Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Elastic File System

Amazon Elastic File System (service prefix: elasticfilesystem) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Elastic File System
Actions defined by Amazon Elastic File System
Permission-only actions for Amazon Elastic File System
Resource types defined by Amazon Elastic File System
Condition keys for Amazon Elastic File System

API operations defined by Amazon Elastic File System

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateAccessPoint	elasticfilesystem:CreateAccessPoint			Write
CreateAccessPoint	elasticfilesystem:TagResource			Tagging, Write
CreateFileSystem	elasticfilesystem:CreateFileSystem			Write
CreateFileSystem	elasticfilesystem:TagResource			Tagging, Write
CreateMountTarget	elasticfilesystem:CreateMountTarget			Write
CreateReplicationConfiguration	elasticfilesystem:CreateReplicationConfiguration			Write
CreateReplicationConfiguration	iam:PassRole	iam:PassedToService	elasticfilesystem.amazonaws.com	Write
CreateTags	elasticfilesystem:CreateTags			Tagging, Write
DeleteAccessPoint	elasticfilesystem:DeleteAccessPoint			Write
DeleteFileSystem	elasticfilesystem:DeleteFileSystem			Write
DeleteFileSystemPolicy	elasticfilesystem:DeleteFileSystemPolicy			Permissions management, Write
DeleteMountTarget	elasticfilesystem:DeleteMountTarget			Write
DeleteReplicationConfiguration	elasticfilesystem:DeleteReplicationConfiguration			Write
DeleteTags	elasticfilesystem:DeleteTags			Tagging, Write
DescribeAccessPoints	elasticfilesystem:DescribeAccessPoints			List
DescribeAccountPreferences	elasticfilesystem:DescribeAccountPreferences			List
DescribeBackupPolicy	elasticfilesystem:DescribeBackupPolicy			Read
DescribeFileSystemPolicy	elasticfilesystem:DescribeFileSystemPolicy			Read
DescribeFileSystems	elasticfilesystem:DescribeFileSystems			List
DescribeLifecycleConfiguration	elasticfilesystem:DescribeLifecycleConfiguration			Read
DescribeMountTargetSecurityGroups	elasticfilesystem:DescribeMountTargetSecurityGroups			Read
DescribeMountTargets	elasticfilesystem:DescribeMountTargets			Read
DescribeReplicationConfigurations	elasticfilesystem:DescribeReplicationConfigurations			List
DescribeTags	elasticfilesystem:DescribeTags			Read
ListTagsForResource	elasticfilesystem:ListTagsForResource			Read
ModifyMountTargetSecurityGroups	elasticfilesystem:ModifyMountTargetSecurityGroups			Write
PutAccountPreferences	elasticfilesystem:PutAccountPreferences			Write
PutBackupPolicy	elasticfilesystem:PutBackupPolicy			Write
PutFileSystemPolicy	elasticfilesystem:PutFileSystemPolicy			Permissions management, Write
PutLifecycleConfiguration	elasticfilesystem:PutLifecycleConfiguration			Write
TagResource	elasticfilesystem:TagResource			Tagging, Write
UntagResource	elasticfilesystem:UntagResource			Tagging, Write
UpdateFileSystem	elasticfilesystem:UpdateFileSystem			Write
UpdateFileSystemProtection	elasticfilesystem:UpdateFileSystemProtection			Write

Actions defined by Amazon Elastic File System

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateAccessPoint	Grants permission to create an access point for the specified file system	file-system*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFileSystem	Grants permission to create a new, empty file system		aws:RequestTag/${TagKey} aws:TagKeys elasticfilesystem:Encrypted	Write
CreateMountTarget	Grants permission to create a mount target for a file system	file-system*	aws:ResourceTag/${TagKey}	Write
CreateReplicationConfiguration	Grants permission to create a new replication configuration	file-system*	aws:ResourceTag/${TagKey}	Write
CreateTags	Grants permission to create or overwrite tags associated with a file system; deprecated, see TagResource	file-system*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
DeleteAccessPoint	Grants permission to delete the specified access point	access-point*	aws:ResourceTag/${TagKey}	Write
DeleteFileSystem	Grants permission to delete a file system, permanently severing access to its contents	file-system*	aws:ResourceTag/${TagKey}	Write
DeleteFileSystemPolicy	Grants permission to delete the resource-level policy for a file system	file-system*	aws:ResourceTag/${TagKey}	Permissions management, Write
DeleteMountTarget	Grants permission to delete the specified mount target	file-system*	aws:ResourceTag/${TagKey}	Write
DeleteReplicationConfiguration	Grants permission to delete a replication configuration	file-system*	aws:ResourceTag/${TagKey}	Write
DeleteTags	Grants permission to delete the specified tags from a file system; deprecated, see UntagResource	file-system*	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
DescribeAccessPoints	Grants permission to view the descriptions of Amazon EFS access points	access-point	aws:ResourceTag/${TagKey}	List
DescribeAccessPoints		file-system	aws:ResourceTag/${TagKey}	List
DescribeAccountPreferences	Grants permission to view the account preferences in effect for an account			List
DescribeBackupPolicy	Grants permission to view the BackupPolicy object for an Amazon EFS file system	file-system*	aws:ResourceTag/${TagKey}	Read
DescribeFileSystemPolicy	Grants permission to view the resource-level policy for an Amazon EFS file system	file-system	aws:ResourceTag/${TagKey}	Read
DescribeFileSystems	Grants permission to view the description of an Amazon EFS file system specified by file system CreationToken or FileSystemId; or to view the description of all file systems owned by the caller's Amazon Web Services account in the Amazon region of the endpoint that is being called	file-system	aws:ResourceTag/${TagKey}	List
DescribeLifecycleConfiguration	Grants permission to view the LifecycleConfiguration object for an Amazon EFS file system	file-system*	aws:ResourceTag/${TagKey}	Read
DescribeMountTargetSecurityGroups	Grants permission to view the security groups in effect for a mount target	file-system*	aws:ResourceTag/${TagKey}	Read
DescribeMountTargets	Grants permission to view the descriptions of all mount targets, or a specific mount target, for a file system	access-point	aws:ResourceTag/${TagKey}	Read
DescribeMountTargets		file-system*	aws:ResourceTag/${TagKey}	Read
DescribeReplicationConfigurations	Grants permission to view the description of an Amazon EFS replication configuration specified by FileSystemId; or to view the description of all replication configurations owned by the caller's Amazon Web Services account in the Amazon region of the endpoint that is being called	file-system	aws:ResourceTag/${TagKey}	List
DescribeTags	Grants permission to view the tags associated with a file system	file-system*	aws:ResourceTag/${TagKey}	Read
ListTagsForResource	Grants permission to view the tags associated with the specified Amazon EFS resource	access-point	aws:ResourceTag/${TagKey}	Read
ListTagsForResource		file-system	aws:ResourceTag/${TagKey}	Read
ModifyMountTargetSecurityGroups	Grants permission to modify the set of security groups in effect for a mount target	file-system*	aws:ResourceTag/${TagKey}	Write
PutAccountPreferences	Grants permission to set the account preferences of an account			Write
PutBackupPolicy	Grants permission to enable or disable automatic backups with Amazon Backup by creating a new BackupPolicy object	file-system*	aws:ResourceTag/${TagKey}	Write
PutFileSystemPolicy	Grants permission to apply a resource-level policy that defines the actions allowed or denied from given actors for the specified file system	file-system*	aws:ResourceTag/${TagKey}	Permissions management, Write
PutLifecycleConfiguration	Grants permission to enable lifecycle management by creating a new LifecycleConfiguration object	file-system*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to create or overwrite tags associated with the specified Amazon EFS resource	access-point	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticfilesystem:CreateAction	Tagging, Write
TagResource		file-system	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys elasticfilesystem:CreateAction	Tagging, Write
UntagResource	Grants permission to delete the specified tags from an Amazon EFS resource	access-point	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource		file-system	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateFileSystem	Grants permission to update the throughput mode or the amount of provisioned throughput of an existing file system	file-system*	aws:ResourceTag/${TagKey}	Write
UpdateFileSystemProtection	Grants permission to update the file system protection of an existing file system	file-system*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon Elastic File System

The following actions are defined by Amazon Elastic File System but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
Backup	Grants permission to start a backup job for an existing file system	file-system*	aws:ResourceTag/${TagKey}	Write
ClientMount	Grants permission to allow an NFS client read-access to a file system	file-system*	aws:ResourceTag/${TagKey} elasticfilesystem:AccessedViaMountTarget elasticfilesystem:AccessPointArn	Read
ClientRootAccess	Grants permission to allow an NFS client root-access to a file system	file-system*	aws:ResourceTag/${TagKey} elasticfilesystem:AccessedViaMountTarget elasticfilesystem:AccessPointArn	Write
ClientWrite	Grants permission to allow an NFS client write-access to a file system	file-system*	aws:ResourceTag/${TagKey} elasticfilesystem:AccessedViaMountTarget elasticfilesystem:AccessPointArn	Write
ReplicationRead	Grants permission to read file system data for replication	file-system*	aws:ResourceTag/${TagKey}	Read
ReplicationWrite	Grants permission to replicate data to a file system	file-system*	aws:ResourceTag/${TagKey}	Write
Restore	Grants permission to start a restore job for a backup of a file system	file-system*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Elastic File System

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
access-point	arn:${Partition}:elasticfilesystem:${Region}:${Account}:access-point/${AccessPointId}	aws:ResourceTag/${TagKey}
file-system	arn:${Partition}:elasticfilesystem:${Region}:${Account}:file-system/${FileSystemId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Elastic File System

Amazon Elastic File System defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a tag key and value pair that is allowed in the request	String
aws:ResourceTag/${TagKey}	Filters access by a tag key and value pair of a resource	String
aws:TagKeys	Filters access by a list of tag keys that are allowed in the request	ArrayOfString
elasticfilesystem:AccessPointArn	Filters access by the ARN of the access point used to mount the file system	ARN
elasticfilesystem:AccessedViaMountTarget	Filters access by whether the file system is accessed via mount targets	Bool
elasticfilesystem:CreateAction	Filters access by the name of a resource-creating API action	String
elasticfilesystem:Encrypted	Filters access by whether users can create only encrypted or unencrypted file systems	Bool

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Elastic Container Service (ecs)

Amazon Elastic Kubernetes Service (eks)