Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Direct Connect

Amazon Direct Connect (service prefix: directconnect) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Direct Connect
Actions defined by Amazon Direct Connect
Resource types defined by Amazon Direct Connect
Condition keys for Amazon Direct Connect

API operations defined by Amazon Direct Connect

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AcceptDirectConnectGatewayAssociationProposal	directconnect:AcceptDirectConnectGatewayAssociationProposal	Write
AllocateConnectionOnInterconnect	directconnect:AllocateConnectionOnInterconnect	Write
AllocateHostedConnection	directconnect:AllocateHostedConnection	Write
AllocateHostedConnection	directconnect:TagResource	Tagging, Write
AllocatePrivateVirtualInterface	directconnect:AllocatePrivateVirtualInterface	Write
AllocatePrivateVirtualInterface	directconnect:TagResource	Tagging, Write
AllocatePublicVirtualInterface	directconnect:AllocatePublicVirtualInterface	Write
AllocatePublicVirtualInterface	directconnect:TagResource	Tagging, Write
AllocateTransitVirtualInterface	directconnect:AllocateTransitVirtualInterface	Write
AllocateTransitVirtualInterface	directconnect:TagResource	Tagging, Write
AssociateConnectionWithLag	directconnect:AssociateConnectionWithLag	Write
AssociateHostedConnection	directconnect:AssociateHostedConnection	Write
AssociateMacSecKey	directconnect:AssociateMacSecKey	Write
AssociateVirtualInterface	directconnect:AssociateVirtualInterface	Write
ConfirmConnection	directconnect:ConfirmConnection	Write
ConfirmCustomerAgreement	directconnect:ConfirmCustomerAgreement	Write
ConfirmPrivateVirtualInterface	directconnect:ConfirmPrivateVirtualInterface	Write
ConfirmPublicVirtualInterface	directconnect:ConfirmPublicVirtualInterface	Write
ConfirmTransitVirtualInterface	directconnect:ConfirmTransitVirtualInterface	Write
CreateBGPPeer	directconnect:CreateBGPPeer	Write
CreateConnection	directconnect:CreateConnection	Write
CreateConnection	directconnect:TagResource	Tagging, Write
CreateDirectConnectGateway	directconnect:CreateDirectConnectGateway	Write
CreateDirectConnectGateway	directconnect:TagResource	Tagging, Write
CreateDirectConnectGatewayAssociation	directconnect:CreateDirectConnectGatewayAssociation	Write
CreateDirectConnectGatewayAssociationProposal	directconnect:CreateDirectConnectGatewayAssociationProposal	Write
CreateInterconnect	directconnect:CreateInterconnect	Write
CreateInterconnect	directconnect:TagResource	Tagging, Write
CreateLag	directconnect:CreateLag	Write
CreateLag	directconnect:TagResource	Tagging, Write
CreatePrivateVirtualInterface	directconnect:CreatePrivateVirtualInterface	Write
CreatePrivateVirtualInterface	directconnect:TagResource	Tagging, Write
CreatePublicVirtualInterface	directconnect:CreatePublicVirtualInterface	Write
CreatePublicVirtualInterface	directconnect:TagResource	Tagging, Write
CreateTransitVirtualInterface	directconnect:CreateTransitVirtualInterface	Write
CreateTransitVirtualInterface	directconnect:TagResource	Tagging, Write
DeleteBGPPeer	directconnect:DeleteBGPPeer	Write
DeleteConnection	directconnect:DeleteConnection	Write
DeleteDirectConnectGateway	directconnect:DeleteDirectConnectGateway	Write
DeleteDirectConnectGatewayAssociation	directconnect:DeleteDirectConnectGatewayAssociation	Write
DeleteDirectConnectGatewayAssociationProposal	directconnect:DeleteDirectConnectGatewayAssociationProposal	Write
DeleteInterconnect	directconnect:DeleteInterconnect	Write
DeleteLag	directconnect:DeleteLag	Write
DeleteVirtualInterface	directconnect:DeleteVirtualInterface	Write
DescribeConnectionLoa	directconnect:DescribeConnectionLoa	Read
DescribeConnections	directconnect:DescribeConnections	Read
DescribeConnectionsOnInterconnect	directconnect:DescribeConnectionsOnInterconnect	Read
DescribeCustomerMetadata	directconnect:DescribeCustomerMetadata	Read
DescribeDirectConnectGatewayAssociationProposals	directconnect:DescribeDirectConnectGatewayAssociationProposals	Read
DescribeDirectConnectGatewayAssociations	directconnect:DescribeDirectConnectGatewayAssociations	Read
DescribeDirectConnectGatewayAttachments	directconnect:DescribeDirectConnectGatewayAttachments	Read
DescribeDirectConnectGateways	directconnect:DescribeDirectConnectGateways	Read
DescribeHostedConnections	directconnect:DescribeHostedConnections	Read
DescribeInterconnectLoa	directconnect:DescribeInterconnectLoa	Read
DescribeInterconnects	directconnect:DescribeInterconnects	Read
DescribeLags	directconnect:DescribeLags	Read
DescribeLoa	directconnect:DescribeLoa	Read
DescribeLocations	directconnect:DescribeLocations	Read
DescribeRouterConfiguration	directconnect:DescribeRouterConfiguration	Read
DescribeTags	directconnect:DescribeTags	Read
DescribeVirtualGateways	directconnect:DescribeVirtualGateways	Read
DescribeVirtualInterfaces	directconnect:DescribeVirtualInterfaces	Read
DisassociateConnectionFromLag	directconnect:DisassociateConnectionFromLag	Write
DisassociateMacSecKey	directconnect:DisassociateMacSecKey	Write
ListVirtualInterfaceTestHistory	directconnect:ListVirtualInterfaceTestHistory	List
StartBgpFailoverTest	directconnect:StartBgpFailoverTest	Write
StopBgpFailoverTest	directconnect:StopBgpFailoverTest	Write
TagResource	directconnect:TagResource	Tagging, Write
UntagResource	directconnect:UntagResource	Tagging, Write
UpdateConnection	directconnect:UpdateConnection	Write
UpdateDirectConnectGateway	directconnect:UpdateDirectConnectGateway	Write
UpdateDirectConnectGatewayAssociation	directconnect:UpdateDirectConnectGatewayAssociation	Write
UpdateLag	directconnect:UpdateLag	Write
UpdateVirtualInterfaceAttributes	directconnect:UpdateVirtualInterfaceAttributes	Write

Actions defined by Amazon Direct Connect

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptDirectConnectGatewayAssociationProposal	Grants permission to accept a proposal request to attach a virtual private gateway to a Direct Connect gateway	dx-gateway*	aws:ResourceTag/${TagKey}	Write
AllocateConnectionOnInterconnect	Grants permission to create a hosted connection on an interconnect	dxcon*	aws:ResourceTag/${TagKey}	Write
AllocateHostedConnection	Grants permission to create a new hosted connection between a Amazon Direct Connect partner's network and a specific Amazon Direct Connect location	dxcon	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
AllocateHostedConnection		dxlag	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
AllocatePrivateVirtualInterface	Grants permission to provision a private virtual interface to be owned by a different customer	dxcon	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
AllocatePrivateVirtualInterface		dxlag	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
AllocatePublicVirtualInterface	Grants permission to provision a public virtual interface to be owned by a different customer	dxcon	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
AllocatePublicVirtualInterface		dxlag	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
AllocateTransitVirtualInterface	Grants permission to provision a transit virtual interface to be owned by a different customer	dxcon	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
AllocateTransitVirtualInterface		dxlag	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
AssociateConnectionWithLag	Grants permission to associate a connection with a LAG	dxcon*	aws:ResourceTag/${TagKey}	Write
AssociateConnectionWithLag	Grants permission to associate a connection with a LAG	dxlag*	aws:ResourceTag/${TagKey}	Write
AssociateHostedConnection	Grants permission to associate a hosted connection and its virtual interfaces with a link aggregation group (LAG) or interconnect	dxcon*	aws:ResourceTag/${TagKey}	Write
		dxcon*	aws:ResourceTag/${TagKey}
		dxlag	aws:ResourceTag/${TagKey}
AssociateMacSecKey	Grants permission to associate a MAC Security (MACsec) Connection Key Name (CKN)/ Connectivity Association Key (CAK) pair with an Amazon Direct Connect dedicated connection	dxcon	aws:ResourceTag/${TagKey}	Write
AssociateMacSecKey		dxlag	aws:ResourceTag/${TagKey}	Write
AssociateVirtualInterface	Grants permission to associate a virtual interface with a specified link aggregation group (LAG) or connection	dxcon	aws:ResourceTag/${TagKey}	Write
		dxlag	aws:ResourceTag/${TagKey}
		dxvif*	aws:ResourceTag/${TagKey}
ConfirmConnection	Grants permission to confirm the creation of a hosted connection on an interconnect	dxcon*	aws:ResourceTag/${TagKey}	Write
ConfirmCustomerAgreement	Grants permission to confirm the the terms of agreement when creating the connection or link aggregation group (LAG)			Write
ConfirmPrivateVirtualInterface	Grants permission to accept ownership of a private virtual interface created by another customer	dxvif*	aws:ResourceTag/${TagKey}	Write
ConfirmPublicVirtualInterface	Grants permission to accept ownership of a public virtual interface created by another customer	dxvif*	aws:ResourceTag/${TagKey}	Write
ConfirmTransitVirtualInterface	Grants permission to accept ownership of a transit virtual interface created by another customer	dxvif*	aws:ResourceTag/${TagKey}	Write
CreateBGPPeer	Grants permission to create a BGP peer on the specified virtual interface	dxvif*	aws:ResourceTag/${TagKey}	Write
CreateConnection	Grants permission to create a new connection between the customer network and a specific Amazon Direct Connect location	dxlag	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDirectConnectGateway	Grants permission to create a Direct Connect gateway, which is an intermediate object that enables you to connect a set of virtual interfaces and virtual private gateways		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateDirectConnectGatewayAssociation	Grants permission to create an association between a Direct Connect gateway and a virtual private gateway	dx-gateway*	aws:ResourceTag/${TagKey}	Write
CreateDirectConnectGatewayAssociationProposal	Grants permission to create a proposal to associate the specified virtual private gateway with the specified Direct Connect gateway	dx-gateway*	aws:ResourceTag/${TagKey}	Write
CreateInterconnect	Grants permission to create a new interconnect between a Amazon Direct Connect partner's network and a specific Amazon Direct Connect location	dxlag	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateLag	Grants permission to create a link aggregation group (LAG) with the specified number of bundled physical connections between the customer network and a specific Amazon Direct Connect location	dxcon	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePrivateVirtualInterface	Grants permission to create a new private virtual interface	dxcon	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePrivateVirtualInterface	Grants permission to create a new private virtual interface	dxlag	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePublicVirtualInterface	Grants permission to create a new public virtual interface	dxcon	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePublicVirtualInterface	Grants permission to create a new public virtual interface	dxlag	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTransitVirtualInterface	Grants permission to create a new transit virtual interface	dxcon	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTransitVirtualInterface	Grants permission to create a new transit virtual interface	dxlag	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteBGPPeer	Grants permission to delete the specified BGP peer on the specified virtual interface with the specified customer address and ASN	dxvif*	aws:ResourceTag/${TagKey}	Write
DeleteConnection	Grants permission to delete the connection	dxcon*	aws:ResourceTag/${TagKey}	Write
DeleteDirectConnectGateway	Grants permission to delete the specified Direct Connect gateway	dx-gateway*	aws:ResourceTag/${TagKey}	Write
DeleteDirectConnectGatewayAssociation	Grants permission to delete the association between the specified Direct Connect gateway and virtual private gateway	dx-gateway*	aws:ResourceTag/${TagKey}	Write
DeleteDirectConnectGatewayAssociationProposal	Grants permission to delete the association proposal request between the specified Direct Connect gateway and virtual private gateway			Write
DeleteInterconnect	Grants permission to delete the specified interconnect	dxcon*	aws:ResourceTag/${TagKey}	Write
DeleteLag	Grants permission to delete the specified link aggregation group (LAG)	dxlag*	aws:ResourceTag/${TagKey}	Write
DeleteVirtualInterface	Grants permission to delete a virtual interface	dxvif*	aws:ResourceTag/${TagKey}	Write
DescribeConnectionLoa	Grants permission to describe the LOA-CFA for a Connection	dxcon*	aws:ResourceTag/${TagKey}	Read
DescribeConnections	Grants permission to describe all connections in this region	dxcon	aws:ResourceTag/${TagKey}	Read
DescribeConnectionsOnInterconnect	Grants permission to describe a list of connections that have been provisioned on the given interconnect	dxcon*	aws:ResourceTag/${TagKey}	Read
DescribeCustomerMetadata	Grants permission to view a list of customer agreements, along with their signed status and whether the customer is an NNIPartner, NNIPartnerV2, or a nonPartner			Read
DescribeDirectConnectGatewayAssociationProposals	Grants permission to describe one or more association proposals for connection between a virtual private gateway and a Direct Connect gateway	dx-gateway	aws:ResourceTag/${TagKey}	Read
DescribeDirectConnectGatewayAssociations	Grants permission to describe the associations between your Direct Connect gateways and virtual private gateways	dx-gateway	aws:ResourceTag/${TagKey}	Read
DescribeDirectConnectGatewayAttachments	Grants permission to describe the attachments between your Direct Connect gateways and virtual interfaces	dx-gateway	aws:ResourceTag/${TagKey}	Read
DescribeDirectConnectGateways	Grants permission to describe all your Direct Connect gateways or only the specified Direct Connect gateway	dx-gateway	aws:ResourceTag/${TagKey}	Read
DescribeHostedConnections	Grants permission to describe the hosted connections that have been provisioned on the specified interconnect or link aggregation group (LAG)	dxcon	aws:ResourceTag/${TagKey}	Read
DescribeHostedConnections		dxlag	aws:ResourceTag/${TagKey}	Read
DescribeInterconnectLoa	Grants permission to describe the LOA-CFA for an Interconnect	dxcon*	aws:ResourceTag/${TagKey}	Read
DescribeInterconnects	Grants permission to describe a list of interconnects owned by the Amazon Web Services account	dxcon	aws:ResourceTag/${TagKey}	Read
DescribeLags	Grants permission to describe all your link aggregation groups (LAG) or the specified LAG	dxlag	aws:ResourceTag/${TagKey}	Read
DescribeLoa	Grants permission to describe the LOA-CFA for a connection, interconnect, or link aggregation group (LAG)	dxcon	aws:ResourceTag/${TagKey}	Read
DescribeLoa		dxlag	aws:ResourceTag/${TagKey}	Read
DescribeLocations	Grants permission to describe the list of Amazon Direct Connect locations in the current Amazon region			Read
DescribeRouterConfiguration	Grants permission to describe Details about the router for a virtual interface	dxvif*	aws:ResourceTag/${TagKey}	Read
DescribeTags	Grants permission to describe the tags associated with the specified Amazon Direct Connect resources	dx-gateway	aws:ResourceTag/${TagKey}	Read
		dxcon	aws:ResourceTag/${TagKey}
		dxlag	aws:ResourceTag/${TagKey}
		dxvif	aws:ResourceTag/${TagKey}
DescribeVirtualGateways	Grants permission to describe a list of virtual private gateways owned by the Amazon Web Services account			Read
DescribeVirtualInterfaces	Grants permission to describe all virtual interfaces for an Amazon Web Services account	dxcon	aws:ResourceTag/${TagKey}	Read
		dxlag	aws:ResourceTag/${TagKey}
		dxvif	aws:ResourceTag/${TagKey}
DisassociateConnectionFromLag	Grants permission to disassociate a connection from a link aggregation group (LAG)	dxcon*	aws:ResourceTag/${TagKey}	Write
DisassociateConnectionFromLag		dxlag*	aws:ResourceTag/${TagKey}	Write
DisassociateMacSecKey	Grants permission to remove the association between a MAC Security (MACsec) security key and an Amazon Direct Connect dedicated connection	dxcon	aws:ResourceTag/${TagKey}	Write
DisassociateMacSecKey		dxlag	aws:ResourceTag/${TagKey}	Write
ListVirtualInterfaceTestHistory	Grants permission to list the virtual interface failover test history	dxvif*	aws:ResourceTag/${TagKey}	List
StartBgpFailoverTest	Grants permission to start the virtual interface failover test that verifies your configuration meets your resiliency requirements by placing the BGP peering session in the DOWN state. You can then send traffic to verify that there are no outages	dxvif*	aws:ResourceTag/${TagKey}	Write
StopBgpFailoverTest	Grants permission to stop the virtual interface failover test	dxvif*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to add the specified tags to the specified Amazon Direct Connect resource. Each resource can have a maximum of 50 tags	dx-gateway	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		dxcon	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		dxlag	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		dxvif	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove one or more tags from the specified Amazon Direct Connect resource	dx-gateway	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		dxcon	aws:ResourceTag/${TagKey} aws:TagKeys
		dxlag	aws:ResourceTag/${TagKey} aws:TagKeys
		dxvif	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateConnection	Grants permission to update the Amazon Direct Connect dedicated connection configuration. You can update the following parameters for a connection: The connection name or The connection's MAC Security (MACsec) encryption mode	dxcon*	aws:ResourceTag/${TagKey}	Write
UpdateDirectConnectGateway	Grants permission to update the name of a Direct Connect gateway	dx-gateway*	aws:ResourceTag/${TagKey}	Write
UpdateDirectConnectGatewayAssociation	Grants permission to update the specified attributes of the Direct Connect gateway association			Write
UpdateLag	Grants permission to update the attributes of the specified link aggregation group (LAG)	dxlag*	aws:ResourceTag/${TagKey}	Write
UpdateVirtualInterfaceAttributes	Grants permission to update the specified attributes of the specified virtual private interface	dxvif*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Direct Connect

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
dx-gateway	arn:${Partition}:directconnect::${Account}:dx-gateway/${DirectConnectGatewayId}	aws:ResourceTag/${TagKey}
dxcon	arn:${Partition}:directconnect:${Region}:${Account}:dxcon/${ConnectionId}	aws:ResourceTag/${TagKey}
dxlag	arn:${Partition}:directconnect:${Region}:${Account}:dxlag/${LagId}	aws:ResourceTag/${TagKey}
dxvif	arn:${Partition}:directconnect:${Region}:${Account}:dxvif/${VirtualInterfaceId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Direct Connect

Amazon Direct Connect defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by actions based on the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by actions based on tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by actions based on the presence of tag keys in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Database Migration Service (dms)

Amazon Directory Service (ds)