudfront::${Account}:distribution-tenant/${Id}	aws:ResourceTag/${TagKey}
field-level-encryption-config	arn:${Partition}:cloudfront::${Account}:field-level-encryption-config/${Id}
field-level-encryption-profile	arn:${Partition}:cloudfront::${Account}:field-level-encryption-profile/${Id}
function	arn:${Partition}:cloudfront::${Account}:function/${Name}	aws:ResourceTag/${TagKey}
key-value-store	arn:${Partition}:cloudfront::${Account}:key-value-store/${Name}	aws:ResourceTag/${TagKey}
origin-access-control	arn:${Partition}:cloudfront::${Account}:origin-access-control/${Id}
origin-access-identity	arn:${Partition}:cloudfront::${Account}:origin-access-identity/${Id}
origin-request-policy	arn:${Partition}:cloudfront::${Account}:origin-request-policy/${Id}
realtime-log-config	arn:${Partition}:cloudfront::${Account}:realtime-log-config/${Name}
response-headers-policy	arn:${Partition}:cloudfront::${Account}:response-headers-policy/${Id}
streaming-distribution	arn:${Partition}:cloudfront::${Account}:streaming-distribution/${DistributionId}	aws:ResourceTag/${TagKey}
trust-store	arn:${Partition}:cloudfront::${Account}:trust-store/${Id}	aws:ResourceTag/${TagKey}
vpcorigin	arn:${Partition}:cloudfront::${Account}:vpcorigin/${Id}	aws:ResourceTag/${TagKey}

Condition keys for Amazon CloudFront

Amazon CloudFront defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Athena (athena)

Amazon CloudWatch (cloudwatch)