Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Directory Service

Amazon Directory Service (service prefix: ds) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Directory Service
Actions defined by Amazon Directory Service
Permission-only actions for Amazon Directory Service
Resource types defined by Amazon Directory Service
Condition keys for Amazon Directory Service

API operations defined by Amazon Directory Service

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AcceptSharedDirectory	ds:AcceptSharedDirectory	Write
AddIpRoutes	ds:AddIpRoutes	Write
AddRegion	ds:AddRegion	Write
AddTagsToResource	ds:AddTagsToResource	Tagging, Write
CancelSchemaExtension	ds:CancelSchemaExtension	Write
ConnectDirectory	ds:AddTagsToResource	Tagging, Write
ConnectDirectory	ds:ConnectDirectory	Write
CreateAlias	ds:CreateAlias	Write
CreateComputer	ds:CreateComputer	Write
CreateConditionalForwarder	ds:CreateConditionalForwarder	Write
CreateDirectory	ds:AddTagsToResource	Tagging, Write
CreateDirectory	ds:CreateDirectory	Write
CreateHybridAD	ds:AddTagsToResource	Tagging, Write
CreateHybridAD	ds:CreateHybridAD	Write
CreateLogSubscription	ds:CreateLogSubscription	Write
CreateMicrosoftAD	ds:AddTagsToResource	Tagging, Write
CreateMicrosoftAD	ds:CreateMicrosoftAD	Write
CreateSnapshot	ds:CreateSnapshot	Write
CreateTrust	ds:CreateTrust	Write
DeleteADAssessment	ds:DeleteADAssessment	Write
DeleteConditionalForwarder	ds:DeleteConditionalForwarder	Write
DeleteDirectory	ds:DeleteDirectory	Write
DeleteLogSubscription	ds:DeleteLogSubscription	Write
DeleteSnapshot	ds:DeleteSnapshot	Write
DeleteTrust	ds:DeleteTrust	Write
DeregisterCertificate	ds:DeregisterCertificate	Write
DeregisterEventTopic	ds:DeregisterEventTopic	Write
DescribeADAssessment	ds:DescribeADAssessment	Read
DescribeCAEnrollmentPolicy	ds:DescribeCAEnrollmentPolicy	Read
DescribeCertificate	ds:DescribeCertificate	Read
DescribeClientAuthenticationSettings	ds:DescribeClientAuthenticationSettings	Read
DescribeConditionalForwarders	ds:DescribeConditionalForwarders	Read
DescribeDirectories	ds:DescribeDirectories	List
DescribeDirectoryDataAccess	ds:DescribeDirectoryDataAccess	Read
DescribeDomainControllers	ds:DescribeDomainControllers	Read
DescribeEventTopics	ds:DescribeEventTopics	Read
DescribeHybridADUpdate	ds:DescribeHybridADUpdate	Read
DescribeLDAPSSettings	ds:DescribeLDAPSSettings	Read
DescribeRegions	ds:DescribeRegions	Read
DescribeSettings	ds:DescribeSettings	Read
DescribeSharedDirectories	ds:DescribeSharedDirectories	Read
DescribeSnapshots	ds:DescribeSnapshots	Read
DescribeTrusts	ds:DescribeTrusts	Read
DescribeUpdateDirectory	ds:DescribeUpdateDirectory	Read
DisableCAEnrollmentPolicy	ds:DisableCAEnrollmentPolicy	Write
DisableClientAuthentication	ds:DisableClientAuthentication	Write
DisableDirectoryDataAccess	ds:DisableDirectoryDataAccess	Write
DisableLDAPS	ds:DisableLDAPS	Write
DisableRadius	ds:DisableRadius	Write
DisableSso	ds:DisableSso	Write
EnableCAEnrollmentPolicy	ds:EnableCAEnrollmentPolicy	Write
EnableClientAuthentication	ds:EnableClientAuthentication	Write
EnableDirectoryDataAccess	ds:EnableDirectoryDataAccess	Write
EnableLDAPS	ds:EnableLDAPS	Write
EnableRadius	ds:EnableRadius	Write
EnableSso	ds:EnableSso	Write
GetDirectoryLimits	ds:GetDirectoryLimits	Read
GetSnapshotLimits	ds:GetSnapshotLimits	Read
ListADAssessments	ds:ListADAssessments	List
ListCertificates	ds:ListCertificates	List
ListIpRoutes	ds:ListIpRoutes	Read
ListLogSubscriptions	ds:ListLogSubscriptions	Read
ListSchemaExtensions	ds:ListSchemaExtensions	List
ListTagsForResource	ds:ListTagsForResource	Read
RegisterCertificate	ds:RegisterCertificate	Write
RegisterEventTopic	ds:RegisterEventTopic	Write
RejectSharedDirectory	ds:RejectSharedDirectory	Write
RemoveIpRoutes	ds:RemoveIpRoutes	Write
RemoveRegion	ds:RemoveRegion	Write
RemoveTagsFromResource	ds:RemoveTagsFromResource	Tagging, Write
ResetUserPassword	ds:ResetUserPassword	Write
RestoreFromSnapshot	ds:RestoreFromSnapshot	Write
ShareDirectory	ds:ShareDirectory	Write
StartADAssessment	ds:StartADAssessment	Write
StartSchemaExtension	ds:StartSchemaExtension	Write
UnshareDirectory	ds:UnshareDirectory	Write
UpdateConditionalForwarder	ds:UpdateConditionalForwarder	Write
UpdateDirectorySetup	ds:UpdateDirectorySetup	Write
UpdateHybridAD	ds:UpdateHybridAD	Write
UpdateNumberOfDomainControllers	ds:UpdateNumberOfDomainControllers	Write
UpdateRadius	ds:UpdateRadius	Write
UpdateSettings	ds:UpdateSettings	Write
UpdateTrust	ds:UpdateTrust	Write
VerifyTrust	ds:VerifyTrust	Read

Actions defined by Amazon Directory Service

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptSharedDirectory	Grants permission to accept a directory sharing request that was sent from the directory owner account	directory*	aws:ResourceTag/${TagKey}	Write
AddIpRoutes	Grants permission to add a CIDR address block to correctly route traffic to and from your Microsoft AD on Amazon Web Services	directory*	aws:ResourceTag/${TagKey}	Write
AddRegion	Grants permission to add two domain controllers in the specified Region for the specified directory	directory*	aws:ResourceTag/${TagKey}	Write
AddTagsToResource	Grants permission to add or overwrite one or more tags for the specified Amazon Directory Services directory	directory*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
CancelSchemaExtension	Grants permission to cancel an in-progress schema extension to a Microsoft AD directory	directory*	aws:ResourceTag/${TagKey}	Write
ConnectDirectory	Grants permission to create an AD Connector to connect to an on-premises directory		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateAlias	Grants permission to create an alias for a directory and assigns the alias to the directory	directory*	aws:ResourceTag/${TagKey}	Write
CreateComputer	Grants permission to create a computer account in the specified directory, and joins the computer to the directory	directory*	aws:ResourceTag/${TagKey}	Write
CreateConditionalForwarder	Grants permission to create a conditional forwarder associated with your Amazon directory	directory*	aws:ResourceTag/${TagKey}	Write
CreateDirectory	Grants permission to create a Simple AD directory		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateHybridAD	Grants permission to create a Hybrid Managed AD directory		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateLogSubscription	Grants permission to create a subscription to forward real time Directory Service domain controller security logs to the specified CloudWatch log group in your Amazon Web Services account	directory*	aws:ResourceTag/${TagKey}	Write
CreateMicrosoftAD	Grants permission to create a Microsoft AD in the Amazon cloud		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateSnapshot	Grants permission to create a snapshot of a Simple AD or Microsoft AD directory in the Amazon cloud	directory*	aws:ResourceTag/${TagKey}	Write
CreateTrust	Grants permission to initiate the creation of the Amazon side of a trust relationship between a Microsoft AD in the Amazon cloud and an external domain	directory*	aws:ResourceTag/${TagKey}	Write
DeleteADAssessment	Grants permission to delete a directory assessment			Write
DeleteConditionalForwarder	Grants permission to delete a conditional forwarder that has been set up for your Amazon directory	directory*	aws:ResourceTag/${TagKey}	Write
DeleteDirectory	Grants permission to delete an Amazon Directory Service directory	directory*	aws:ResourceTag/${TagKey}	Write
DeleteLogSubscription	Grants permission to delete the specified log subscription	directory*	aws:ResourceTag/${TagKey}	Write
DeleteSnapshot	Grants permission to delete a directory snapshot	directory*	aws:ResourceTag/${TagKey}	Write
DeleteTrust	Grants permission to delete an existing trust relationship between your Microsoft AD in the Amazon cloud and an external domain	directory*	aws:ResourceTag/${TagKey}	Write
DeregisterCertificate	Grants permission to delete from the system the certificate that was registered for a secured LDAP connection	directory*	aws:ResourceTag/${TagKey}	Write
DeregisterEventTopic	Grants permission to remove the specified directory as a publisher to the specified SNS topic	directory*	aws:ResourceTag/${TagKey}	Write
DescribeADAssessment	Grants permission to describe a directory assessment			Read
DescribeCAEnrollmentPolicy	Grants permission to describe the ca enrollment status of a specified directory	directory*	aws:ResourceTag/${TagKey}	Read
DescribeCertificate	Grants permission to display information about the certificate registered for a secured LDAP connection	directory*	aws:ResourceTag/${TagKey}	Read
DescribeClientAuthenticationSettings	Grants permission to retrieve information about the type of client authentication for the specified directory, if the type is specified. If no type is specified, information about all client authentication types that are supported for the specified directory is retrieved. Currently, only SmartCard is supported	directory*	aws:ResourceTag/${TagKey}	Read
DescribeConditionalForwarders	Grants permission to obtain information about the conditional forwarders for this account	directory*	aws:ResourceTag/${TagKey}	Read
DescribeDirectories	Grants permission to obtain information about the directories that belong to this account			List
DescribeDirectoryDataAccess	Grants permission to describe the Directory Service Data API status for the specified directory	directory*	aws:ResourceTag/${TagKey}	Read
DescribeDomainControllers	Grants permission to provide information about any domain controllers in your directory	directory*	aws:ResourceTag/${TagKey}	Read
DescribeEventTopics	Grants permission to obtain information about which SNS topics receive status messages from the specified directory	directory*	aws:ResourceTag/${TagKey}	Read
DescribeHybridADUpdate	Grants permission to describe the updates of a specified hybrid directory	directory*	aws:ResourceTag/${TagKey}	Read
DescribeLDAPSSettings	Grants permission to describe the status of LDAP security for the specified directory	directory*	aws:ResourceTag/${TagKey}	Read
DescribeRegions	Grants permission to provide information about the Regions that are configured for multi-Region replication	directory*	aws:ResourceTag/${TagKey}	Read
DescribeSettings	Grants permission to retrieve information about the configurable settings for the specified directory	directory*	aws:ResourceTag/${TagKey}	Read
DescribeSharedDirectories	Grants permission to return the shared directories in your account	directory*	aws:ResourceTag/${TagKey}	Read
DescribeSnapshots	Grants permission to obtain information about the directory snapshots that belong to this account			Read
DescribeTrusts	Grants permission to obtain information about the trust relationships for this account			Read
DescribeUpdateDirectory	Grants permission to describe the updates of a directory for a particular update type	directory*	aws:ResourceTag/${TagKey}	Read
DisableCAEnrollmentPolicy	Grants permission to disable the ca enrollment of a specified directory	directory*	aws:ResourceTag/${TagKey}	Write
DisableClientAuthentication	Grants permission to disable alternative client authentication methods for the specified directory	directory*	aws:ResourceTag/${TagKey}	Write
DisableDirectoryDataAccess	Grants permission to disable the Directory Service Data API for the specified directory	directory*	aws:ResourceTag/${TagKey}	Write
DisableLDAPS	Grants permission to deactivate LDAP secure calls for the specified directory	directory*	aws:ResourceTag/${TagKey}	Write
DisableRadius	Grants permission to disable multi-factor authentication (MFA) with the Remote Authentication Dial In User Service (RADIUS) server for an AD Connector directory	directory*	aws:ResourceTag/${TagKey}	Write
DisableSso	Grants permission to disable single-sign on for a directory	directory*	aws:ResourceTag/${TagKey}	Write
EnableCAEnrollmentPolicy	Grants permission to enable the ca enrollment of a specified directory	directory*	aws:ResourceTag/${TagKey}	Write
EnableClientAuthentication	Grants permission to enable alternative client authentication methods for the specified directory	directory*	aws:ResourceTag/${TagKey}	Write
EnableDirectoryDataAccess	Grants permission to enable the Directory Service Data API for the specified directory	directory*	aws:ResourceTag/${TagKey}	Write
EnableLDAPS	Grants permission to activate the switch for the specific directory to always use LDAP secure calls	directory*	aws:ResourceTag/${TagKey}	Write
EnableRadius	Grants permission to enable multi-factor authentication (MFA) with the Remote Authentication Dial In User Service (RADIUS) server for an AD Connector directory	directory*	aws:ResourceTag/${TagKey}	Write
EnableSso	Grants permission to enable single-sign on for a directory	directory*	aws:ResourceTag/${TagKey}	Write
GetDirectoryLimits	Grants permission to obtain directory limit information for the current region			Read
GetSnapshotLimits	Grants permission to obtain the manual snapshot limits for a directory	directory*	aws:ResourceTag/${TagKey}	Read
ListADAssessments	Grants permission to list directory assessments			List
ListCertificates	Grants permission to list all the certificates registered for a secured LDAP connection, for the specified directory	directory*	aws:ResourceTag/${TagKey}	List
ListIpRoutes	Grants permission to list the address blocks that you have added to a directory	directory*	aws:ResourceTag/${TagKey}	Read
ListLogSubscriptions	Grants permission to list the active log subscriptions for the Amazon Web Services account			Read
ListSchemaExtensions	Grants permission to list all schema extensions applied to a Microsoft AD Directory	directory*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list all tags on an Amazon Directory Services directory	directory*	aws:ResourceTag/${TagKey}	Read
RegisterCertificate	Grants permission to register a certificate for secured LDAP connection	directory*	aws:ResourceTag/${TagKey}	Write
RegisterEventTopic	Grants permission to associate a directory with an SNS topic	directory*	aws:ResourceTag/${TagKey}	Write
RejectSharedDirectory	Grants permission to reject a directory sharing request that was sent from the directory owner account	directory*	aws:ResourceTag/${TagKey}	Write
RemoveIpRoutes	Grants permission to remove IP address blocks from a directory	directory*	aws:ResourceTag/${TagKey}	Write
RemoveRegion	Grants permission to stop all replication and removes the domain controllers from the specified Region. You cannot remove the primary Region with this operation	directory*	aws:ResourceTag/${TagKey}	Write
RemoveTagsFromResource	Grants permission to remove tags from an Amazon Directory Services directory	directory*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
ResetUserPassword	Grants permission to reset the password for any user in your Amazon Managed Microsoft AD or Simple AD directory	directory*	aws:ResourceTag/${TagKey}	Write
RestoreFromSnapshot	Grants permission to restore a directory using an existing directory snapshot	directory*	aws:ResourceTag/${TagKey}	Write
ShareDirectory	Grants permission to share a specified directory in your Amazon Web Services account (directory owner) with another Amazon Web Services account (directory consumer). With this operation you can use your directory from any Amazon Web Services account and from any Amazon VPC within an Amazon Web Services Region	directory*	aws:ResourceTag/${TagKey}	Write
StartADAssessment	Grants permission to start a directory assessment			Write
StartSchemaExtension	Grants permission to apply a schema extension to a Microsoft AD directory	directory*	aws:ResourceTag/${TagKey}	Write
UnshareDirectory	Grants permission to stop the directory sharing between the directory owner and consumer accounts	directory*	aws:ResourceTag/${TagKey}	Write
UpdateConditionalForwarder	Grants permission to update a conditional forwarder that has been set up for your Amazon directory	directory*	aws:ResourceTag/${TagKey}	Write
UpdateDirectorySetup	Grants permission to update the directory for a particular update type	directory*	aws:ResourceTag/${TagKey}	Write
UpdateHybridAD	Grants permission to update configurations for a specified hybrid directory	directory*	aws:ResourceTag/${TagKey}	Write
UpdateNumberOfDomainControllers	Grants permission to add or remove domain controllers to or from the directory. Based on the difference between current value and new value (provided through this API call), domain controllers will be added or removed. It may take up to 45 minutes for any new domain controllers to become fully active once the requested number of domain controllers is updated. During this time, you cannot make another update request	directory*	aws:ResourceTag/${TagKey}	Write
UpdateRadius	Grants permission to update the Remote Authentication Dial In User Service (RADIUS) server information for an AD Connector directory	directory*	aws:ResourceTag/${TagKey}	Write
UpdateSettings	Grants permission to update the configurable settings for the specified directory	directory*	aws:ResourceTag/${TagKey}	Write
UpdateTrust	Grants permission to update the trust that has been set up between your Amazon Managed Microsoft AD directory and an on-premises Active Directory	directory*	aws:ResourceTag/${TagKey}	Write
VerifyTrust	Grants permission to verify a trust relationship between your Microsoft AD in the Amazon cloud and an external domain	directory*	aws:ResourceTag/${TagKey}	Read

Permission-only actions for Amazon Directory Service

The following actions are defined by Amazon Directory Service but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AccessDSData	Grants permission to access directory data using the Directory Service Data API	directory*	aws:ResourceTag/${TagKey}	Permissions management, Write
AuthorizeApplication	Grants permission to authorize an application for your Amazon Directory	directory*	aws:ResourceTag/${TagKey}	Write
CheckAlias	Grants permission to verify that the alias is available for use			Read
CreateIdentityPoolDirectory	Grants permission to create an IdentityPool Directory in the Amazon cloud		aws:RequestTag/${TagKey} aws:TagKeys	Write
DisableRoleAccess	Grants permission to disable Amazon Web Services Management Console access for identity in your Amazon Directory	directory*	aws:ResourceTag/${TagKey}	Write
EnableRoleAccess	Grants permission to enable Amazon Web Services Management Console access for identity in your Amazon Directory	directory*	aws:ResourceTag/${TagKey}	Write
GetAuthorizedApplicationDetails	Grants permission to retrieve the details of the authorized applications on a directory	directory*	aws:ResourceTag/${TagKey}	Read
ListAuthorizedApplications	Grants permission to obtain the Amazon applications authorized for a directory	directory*	aws:ResourceTag/${TagKey}	Read
UnauthorizeApplication	Grants permission to unauthorize an application from your Amazon Directory	directory*	aws:ResourceTag/${TagKey}	Write
UpdateAuthorizedApplication	Grants permission to update an authorized application for your Amazon Directory	directory*	aws:ResourceTag/${TagKey}	Write
UpdateDirectory	Grants permission to update the configurations like service account credentials or DNS server IP addresses for the specified directory	directory*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Directory Service

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
directory	arn:${Partition}:ds:${Region}:${Account}:directory/${DirectoryId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Directory Service

Amazon Directory Service defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the value of the request to Amazon DS	String
aws:ResourceTag/${TagKey}	Filters access by the Amazon DS Resource being acted upon	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Direct Connect (directconnect)

Amazon Elastic Beanstalk (elasticbeanstalk)