Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon FSx

Amazon FSx (service prefix: fsx) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by Amazon FSx

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AssociateFileSystemAliases	fsx:AssociateFileSystemAliases	Write
CancelDataRepositoryTask	fsx:CancelDataRepositoryTask	Write
CopyBackup	fsx:CopyBackup	Write
CopyBackup	fsx:TagResource	Tagging, Write
CopySnapshotAndUpdateVolume	fsx:CopySnapshotAndUpdateVolume	Write
CreateAndAttachS3AccessPoint	fsx:CreateAndAttachS3AccessPoint	Write
CreateBackup	fsx:CreateBackup	Write
CreateBackup	fsx:TagResource	Tagging, Write
CreateDataRepositoryAssociation	fsx:CreateDataRepositoryAssociation	Write
CreateDataRepositoryAssociation	fsx:TagResource	Tagging, Write
CreateDataRepositoryTask	fsx:CreateDataRepositoryTask	Write
CreateDataRepositoryTask	fsx:TagResource	Tagging, Write
CreateFileCache	fsx:CreateDataRepositoryAssociation	Write
	fsx:CreateFileCache	Write
	fsx:TagResource	Tagging, Write
CreateFileSystem	fsx:CreateFileSystem	Write
CreateFileSystem	fsx:TagResource	Tagging, Write
CreateFileSystemFromBackup	fsx:CreateFileSystemFromBackup	Write
CreateFileSystemFromBackup	fsx:TagResource	Tagging, Write
CreateSnapshot	fsx:CreateSnapshot	Write
CreateSnapshot	fsx:TagResource	Tagging, Write
CreateStorageVirtualMachine	fsx:CreateStorageVirtualMachine	Write
CreateStorageVirtualMachine	fsx:TagResource	Tagging, Write
CreateVolume	fsx:CreateVolume	Write
CreateVolume	fsx:TagResource	Tagging, Write
CreateVolumeFromBackup	fsx:CreateVolumeFromBackup	Write
CreateVolumeFromBackup	fsx:TagResource	Tagging, Write
DeleteBackup	fsx:DeleteBackup	Write
DeleteDataRepositoryAssociation	fsx:DeleteDataRepositoryAssociation	Write
DeleteFileCache	fsx:DeleteDataRepositoryAssociation	Write
DeleteFileCache	fsx:DeleteFileCache	Write
DeleteFileSystem	fsx:CreateBackup	Write
	fsx:DeleteFileSystem	Write
	fsx:TagResource	Tagging, Write
DeleteSnapshot	fsx:DeleteSnapshot	Write
DeleteStorageVirtualMachine	fsx:DeleteStorageVirtualMachine	Write
DeleteVolume	fsx:BypassSnaplockEnterpriseRetention	Permissions management, Write
	fsx:DeleteVolume	Write
	fsx:TagResource	Tagging, Write
DescribeBackups	fsx:DescribeBackups	Read
DescribeDataRepositoryAssociations	fsx:DescribeDataRepositoryAssociations	Read
DescribeDataRepositoryTasks	fsx:DescribeDataRepositoryTasks	Read
DescribeFileCaches	fsx:DescribeFileCaches	Read
DescribeFileSystemAliases	fsx:DescribeFileSystemAliases	Read
DescribeFileSystems	fsx:DescribeFileSystems	Read
DescribeS3AccessPointAttachments	fsx:DescribeS3AccessPointAttachments	Read
DescribeSharedVpcConfiguration	fsx:DescribeSharedVpcConfiguration	Read
DescribeSnapshots	fsx:DescribeSnapshots	Read
DescribeStorageVirtualMachines	fsx:DescribeStorageVirtualMachines	Read
DescribeVolumes	fsx:DescribeVolumes	Read
DetachAndDeleteS3AccessPoint	fsx:DetachAndDeleteS3AccessPoint	Write
DisassociateFileSystemAliases	fsx:DisassociateFileSystemAliases	Write
ListTagsForResource	fsx:ListTagsForResource	Read
ReleaseFileSystemNfsV3Locks	fsx:ReleaseFileSystemNfsV3Locks	Write
RestoreVolumeFromSnapshot	fsx:RestoreVolumeFromSnapshot	Write
StartMisconfiguredStateRecovery	fsx:StartMisconfiguredStateRecovery	Write
TagResource	fsx:TagResource	Tagging, Write
UntagResource	fsx:UntagResource	Tagging, Write
UpdateDataRepositoryAssociation	fsx:UpdateDataRepositoryAssociation	Write
UpdateFileCache	fsx:UpdateFileCache	Write
UpdateFileSystem	fsx:UpdateFileSystem	Write
UpdateSharedVpcConfiguration	fsx:UpdateSharedVpcConfiguration	Write
UpdateSnapshot	fsx:UpdateSnapshot	Write
UpdateStorageVirtualMachine	fsx:UpdateStorageVirtualMachine	Write
UpdateVolume	fsx:UpdateVolume	Write

Actions defined by Amazon FSx

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateFileSystemAliases	Grants permission to associate DNS aliases with an Amazon FSx for Windows File Server file system	file-system*	aws:ResourceTag/${TagKey}	Write
CancelDataRepositoryTask	Grants permission to cancel a data repository task	task*	aws:ResourceTag/${TagKey}	Write
CopyBackup	Grants permission to copy a backup	backup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CopySnapshotAndUpdateVolume	Grants permission to update an existing volume by using a snapshot from another Amazon FSx for OpenZFS file system	snapshot*	aws:ResourceTag/${TagKey}	Write
CopySnapshotAndUpdateVolume		volume*	aws:ResourceTag/${TagKey}	Write
CreateAndAttachS3AccessPoint	Grants permission to create and attach a S3 Access Point to a FSx File System	volume	aws:ResourceTag/${TagKey}	Write
CreateBackup	Grants permission to create a new backup of an Amazon FSx file system or an Amazon FSx volume	backup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		file-system	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		volume	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateDataRepositoryAssociation	Grants permission to create a new data respository association for an Amazon FSx for Lustre file system	association*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys fsx:NfsDataRepositoryAuthenticationEnabled fsx:NfsDataRepositoryEncryptionInTransitEnabled	Write
CreateDataRepositoryAssociation		file-system*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDataRepositoryTask	Grants permission to create a new data respository task for an Amazon FSx for Lustre file system	file-system*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDataRepositoryTask		task*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFileCache	Grants permission to create a new, empty, Amazon file cache	association	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys fsx:NfsDataRepositoryAuthenticationEnabled fsx:NfsDataRepositoryEncryptionInTransitEnabled	Write
CreateFileCache	Grants permission to create a new, empty, Amazon file cache	file-cache*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFileSystem	Grants permission to create a new, empty, Amazon FSx file system	file-system*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFileSystemFromBackup	Grants permission to create a new Amazon FSx file system from an existing backup	backup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFileSystemFromBackup		file-system*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSnapshot	Grants permission to create a new snapshot on a volume	snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSnapshot	Grants permission to create a new snapshot on a volume	volume*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateStorageVirtualMachine	Grants permission to create a new storage virtual machine in an Amazon FSx for Ontap file system	file-system*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateStorageVirtualMachine		storage-virtual-machine*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateVolume	Grants permission to create a new volume	snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys fsx:ParentVolumeId fsx:StorageVirtualMachineId	Write
CreateVolume	Grants permission to create a new volume	volume*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys fsx:ParentVolumeId fsx:StorageVirtualMachineId	Write
CreateVolumeFromBackup	Grants permission to create a new volume from backup	backup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys fsx:StorageVirtualMachineId	Write
		storage-virtual-machine*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys fsx:StorageVirtualMachineId
		volume*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys fsx:StorageVirtualMachineId
DeleteBackup	Grants permission to delete a backup, deleting its contents. After deletion, the backup no longer exists, and its data is no longer available	backup*	aws:ResourceTag/${TagKey}	Write
DeleteDataRepositoryAssociation	Grants permission to delete a data repository association	association*	aws:ResourceTag/${TagKey}	Write
DeleteFileCache	Grants permission to delete a file cache, deleting its contents	association	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteFileCache		file-cache*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteFileSystem	Grants permission to delete a file system, deleting its contents and any existing automatic backups of the file system	backup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteFileSystem		file-system*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteSnapshot	Grants permission to delete a snapshot on a volume	snapshot*	aws:ResourceTag/${TagKey}	Write
DeleteStorageVirtualMachine	Grants permission to delete a storage virtual machine, deleting its contents	storage-virtual-machine*	aws:ResourceTag/${TagKey}	Write
DeleteVolume	Grants permission to delete a volume, deleting its contents and any existing automatic backups of the volume	backup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys fsx:ParentVolumeId fsx:StorageVirtualMachineId	Write
DeleteVolume		volume*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys fsx:ParentVolumeId fsx:StorageVirtualMachineId	Write
DescribeBackups	Grants permission to return the descriptions of all backups owned by your Amazon Web Services account in the Amazon Web Services Region of the endpoint that you're calling			Read
DescribeDataRepositoryAssociations	Grants permission to return the descriptions of all data repository associations owned by your Amazon Web Services account in the Amazon Web Services Region of the endpoint that you're calling			Read
DescribeDataRepositoryTasks	Grants permission to return the descriptions of all data repository tasks owned by your Amazon Web Services account in the Amazon Web Services Region of the endpoint that you're calling			Read
DescribeFileCaches	Grants permission to return the descriptions of all file caches owned by your Amazon Web Services account in the Amazon Web Services Region of the endpoint that you're calling			Read
DescribeFileSystemAliases	Grants permission to return the description of all DNS aliases owned by your Amazon FSx for Windows File Server file system	file-system*	aws:ResourceTag/${TagKey}	Read
DescribeFileSystems	Grants permission to return the descriptions of all file systems owned by your Amazon Web Services account in the Amazon Web Services Region of the endpoint that you're calling			Read
DescribeS3AccessPointAttachments	Grants permission to return the descriptions of S3 Access Point Attachments			Read
DescribeSharedVpcConfiguration	Grants permission to return the descriptions of whether FSx route table updates from participant accounts are allowed in your account			Read
DescribeSnapshots	Grants permission to return the descriptions of all snapshots owned by your Amazon Web Services account in the Amazon Web Services Region of the endpoint you're calling			Read
DescribeStorageVirtualMachines	Grants permission to return the descriptions of all storage virtual machines owned by your Amazon Web Services account in the Amazon Web Services Region of the endpoint that you're calling			Read
DescribeVolumes	Grants permission to return the descriptions of all volumes owned by your Amazon Web Services account in the Amazon Web Services Region of the endpoint that you're calling			Read
DetachAndDeleteS3AccessPoint	Grants permission to detach an S3 Access Point from an Amazon FSx File System and delete the S3 Access Point	volume	aws:ResourceTag/${TagKey}	Write
DisassociateFileSystemAliases	Grants permission to disassociate file system aliases with an Amazon FSx for Windows File Server file system	file-system*	aws:ResourceTag/${TagKey}	Write
ListTagsForResource	Grants permission to list tags for an Amazon FSx resource	association	aws:ResourceTag/${TagKey}	Read
		backup	aws:ResourceTag/${TagKey}
		file-cache	aws:ResourceTag/${TagKey}
		file-system	aws:ResourceTag/${TagKey}
		snapshot	aws:ResourceTag/${TagKey}
		storage-virtual-machine	aws:ResourceTag/${TagKey}
		task	aws:ResourceTag/${TagKey}
		volume	aws:ResourceTag/${TagKey}
ReleaseFileSystemNfsV3Locks	Grants permission to release file system NFS V3 locks	file-system*	aws:ResourceTag/${TagKey}	Write
RestoreVolumeFromSnapshot	Grants permission to restore volume state from a snapshot	snapshot*	aws:ResourceTag/${TagKey}	Write
RestoreVolumeFromSnapshot	Grants permission to restore volume state from a snapshot	volume*	aws:ResourceTag/${TagKey}	Write
StartMisconfiguredStateRecovery	Grants permission to start misconfigured state recovery	file-system*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag an Amazon FSx resource	association	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys fsx:NfsDataRepositoryAuthenticationEnabled fsx:NfsDataRepositoryEncryptionInTransitEnabled	Tagging, Write
		backup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		file-cache	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		file-system	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		storage-virtual-machine	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		task	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		volume	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys fsx:ParentVolumeId fsx:StorageVirtualMachineId
UntagResource	Grants permission to remove a tag from an Amazon FSx resource	association	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		backup	aws:ResourceTag/${TagKey} aws:TagKeys
		file-cache	aws:ResourceTag/${TagKey} aws:TagKeys
		file-system	aws:ResourceTag/${TagKey} aws:TagKeys
		snapshot	aws:ResourceTag/${TagKey} aws:TagKeys
		storage-virtual-machine	aws:ResourceTag/${TagKey} aws:TagKeys
		task	aws:ResourceTag/${TagKey} aws:TagKeys
		volume	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateDataRepositoryAssociation	Grants permission to update data repository association configuration	association*	aws:ResourceTag/${TagKey}	Write
UpdateFileCache	Grants permission to update file cache configuration	file-cache*	aws:ResourceTag/${TagKey}	Write
UpdateFileSystem	Grants permission to update file system configuration	file-system*	aws:ResourceTag/${TagKey}	Write
UpdateSharedVpcConfiguration	Grants permission to enable or disable FSx route table updates from participant accounts in your account			Write
UpdateSnapshot	Grants permission to update snapshot configuration	snapshot*	aws:ResourceTag/${TagKey}	Write
UpdateStorageVirtualMachine	Grants permission to update storage virtual machine configuration	storage-virtual-machine*	aws:ResourceTag/${TagKey}	Write
UpdateVolume	Grants permission to update volume configuration	volume*	aws:ResourceTag/${TagKey} fsx:ParentVolumeId fsx:StorageVirtualMachineId	Write

Permission-only actions for Amazon FSx

The following actions are defined by Amazon FSx but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateFileGateway	Grants permission to associate a File Gateway instance with an Amazon FSx for Windows File Server file system	file-system*	aws:ResourceTag/${TagKey}	Write
BypassSnaplockEnterpriseRetention	Grants permission to allow deletion of an FSx for ONTAP SnapLock Enterprise volume that contains WORM (write once, read many) files with active retention periods	volume*	aws:ResourceTag/${TagKey}	Permissions management, Write
DeleteResourcePolicy	Grants permission to manage cross-account sharing of FSx volumes through Amazon Resource Access Manager (RAM). PutResourcePolicy and GetResourcePolicy are also required	volume*	aws:ResourceTag/${TagKey}	Permissions management, Write
DescribeAssociatedFileGateways	Grants permission to describe the File Gateway instances associated with an Amazon FSx for Windows File Server file system	file-system*	aws:ResourceTag/${TagKey}	Read
DisassociateFileGateway	Grants permission to disassociate a File Gateway instance from an Amazon FSx for Windows File Server file system	file-system*	aws:ResourceTag/${TagKey}	Write
GetResourcePolicy	Grants permission to manage cross-account sharing of FSx volumes through Amazon Resource Access Manager (RAM). PutResourcePolicy and DeleteResourcePolicy are also required	volume*	aws:ResourceTag/${TagKey}	Permissions management, Write
ManageBackupPrincipalAssociations	Grants permission to manage backup principal associations through Amazon Backup	backup*	aws:ResourceTag/${TagKey}	Permissions management, Write
PutResourcePolicy	Grants permission to manage cross-account sharing of FSx volumes through Amazon Resource Access Manager (RAM). DeleteResourcePolicy and GetResourcePolicy are also required	volume*	aws:ResourceTag/${TagKey}	Permissions management, Write

Resource types defined by Amazon FSx

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
association	arn:${Partition}:fsx:${Region}:${Account}:association/${FileSystemIdOrFileCacheId}/${DataRepositoryAssociationId}	aws:ResourceTag/${TagKey}
backup	arn:${Partition}:fsx:${Region}:${Account}:backup/${BackupId}	aws:ResourceTag/${TagKey}
file-cache	arn:${Partition}:fsx:${Region}:${Account}:file-cache/${FileCacheId}	aws:ResourceTag/${TagKey}
file-system	arn:${Partition}:fsx:${Region}:${Account}:file-system/${FileSystemId}	aws:ResourceTag/${TagKey}
snapshot	arn:${Partition}:fsx:${Region}:${Account}:snapshot/${VolumeId}/${SnapshotId}	aws:ResourceTag/${TagKey}
storage-virtual-machine	arn:${Partition}:fsx:${Region}:${Account}:storage-virtual-machine/${FileSystemId}/${StorageVirtualMachineId}	aws:ResourceTag/${TagKey}
task	arn:${Partition}:fsx:${Region}:${Account}:task/${TaskId}	aws:ResourceTag/${TagKey}
volume	arn:${Partition}:fsx:${Region}:${Account}:volume/${FileSystemId}/${VolumeId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon FSx

Amazon FSx defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
fsx:IsBackupCopyDestination	Filters access by whether the backup is a destination backup for a CopyBackup operation	Bool
fsx:IsBackupCopySource	Filters access by whether the backup is a source backup for a CopyBackup operation	Bool
fsx:NfsDataRepositoryAuthenticationEnabled	Filters access by NFS data repositories which support authentication	Bool
fsx:NfsDataRepositoryEncryptionInTransitEnabled	Filters access by NFS data repositories which support encryption-in-transit	Bool
fsx:ParentVolumeId	Filters access by the containing parent volume for mutating volume operations	String
fsx:StorageVirtualMachineId	Filters access by the containing storage virtual machine for a volume for mutating volume operations	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon FreeRTOS (freertos)

Amazon GameLift Servers (gamelift)