Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Config

Amazon Config (service prefix: config) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by Amazon Config

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AssociateResourceTypes	config:AssociateResourceTypes			Write
BatchGetAggregateResourceConfig	config:BatchGetAggregateResourceConfig			Read
BatchGetResourceConfig	config:BatchGetResourceConfig			Read
DeleteAggregationAuthorization	config:DeleteAggregationAuthorization			Write
DeleteConfigRule	config:DeleteConfigRule			Write
DeleteConfigurationAggregator	config:DeleteConfigurationAggregator			Write
DeleteConfigurationRecorder	config:DeleteConfigurationRecorder			Write
DeleteConformancePack	config:DeleteConformancePack			Write
DeleteConnector	config:DeleteConnector			Write
DeleteDeliveryChannel	config:DeleteDeliveryChannel			Write
DeleteEvaluationResults	config:DeleteEvaluationResults			Write
DeleteOrganizationConfigRule	config:DeleteOrganizationConfigRule			Write
DeleteOrganizationConformancePack	config:DeleteOrganizationConformancePack			Write
DeletePendingAggregationRequest	config:DeletePendingAggregationRequest			Write
DeleteRemediationConfiguration	config:DeleteRemediationConfiguration			Write
DeleteRemediationExceptions	config:DeleteRemediationExceptions			Write
DeleteResourceConfig	config:DeleteResourceConfig			Write
DeleteRetentionConfiguration	config:DeleteRetentionConfiguration			Write
DeleteServiceLinkedConfigurationRecorder	config:DeleteServiceLinkedConfigurationRecorder			Write
DeleteStoredQuery	config:DeleteStoredQuery			Write
DeliverConfigSnapshot	config:DeliverConfigSnapshot			Read
DescribeAggregateComplianceByConfigRules	config:DescribeAggregateComplianceByConfigRules			Read
DescribeAggregateComplianceByConformancePacks	config:DescribeAggregateComplianceByConformancePacks			Read
DescribeAggregationAuthorizations	config:DescribeAggregationAuthorizations			List
DescribeComplianceByConfigRule	config:DescribeComplianceByConfigRule			Read
DescribeComplianceByResource	config:DescribeComplianceByResource			Read
DescribeConfigRuleEvaluationStatus	config:DescribeConfigRuleEvaluationStatus			Read
DescribeConfigRules	config:DescribeConfigRules			List
DescribeConfigurationAggregatorSourcesStatus	config:DescribeConfigurationAggregatorSourcesStatus			Read
DescribeConfigurationAggregators	config:DescribeConfigurationAggregators			List
DescribeConfigurationRecorderStatus	config:DescribeConfigurationRecorderStatus			Read
DescribeConfigurationRecorders	config:DescribeConfigurationRecorders			Read
DescribeConformancePackCompliance	config:DescribeConformancePackCompliance			Read
DescribeConformancePackStatus	config:DescribeConformancePackStatus			Read
DescribeConformancePacks	config:DescribeConformancePacks			List
DescribeDeliveryChannelStatus	config:DescribeDeliveryChannelStatus			Read
DescribeDeliveryChannels	config:DescribeDeliveryChannels			List
DescribeOrganizationConfigRuleStatuses	config:DescribeOrganizationConfigRuleStatuses			Read
DescribeOrganizationConfigRules	config:DescribeOrganizationConfigRules			List
DescribeOrganizationConformancePackStatuses	config:DescribeOrganizationConformancePackStatuses			Read
DescribeOrganizationConformancePacks	config:DescribeOrganizationConformancePacks			List
DescribePendingAggregationRequests	config:DescribePendingAggregationRequests			List
DescribeRemediationConfigurations	config:DescribeRemediationConfigurations			List
DescribeRemediationExceptions	config:DescribeRemediationExceptions			List
DescribeRemediationExecutionStatus	config:DescribeRemediationExecutionStatus			Read
DescribeRetentionConfigurations	config:DescribeRetentionConfigurations			List
DisassociateResourceTypes	config:DisassociateResourceTypes			Write
GetAggregateComplianceDetailsByConfigRule	config:GetAggregateComplianceDetailsByConfigRule			Read
GetAggregateConfigRuleComplianceSummary	config:GetAggregateConfigRuleComplianceSummary			Read
GetAggregateConformancePackComplianceSummary	config:GetAggregateConformancePackComplianceSummary			Read
GetAggregateDiscoveredResourceCounts	config:GetAggregateDiscoveredResourceCounts			Read
GetAggregateResourceConfig	config:GetAggregateResourceConfig			Read
GetComplianceDetailsByConfigRule	config:GetComplianceDetailsByConfigRule			Read
GetComplianceDetailsByResource	config:GetComplianceDetailsByResource			Read
GetComplianceSummaryByConfigRule	config:GetComplianceSummaryByConfigRule			Read
GetComplianceSummaryByResourceType	config:GetComplianceSummaryByResourceType			Read
GetConformancePackComplianceDetails	config:GetConformancePackComplianceDetails			Read
GetConformancePackComplianceSummary	config:GetConformancePackComplianceSummary			Read
GetConnector	config:GetConnector			Read
GetCustomRulePolicy	config:GetCustomRulePolicy			Read
GetDiscoveredResourceCounts	config:GetDiscoveredResourceCounts			Read
GetOrganizationConfigRuleDetailedStatus	config:GetOrganizationConfigRuleDetailedStatus			Read
GetOrganizationConformancePackDetailedStatus	config:GetOrganizationConformancePackDetailedStatus			Read
GetOrganizationCustomRulePolicy	config:GetOrganizationCustomRulePolicy			Read
GetResourceConfigHistory	config:GetResourceConfigHistory			Read
GetResourceEvaluationSummary	config:GetResourceEvaluationSummary			Read
GetStoredQuery	config:GetStoredQuery			Read
ListAggregateDiscoveredResources	config:ListAggregateDiscoveredResources			List
ListConfigurationRecorders	config:ListConfigurationRecorders			List
ListConformancePackComplianceScores	config:ListConformancePackComplianceScores			List
ListConnectors	config:ListConnectors			List
ListDiscoveredResources	config:ListDiscoveredResources			List
ListResourceEvaluations	config:ListResourceEvaluations			List
ListStoredQueries	config:ListStoredQueries			List
ListTagsForResource	config:ListTagsForResource			Read
PutAggregationAuthorization	config:PutAggregationAuthorization			Write
PutAggregationAuthorization	config:TagResource			Tagging, Write
PutConfigRule	config:PutConfigRule			Write
PutConfigRule	config:TagResource			Tagging, Write
PutConfigurationAggregator	config:PutConfigurationAggregator			Write
	config:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	config.amazonaws.com	Write
PutConfigurationRecorder	config:PutConfigurationRecorder			Write
	config:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	config.amazonaws.com	Write
PutConformancePack	config:PutConformancePack			Write
	config:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
PutConnector	config:PutConnector			Write
PutConnector	config:TagResource			Tagging, Write
PutDeliveryChannel	config:PutDeliveryChannel			Write
PutEvaluations	config:PutEvaluations			Write
PutExternalEvaluation	config:PutExternalEvaluation			Write
PutOrganizationConfigRule	config:PutOrganizationConfigRule			Write
PutOrganizationConformancePack	config:PutOrganizationConformancePack			Write
	config:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
PutRemediationConfigurations	config:PutRemediationConfigurations			Write
PutRemediationConfigurations	iam:PassRole	iam:PassedToService	ssm.amazonaws.com	Write
PutRemediationExceptions	config:PutRemediationExceptions			Write
PutResourceConfig	config:PutResourceConfig			Write
PutRetentionConfiguration	config:PutRetentionConfiguration			Write
PutServiceLinkedConfigurationRecorder	config:PutServiceLinkedConfigurationRecorder			Write
PutStoredQuery	config:PutStoredQuery			Write
PutStoredQuery	config:TagResource			Tagging, Write
PutThirdPartyServiceLinkedConfigurationRecorder	config:GetConnector			Read
PutThirdPartyServiceLinkedConfigurationRecorder	config:PutThirdPartyServiceLinkedConfigurationRecorder			Write
SelectAggregateResourceConfig	config:SelectAggregateResourceConfig			Read
SelectResourceConfig	config:SelectResourceConfig			Read
StartConfigRulesEvaluation	config:StartConfigRulesEvaluation			Write
StartConfigurationRecorder	config:StartConfigurationRecorder			Write
StartRemediationExecution	config:StartRemediationExecution			Write
StartResourceEvaluation	config:StartResourceEvaluation			Write
StopConfigurationRecorder	config:StopConfigurationRecorder			Write
TagResource	config:TagResource			Tagging, Write
UntagResource	config:UntagResource			Tagging, Write

Actions defined by Amazon Config

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateResourceTypes	Grants permission to add all specified resource types to the RecordingGroup of configuration recorder and includes those resource types when recording	ConfigurationRecorder*	aws:ResourceTag/${TagKey}	Write
BatchGetAggregateResourceConfig	Grants permission to return the current configuration items for resources that are present in your Amazon Config aggregator	ConfigurationAggregator*	aws:ResourceTag/${TagKey}	Read
BatchGetResourceConfig	Grants permission to return the current configuration for one or more requested resources			Read
DeleteAggregationAuthorization	Grants permission to delete the authorization granted to the specified configuration aggregator account in a specified region	AggregationAuthorization*	aws:ResourceTag/${TagKey}	Write
DeleteConfigRule	Grants permission to delete the specified Amazon Config rule and all of its evaluation results	ConfigRule*	aws:ResourceTag/${TagKey}	Write
DeleteConfigurationAggregator	Grants permission to delete the specified configuration aggregator and the aggregated data associated with the aggregator	ConfigurationAggregator*	aws:ResourceTag/${TagKey}	Write
DeleteConfigurationRecorder	Grants permission to delete the customer managed configuration recorder	ConfigurationRecorder*	aws:ResourceTag/${TagKey}	Write
DeleteConformancePack	Grants permission to delete the specified conformance pack and all the Amazon Config rules and all evaluation results within that conformance pack	ConformancePack*	aws:ResourceTag/${TagKey}	Write
DeleteConnector	Grants permission to delete a connector configuration	Connector*	aws:ResourceTag/${TagKey}	Write
DeleteDeliveryChannel	Grants permission to delete the delivery channel			Write
DeleteEvaluationResults	Grants permission to delete the evaluation results for the specified Config rule	ConfigRule*	aws:ResourceTag/${TagKey}	Write
DeleteOrganizationConfigRule	Grants permission to delete the specified organization config rule and all of its evaluation results from all member accounts in that organization	OrganizationConfigRule*	aws:ResourceTag/${TagKey}	Write
DeleteOrganizationConformancePack	Grants permission to delete the specified organization conformance pack and all of its evaluation results from all member accounts in that organization	OrganizationConformancePack*	aws:ResourceTag/${TagKey}	Write
DeletePendingAggregationRequest	Grants permission to delete pending authorization requests for a specified aggregator account in a specified region			Write
DeleteRemediationConfiguration	Grants permission to delete the remediation configuration	RemediationConfiguration*		Write
DeleteRemediationExceptions	Grants permission to delete one or more remediation exceptions for specific resource keys for a specific Amazon Config Rule			Write
DeleteResourceConfig	Grants permission to record the configuration state for a custom resource that has been deleted			Write
DeleteRetentionConfiguration	Grants permission to delete the retention configuration			Write
DeleteServiceLinkedConfigurationRecorder	Grants permission to delete the service-linked configuration recorder	ConfigurationRecorder*	aws:ResourceTag/${TagKey} config:ConfigurationRecorderServicePrincipal	Write
DeleteStoredQuery	Grants permission to delete the stored query for an Amazon Web Services account in an Amazon Web Services Region	StoredQuery*	aws:ResourceTag/${TagKey}	Write
DeliverConfigSnapshot	Grants permission to schedule delivery of a configuration snapshot to the Amazon S3 bucket in the specified delivery channel			Read
DescribeAggregateComplianceByConfigRules	Grants permission to return a list of compliant and noncompliant rules with the number of resources for compliant and noncompliant rules	ConfigurationAggregator*	aws:ResourceTag/${TagKey}	Read
DescribeAggregateComplianceByConformancePacks	Grants permission to return a list of compliant and noncompliant conformance packs along with count of compliant, non-compliant and total rules within each conformance pack	ConfigurationAggregator*	aws:ResourceTag/${TagKey}	Read
DescribeAggregationAuthorizations	Grants permission to return a list of authorizations granted to various aggregator accounts and regions			List
DescribeComplianceByConfigRule	Grants permission to indicate whether the specified Amazon Config rules are compliant			Read
DescribeComplianceByResource	Grants permission to indicate whether the specified Amazon resources are compliant			Read
DescribeConfigRuleEvaluationStatus	Grants permission to return status information for each of your Amazon managed Config rules			Read
DescribeConfigRules	Grants permission to return details about your Amazon Config rules			List
DescribeConfigurationAggregatorSourcesStatus	Grants permission to return status information for sources within an aggregator	ConfigurationAggregator*	aws:ResourceTag/${TagKey}	Read
DescribeConfigurationAggregators	Grants permission to return the details of one or more configuration aggregators			List
DescribeConfigurationRecorderStatus	Grants permission to return the current status of the specified configuration recorder	ConfigurationRecorder*	aws:ResourceTag/${TagKey} config:ConfigurationRecorderServicePrincipal	Read
DescribeConfigurationRecorders	Grants permission to return the names of one or more specified configuration recorders	ConfigurationRecorder*	aws:ResourceTag/${TagKey} config:ConfigurationRecorderServicePrincipal	Read
DescribeConformancePackCompliance	Grants permission to return compliance information for each rule in that conformance pack	ConformancePack*	aws:ResourceTag/${TagKey}	Read
DescribeConformancePackStatus	Grants permission to provide one or more conformance packs deployment status			Read
DescribeConformancePacks	Grants permission to return a list of one or more conformance packs			List
DescribeDeliveryChannelStatus	Grants permission to return the current status of the specified delivery channel			Read
DescribeDeliveryChannels	Grants permission to return details about the specified delivery channel			List
DescribeOrganizationConfigRuleStatuses	Grants permission to provide organization config rule deployment status for an organization			Read
DescribeOrganizationConfigRules	Grants permission to return a list of organization config rules			List
DescribeOrganizationConformancePackStatuses	Grants permission to provide organization conformance pack deployment status for an organization			Read
DescribeOrganizationConformancePacks	Grants permission to return a list of organization conformance packs			List
DescribePendingAggregationRequests	Grants permission to return a list of all pending aggregation requests			List
DescribeRemediationConfigurations	Grants permission to return the details of one or more remediation configurations	RemediationConfiguration*		List
DescribeRemediationExceptions	Grants permission to return the details of one or more remediation exceptions			List
DescribeRemediationExecutionStatus	Grants permission to provide a detailed view of a Remediation Execution for a set of resources including state, timestamps and any error messages for steps that have failed	RemediationConfiguration*		Read
DescribeRetentionConfigurations	Grants permission to return the details of one or more retention configurations			List
DisassociateResourceTypes	Grants permission to remove all specified resource types from the RecordingGroup of configuration recorder and excludes these resource types when recording	ConfigurationRecorder*	aws:ResourceTag/${TagKey}	Write
GetAggregateComplianceDetailsByConfigRule	Grants permission to return the evaluation results for the specified Amazon Config rule for a specific resource in a rule	ConfigurationAggregator*	aws:ResourceTag/${TagKey}	Read
GetAggregateConfigRuleComplianceSummary	Grants permission to return the number of compliant and noncompliant rules for one or more accounts and regions in an aggregator	ConfigurationAggregator*	aws:ResourceTag/${TagKey}	Read
GetAggregateConformancePackComplianceSummary	Grants permission to return the number of compliant and noncompliant conformance packs for one or more accounts and regions in an aggregator	ConfigurationAggregator*	aws:ResourceTag/${TagKey}	Read
GetAggregateDiscoveredResourceCounts	Grants permission to return the resource counts across accounts and regions that are present in your Amazon Config aggregator	ConfigurationAggregator*	aws:ResourceTag/${TagKey}	Read
GetAggregateResourceConfig	Grants permission to return configuration item that is aggregated for your specific resource in a specific source account and region	ConfigurationAggregator*	aws:ResourceTag/${TagKey}	Read
GetComplianceDetailsByConfigRule	Grants permission to return the evaluation results for the specified Amazon Config rule	ConfigRule*	aws:ResourceTag/${TagKey}	Read
GetComplianceDetailsByResource	Grants permission to return the evaluation results for the specified Amazon resource			Read
GetComplianceSummaryByConfigRule	Grants permission to return the number of Amazon Config rules that are compliant and noncompliant, up to a maximum of 25 for each			Read
GetComplianceSummaryByResourceType	Grants permission to return the number of resources that are compliant and the number that are noncompliant			Read
GetConformancePackComplianceDetails	Grants permission to return compliance details of a conformance pack for all Amazon resources that are monitered by conformance pack	ConformancePack*	aws:ResourceTag/${TagKey}	Read
GetConformancePackComplianceSummary	Grants permission to provide compliance summary for one or more conformance packs	ConformancePack*	aws:ResourceTag/${TagKey}	Read
GetConnector	Grants permission to return the details of a specific connector configuration	Connector*	aws:ResourceTag/${TagKey}	Read
GetCustomRulePolicy	Grants permission to return the policy definition containing the logic for your Amazon Config Custom Policy rule	ConfigRule*	aws:ResourceTag/${TagKey}	Read
GetDiscoveredResourceCounts	Grants permission to return the resource types, the number of each resource type, and the total number of resources that Amazon Config is recording in this region for your Amazon Web Services account			Read
GetOrganizationConfigRuleDetailedStatus	Grants permission to return detailed status for each member account within an organization for a given organization config rule	OrganizationConfigRule*	aws:ResourceTag/${TagKey}	Read
GetOrganizationConformancePackDetailedStatus	Grants permission to return detailed status for each member account within an organization for a given organization conformance pack	OrganizationConformancePack*	aws:ResourceTag/${TagKey}	Read
GetOrganizationCustomRulePolicy	Grants permission to return the policy definition containing the logic for your organization Amazon Config Custom Policy rule	OrganizationConfigRule*	aws:ResourceTag/${TagKey}	Read
GetResourceConfigHistory	Grants permission to return a list of configuration items for the specified resource			Read
GetResourceEvaluationSummary	Grants permission to return the summary of resource evaluations for a specific resource evaluation ID			Read
GetStoredQuery	Grants permission to return the details of a specific stored query	StoredQuery*	aws:ResourceTag/${TagKey}	Read
ListAggregateDiscoveredResources	Grants permission to accept a resource type and returns a list of resource identifiers that are aggregated for a specific resource type across accounts and regions	ConfigurationAggregator*	aws:ResourceTag/${TagKey}	List
ListConfigurationRecorders	Grants permission to list the configuration recorder summaries for an Amazon Web Services account in an Amazon Web Services Region			List
ListConformancePackComplianceScores	Grants permission to return the percentage of compliant rule-resource combinations in a conformance pack compared to the number of total possible rule-resource combinations			List
ListConnectors	Grants permission to list all connectors in the Amazon Web Services account and region			List
ListDiscoveredResources	Grants permission to accept a resource type and returns a list of resource identifiers for the resources of that type			List
ListResourceEvaluations	Grants permission to list the resource evaluation summaries for an Amazon Web Services account in an Amazon Web Services Region			List
ListStoredQueries	Grants permission to list the stored queries for an Amazon Web Services account in an Amazon Web Services Region			List
ListTagsForResource	Grants permission to list the tags for Amazon Config resource	AggregationAuthorization	aws:ResourceTag/${TagKey}	Read
		ConfigRule	aws:ResourceTag/${TagKey}
		ConfigurationAggregator	aws:ResourceTag/${TagKey}
		ConfigurationRecorder	aws:ResourceTag/${TagKey}
		ConformancePack	aws:ResourceTag/${TagKey}
		Connector	aws:ResourceTag/${TagKey}
		OrganizationConfigRule	aws:ResourceTag/${TagKey}
		OrganizationConformancePack	aws:ResourceTag/${TagKey}
		StoredQuery	aws:ResourceTag/${TagKey}
PutAggregationAuthorization	Grants permission to authorize the aggregator account and region to collect data from the source account and region	AggregationAuthorization*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutConfigRule	Grants permission to add or update an Amazon Config rule for evaluating whether your Amazon resources comply with your desired configurations	ConfigRule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutConfigurationAggregator	Grants permission to create and update the configuration aggregator with the selected source accounts and regions	ConfigurationAggregator*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutConfigurationRecorder	Grants permission to create or update a customer managed configuration recorder to record the selected resource configurations	ConfigurationRecorder*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutConformancePack	Grants permission to create or update a conformance pack	ConformancePack*	aws:ResourceTag/${TagKey}	Write
PutConnector	Grants permission to create a connector configuration that contains provider identity information, as well as other optional provider-specific information required for third-party recording	Connector*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutDeliveryChannel	Grants permission to create a delivery channel object to deliver configuration information to an Amazon S3 bucket and Amazon SNS topic			Write
PutEvaluations	Grants permission to be used by an Amazon Lambda function to deliver evaluation results to Amazon Config			Write
PutExternalEvaluation	Grants permission to deliver evaluation result to Amazon Config	ConfigRule*	aws:ResourceTag/${TagKey}	Write
PutOrganizationConfigRule	Grants permission to add or update organization config rule for your entire organization evaluating whether your Amazon resources comply with your desired configurations	OrganizationConfigRule*	aws:ResourceTag/${TagKey}	Write
PutOrganizationConformancePack	Grants permission to add or update organization conformance pack for your entire organization evaluating whether your Amazon resources comply with your desired configurations	OrganizationConformancePack*	aws:ResourceTag/${TagKey}	Write
PutRemediationConfigurations	Grants permission to add or update the remediation configuration with a specific Amazon Config rule with the selected target or action	RemediationConfiguration*		Write
PutRemediationExceptions	Grants permission to add or update remediation exceptions for specific resources for a specific Amazon Config rule			Write
PutResourceConfig	Grants permission to record the configuration state for the resource provided in the request			Write
PutRetentionConfiguration	Grants permission to create and update the retention configuration with details about retention period (number of days) that Amazon Config stores your historical information			Write
PutServiceLinkedConfigurationRecorder	Grants permission to create a new service-linked configuration recorder to record the resource configurations in scope for the linked service		aws:RequestTag/${TagKey} aws:TagKeys config:ConfigurationRecorderServicePrincipal	Write
PutStoredQuery	Grants permission to save a new query or updates an existing saved query	StoredQuery*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
PutThirdPartyServiceLinkedConfigurationRecorder	Grants permission to create or update a service-linked configuration recorder for a third-party provider linked to a specific Amazon partner service	Connector*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys config:ConfigurationRecorderServicePrincipal	Write
SelectAggregateResourceConfig	Grants permission to accept a structured query language (SQL) SELECT command and an aggregator to query configuration state of Amazon resources across multiple accounts and regions, performs the corresponding search, and returns resource configurations matching the properties	ConfigurationAggregator*	aws:ResourceTag/${TagKey}	Read
SelectResourceConfig	Grants permission to accept a structured query language (SQL) SELECT command, performs the corresponding search, and returns resource configurations matching the properties			Read
StartConfigRulesEvaluation	Grants permission to evaluate your resources against the specified Config rules	ConfigRule*	aws:ResourceTag/${TagKey}	Write
StartConfigurationRecorder	Grants permission to the customer managed configuration recorder to start recording configurations of the Amazon resources you have selected to record in your Amazon Web Services account	ConfigurationRecorder*	aws:ResourceTag/${TagKey}	Write
StartRemediationExecution	Grants permission to run an on-demand remediation for the specified Amazon Config rules against the last known remediation configuration			Write
StartResourceEvaluation	Grants permission to evaluate your resource details against the Amazon Config rules in your account			Write
StopConfigurationRecorder	Grants permission to the customer managed configuration recorder to stop recording configurations of the Amazon resources you have selected to record in your Amazon Web Services account	ConfigurationRecorder*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to associate the specified tags to a resource with the specified resourceArn	AggregationAuthorization	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		ConfigRule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		ConfigurationAggregator	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		ConfigurationRecorder	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		ConformancePack	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		Connector	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		OrganizationConfigRule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		OrganizationConformancePack	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		StoredQuery	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to delete specified tags from a resource	AggregationAuthorization	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		ConfigRule	aws:ResourceTag/${TagKey} aws:TagKeys
		ConfigurationAggregator	aws:ResourceTag/${TagKey} aws:TagKeys
		ConfigurationRecorder	aws:ResourceTag/${TagKey} aws:TagKeys
		ConformancePack	aws:ResourceTag/${TagKey} aws:TagKeys
		Connector	aws:ResourceTag/${TagKey} aws:TagKeys
		OrganizationConfigRule	aws:ResourceTag/${TagKey} aws:TagKeys
		OrganizationConformancePack	aws:ResourceTag/${TagKey} aws:TagKeys
		StoredQuery	aws:ResourceTag/${TagKey} aws:TagKeys

Resource types defined by Amazon Config

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
AggregationAuthorization	arn:${Partition}:config:${Region}:${Account}:aggregation-authorization/${AggregatorAccount}/${AggregatorRegion}	aws:ResourceTag/${TagKey}
ConfigRule	arn:${Partition}:config:${Region}:${Account}:config-rule/${ConfigRuleId}	aws:ResourceTag/${TagKey}
ConfigurationAggregator	arn:${Partition}:config:${Region}:${Account}:config-aggregator/${AggregatorId}	aws:ResourceTag/${TagKey}
ConfigurationRecorder	arn:${Partition}:config:${Region}:${Account}:configuration-recorder/${RecorderName}/${RecorderId}	aws:ResourceTag/${TagKey}
ConformancePack	arn:${Partition}:config:${Region}:${Account}:conformance-pack/${ConformancePackName}/${ConformancePackId}	aws:ResourceTag/${TagKey}
Connector	arn:${Partition}:config:${Region}:${Account}:connector/${Provider}/${ProviderId}/${ConnectorId}	aws:ResourceTag/${TagKey}
OrganizationConfigRule	arn:${Partition}:config:${Region}:${Account}:organization-config-rule/${OrganizationConfigRuleId}	aws:ResourceTag/${TagKey}
OrganizationConformancePack	arn:${Partition}:config:${Region}:${Account}:organization-conformance-pack/${OrganizationConformancePackId}	aws:ResourceTag/${TagKey}
RemediationConfiguration	arn:${Partition}:config:${Region}:${Account}:remediation-configuration/${RemediationConfigurationId}
StoredQuery	arn:${Partition}:config:${Region}:${Account}:stored-query/${StoredQueryName}/${StoredQueryId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Config

Amazon Config defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the allowed set of values for each of the tags	String
aws:ResourceTag/${TagKey}	Filters access by tag-value associated with the resource	String
aws:TagKeys	Filters access by the presence of mandatory tags in the request	ArrayOfString
config:ConfigurationRecorderServicePrincipal	Filters access by service principal of the configuration recorder	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Compute Optimizer (compute-optimizer)

Amazon Connector Service (awsconnector)