Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon EC2 Image Builder

Amazon EC2 Image Builder (service prefix: imagebuilder) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon EC2 Image Builder
Actions defined by Amazon EC2 Image Builder
Resource types defined by Amazon EC2 Image Builder
Condition keys for Amazon EC2 Image Builder

API operations defined by Amazon EC2 Image Builder

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CancelImageCreation	imagebuilder:CancelImageCreation			Write
CancelLifecycleExecution	imagebuilder:CancelLifecycleExecution			Write
CreateComponent	imagebuilder:CreateComponent			Write
CreateComponent	imagebuilder:TagResource			Tagging, Write
CreateContainerRecipe	imagebuilder:CreateContainerRecipe			Write
	imagebuilder:GetComponent			Read
	imagebuilder:GetImage			Read
	imagebuilder:TagResource			Tagging, Write
CreateDistributionConfiguration	imagebuilder:CreateDistributionConfiguration			Write
CreateDistributionConfiguration	imagebuilder:TagResource			Tagging, Write
CreateImage	imagebuilder:CreateImage			Write
	imagebuilder:GetContainerRecipe			Read
	imagebuilder:GetDistributionConfiguration			Read
	imagebuilder:GetImageRecipe			Read
	imagebuilder:GetInfrastructureConfiguration			Read
	imagebuilder:GetWorkflow			Read
	imagebuilder:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	imagebuilder.amazonaws.com	Write
CreateImagePipeline	imagebuilder:CreateImagePipeline			Write
	imagebuilder:GetContainerRecipe			Read
	imagebuilder:GetDistributionConfiguration			Read
	imagebuilder:GetImageRecipe			Read
	imagebuilder:GetInfrastructureConfiguration			Read
	imagebuilder:GetWorkflow			Read
	imagebuilder:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	imagebuilder.amazonaws.com	Write
CreateImageRecipe	imagebuilder:CreateImageRecipe			Write
	imagebuilder:GetComponent			Read
	imagebuilder:GetImage			Read
	imagebuilder:TagResource			Tagging, Write
CreateInfrastructureConfiguration	imagebuilder:CreateInfrastructureConfiguration			Write
	imagebuilder:TagResource			Tagging, Write
	iam:GetInstanceProfile			Read
	iam:PassRole	iam:PassedToService	ec2.amazonaws.com	Write
CreateLifecyclePolicy	imagebuilder:CreateLifecyclePolicy			Write
	imagebuilder:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	imagebuilder.amazonaws.com	Write
CreateWorkflow	imagebuilder:CreateWorkflow			Write
CreateWorkflow	imagebuilder:TagResource			Tagging, Write
DeleteComponent	imagebuilder:DeleteComponent			Write
DeleteContainerRecipe	imagebuilder:DeleteContainerRecipe			Write
DeleteDistributionConfiguration	imagebuilder:DeleteDistributionConfiguration			Write
DeleteImage	imagebuilder:DeleteImage			Write
DeleteImagePipeline	imagebuilder:DeleteImagePipeline			Write
DeleteImageRecipe	imagebuilder:DeleteImageRecipe			Write
DeleteInfrastructureConfiguration	imagebuilder:DeleteInfrastructureConfiguration			Write
DeleteLifecyclePolicy	imagebuilder:DeleteLifecyclePolicy			Write
DeleteWorkflow	imagebuilder:DeleteWorkflow			Write
DistributeImage	imagebuilder:DistributeImage			Write
	imagebuilder:GetDistributionConfiguration			Read
	imagebuilder:GetImage			Read
	iam:PassRole	iam:PassedToService	imagebuilder.amazonaws.com	Write
GetComponent	imagebuilder:GetComponent			Read
GetComponentPolicy	imagebuilder:GetComponentPolicy			Read
GetContainerRecipe	imagebuilder:GetContainerRecipe			Read
GetContainerRecipePolicy	imagebuilder:GetContainerRecipePolicy			Read
GetDistributionConfiguration	imagebuilder:GetDistributionConfiguration			Read
GetImage	imagebuilder:GetImage			Read
GetImagePipeline	imagebuilder:GetImagePipeline			Read
GetImagePolicy	imagebuilder:GetImagePolicy			Read
GetImageRecipe	imagebuilder:GetImageRecipe			Read
GetImageRecipePolicy	imagebuilder:GetImageRecipePolicy			Read
GetInfrastructureConfiguration	imagebuilder:GetInfrastructureConfiguration			Read
GetLifecycleExecution	imagebuilder:GetLifecycleExecution			Read
GetLifecyclePolicy	imagebuilder:GetLifecyclePolicy			Read
GetMarketplaceResource	imagebuilder:GetMarketplaceResource			Read
GetWorkflow	imagebuilder:GetWorkflow			Read
GetWorkflowExecution	imagebuilder:GetWorkflowExecution			Read
GetWorkflowStepExecution	imagebuilder:GetWorkflowStepExecution			Read
ImportDiskImage	imagebuilder:GetInfrastructureConfiguration			Read
	imagebuilder:ImportDiskImage			Write
	imagebuilder:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	imagebuilder.amazonaws.com	Write
ImportVmImage	imagebuilder:ImportVmImage			Write
ImportVmImage	imagebuilder:TagResource			Tagging, Write
ListComponentBuildVersions	imagebuilder:ListComponentBuildVersions			List
ListComponents	imagebuilder:ListComponents			List
ListContainerRecipes	imagebuilder:ListContainerRecipes			List
ListDistributionConfigurations	imagebuilder:ListDistributionConfigurations			List
ListImageBuildVersions	imagebuilder:ListImageBuildVersions			List
ListImagePackages	imagebuilder:ListImagePackages			List
ListImagePipelineImages	imagebuilder:ListImagePipelineImages			List
ListImagePipelines	imagebuilder:ListImagePipelines			List
ListImageRecipes	imagebuilder:ListImageRecipes			List
ListImageScanFindingAggregations	imagebuilder:ListImageScanFindingAggregations			List
ListImageScanFindings	imagebuilder:ListImageScanFindings			List
ListImages	imagebuilder:ListImages			List
ListInfrastructureConfigurations	imagebuilder:ListInfrastructureConfigurations			List
ListLifecycleExecutionResources	imagebuilder:ListLifecycleExecutionResources			List
ListLifecycleExecutions	imagebuilder:ListLifecycleExecutions			List
ListLifecyclePolicies	imagebuilder:ListLifecyclePolicies			List
ListTagsForResource	imagebuilder:ListTagsForResource			Read
ListWaitingWorkflowSteps	imagebuilder:ListWaitingWorkflowSteps			List
ListWorkflowBuildVersions	imagebuilder:ListWorkflowBuildVersions			List
ListWorkflowExecutions	imagebuilder:ListWorkflowExecutions			List
ListWorkflowStepExecutions	imagebuilder:ListWorkflowStepExecutions			List
ListWorkflows	imagebuilder:ListWorkflows			List
PutComponentPolicy	imagebuilder:PutComponentPolicy			Permissions management, Write
PutContainerRecipePolicy	imagebuilder:PutContainerRecipePolicy			Permissions management, Write
PutImagePolicy	imagebuilder:PutImagePolicy			Permissions management, Write
PutImageRecipePolicy	imagebuilder:PutImageRecipePolicy			Permissions management, Write
RetryImage	imagebuilder:RetryImage			Write
SendWorkflowStepAction	imagebuilder:SendWorkflowStepAction			Write
StartImagePipelineExecution	imagebuilder:StartImagePipelineExecution			Write
StartImagePipelineExecution	imagebuilder:TagResource			Tagging, Write
StartResourceStateUpdate	imagebuilder:StartResourceStateUpdate			Write
StartResourceStateUpdate	iam:PassRole	iam:PassedToService	imagebuilder.amazonaws.com	Write
TagResource	imagebuilder:TagResource			Tagging, Write
UntagResource	imagebuilder:UntagResource			Tagging, Write
UpdateDistributionConfiguration	imagebuilder:UpdateDistributionConfiguration			Write
UpdateDistributionConfiguration	iam:PassRole	iam:PassedToService	vmie.amazonaws.com	Write
UpdateImagePipeline	imagebuilder:GetContainerRecipe			Read
	imagebuilder:GetDistributionConfiguration			Read
	imagebuilder:GetImageRecipe			Read
	imagebuilder:GetInfrastructureConfiguration			Read
	imagebuilder:GetWorkflow			Read
	imagebuilder:TagResource			Tagging, Write
	imagebuilder:UpdateImagePipeline			Write
	iam:PassRole	iam:PassedToService	imagebuilder.amazonaws.com	Write
UpdateInfrastructureConfiguration	imagebuilder:UpdateInfrastructureConfiguration			Write
	iam:GetInstanceProfile			Read
	iam:PassRole	iam:PassedToService	ec2.amazonaws.com	Write
UpdateLifecyclePolicy	imagebuilder:UpdateLifecyclePolicy			Write
UpdateLifecyclePolicy	iam:PassRole	iam:PassedToService	imagebuilder.amazonaws.com	Write

Actions defined by Amazon EC2 Image Builder

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CancelImageCreation	Grants permission to cancel an image creation	image*	aws:ResourceTag/${TagKey}	Write
CancelLifecycleExecution	Grants permission to cancel a lifecycle execution	lifecycleExecution*		Write
CreateComponent	Grants permission to create a new component	component*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateContainerRecipe	Grants permission to create a new Container Recipe	containerRecipe*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDistributionConfiguration	Grants permission to create a new distribution configuration	distributionConfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateImage	Grants permission to create a new image	image*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateImagePipeline	Grants permission to create a new image pipeline	imagePipeline*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateImageRecipe	Grants permission to create a new Image Recipe	imageRecipe*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateInfrastructureConfiguration	Grants permission to create a new infrastructure configuration	infrastructureConfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys imagebuilder:CreatedResourceTag/${TagKey} imagebuilder:CreatedResourceTagKeys imagebuilder:Ec2MetadataHttpTokens imagebuilder:StatusTopicArn	Write
CreateLifecyclePolicy	Grants permission to create a new lifecycle policy	lifecyclePolicy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys imagebuilder:LifecyclePolicyResourceType	Write
CreateWorkflow	Grants permission to create a new workflow	workflow*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteComponent	Grants permission to delete a component	component*	aws:ResourceTag/${TagKey}	Write
DeleteContainerRecipe	Grants permission to delete a container recipe	containerRecipe*	aws:ResourceTag/${TagKey}	Write
DeleteDistributionConfiguration	Grants permission to delete a distribution configuration	distributionConfiguration*	aws:ResourceTag/${TagKey}	Write
DeleteImage	Grants permission to delete an image	image*	aws:ResourceTag/${TagKey}	Write
DeleteImagePipeline	Grants permission to delete an image pipeline	imagePipeline*	aws:ResourceTag/${TagKey}	Write
DeleteImageRecipe	Grants permission to delete an image recipe	imageRecipe*	aws:ResourceTag/${TagKey}	Write
DeleteInfrastructureConfiguration	Grants permission to delete an infrastructure configuration	infrastructureConfiguration*	aws:ResourceTag/${TagKey}	Write
DeleteLifecyclePolicy	Grants permission to delete a lifecycle policy	lifecyclePolicy*	aws:ResourceTag/${TagKey}	Write
DeleteWorkflow	Grants permission to delete a workflow	workflow*	aws:ResourceTag/${TagKey}	Write
DistributeImage	Grants permission to distribute an image	image*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
GetComponent	Grants permission to view details about a component	component*	aws:ResourceTag/${TagKey}	Read
GetComponentPolicy	Grants permission to view the resource policy associated with a component	component*	aws:ResourceTag/${TagKey}	Read
GetContainerRecipe	Grants permission to view details about a container recipe	containerRecipe*	aws:ResourceTag/${TagKey}	Read
GetContainerRecipePolicy	Grants permission to view the resource policy associated with a container recipe	containerRecipe*	aws:ResourceTag/${TagKey}	Read
GetDistributionConfiguration	Grants permission to view details about a distribution configuration	distributionConfiguration*	aws:ResourceTag/${TagKey}	Read
GetImage	Grants permission to view details about an image	image*	aws:ResourceTag/${TagKey}	Read
GetImagePipeline	Grants permission to view details about an image pipeline	imagePipeline*	aws:ResourceTag/${TagKey}	Read
GetImagePolicy	Grants permission to view the resource policy associated with an image	image*	aws:ResourceTag/${TagKey}	Read
GetImageRecipe	Grants permission to view details about an image recipe	imageRecipe*	aws:ResourceTag/${TagKey}	Read
GetImageRecipePolicy	Grants permission to view the resource policy associated with an image recipe	imageRecipe*	aws:ResourceTag/${TagKey}	Read
GetInfrastructureConfiguration	Grants permission to view details about an infrastructure configuration	infrastructureConfiguration*	aws:ResourceTag/${TagKey}	Read
GetLifecycleExecution	Grants permission to view details about a lifecycle execution	lifecycleExecution*		Read
GetLifecyclePolicy	Grants permission to view details about a lifecycle policy	lifecyclePolicy*	aws:ResourceTag/${TagKey}	Read
GetMarketplaceResource	Grants permission to retrieve Marketplace provided resource	component*	aws:ResourceTag/${TagKey}	Read
GetWorkflow	Grants permission to view details about a workflow	workflow*	aws:ResourceTag/${TagKey}	Read
GetWorkflowExecution	Grants permission to view details about a workflow execution	workflowExecution*		Read
GetWorkflowStepExecution	Grants permission to view details about a workflow step execution	workflowStepExecution*		Read
ImportComponent	Grants permission to import a new component	component*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
ImportDiskImage	Grants permission to import a disk image	imageVersion*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
ImportVmImage	Grants permission to import an image	imageVersion*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
ListComponentBuildVersions	Grants permission to list the component build versions in your account	allComponentBuildVersions*		List
ListComponents	Grants permission to list the component versions owned by or shared with your account			List
ListContainerRecipes	Grants permission to list the container recipes owned by or shared with your account			List
ListDistributionConfigurations	Grants permission to list the distribution configurations in your account			List
ListImageBuildVersions	Grants permission to list the image build versions in your account	allImageBuildVersions*		List
ListImagePackages	Grants permission to return a list of packages installed on the specified image	image*	aws:ResourceTag/${TagKey}	List
ListImagePipelineImages	Grants permission to return a list of images created by the specified pipeline	imagePipeline*	aws:ResourceTag/${TagKey}	List
ListImagePipelines	Grants permission to list the image pipelines in your account			List
ListImageRecipes	Grants permission to list the image recipes owned by or shared with your account			List
ListImageScanFindingAggregations	Grants permission to list aggregations on the image scan findings in your account	image	aws:ResourceTag/${TagKey}	List
ListImageScanFindingAggregations		imagePipeline	aws:ResourceTag/${TagKey}	List
ListImageScanFindings	Grants permission to list the image scan findings for the images in your account	image	aws:ResourceTag/${TagKey}	List
ListImageScanFindings		imagePipeline	aws:ResourceTag/${TagKey}	List
ListImages	Grants permission to list the image versions owned by or shared with your account			List
ListInfrastructureConfigurations	Grants permission to list the infrastructure configurations in your account			List
ListLifecycleExecutionResources	Grants permission to list resources for the specified lifecycle execution	lifecycleExecution*		List
ListLifecycleExecutions	Grants permission to list lifecycle executions for the specified resource	image	aws:ResourceTag/${TagKey}	List
ListLifecycleExecutions		lifecyclePolicy	aws:ResourceTag/${TagKey}	List
ListLifecyclePolicies	Grants permission to list the lifecycle policies in your account			List
ListTagsForResource	Grants permission to list tags for an Image Builder resource	component	aws:ResourceTag/${TagKey}	Read
		containerRecipe	aws:ResourceTag/${TagKey}
		distributionConfiguration	aws:ResourceTag/${TagKey}
		image	aws:ResourceTag/${TagKey}
		imagePipeline	aws:ResourceTag/${TagKey}
		imageRecipe	aws:ResourceTag/${TagKey}
		infrastructureConfiguration	aws:ResourceTag/${TagKey}
		lifecyclePolicy	aws:ResourceTag/${TagKey}
		workflow	aws:ResourceTag/${TagKey}
ListWaitingWorkflowSteps	Grants permission to list waiting workflow steps for the caller account			List
ListWorkflowBuildVersions	Grants permission to list the workflow build versions in your account	allWorkflowBuildVersions*		List
ListWorkflowExecutions	Grants permission to list workflow executions for the specified image	image*	aws:ResourceTag/${TagKey}	List
ListWorkflowStepExecutions	Grants permission to list workflow step executions for the specified workflow	workflowExecution*		List
ListWorkflows	Grants permission to list the workflow versions owned by or shared with your account			List
PutComponentPolicy	Grants permission to set the resource policy associated with a component	component*	aws:ResourceTag/${TagKey}	Permissions management, Write
PutContainerRecipePolicy	Grants permission to set the resource policy associated with a container recipe	containerRecipe*	aws:ResourceTag/${TagKey}	Permissions management, Write
PutImagePolicy	Grants permission to set the resource policy associated with an image	image*	aws:ResourceTag/${TagKey}	Permissions management, Write
PutImageRecipePolicy	Grants permission to set the resource policy associated with an image recipe	imageRecipe*	aws:ResourceTag/${TagKey}	Permissions management, Write
RetryImage	Grants permission to retry an image creation	image*	aws:ResourceTag/${TagKey}	Write
SendWorkflowStepAction	Grants permission to send an action to a workflow step	image*	aws:ResourceTag/${TagKey}	Write
SendWorkflowStepAction	Grants permission to send an action to a workflow step	workflowStepExecution*		Write
StartImagePipelineExecution	Grants permission to create a new image from a pipeline	imagePipeline*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
StartResourceStateUpdate	Grants permission to start a state update for the specified resource	image*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag an Image Builder resource	component	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		containerRecipe	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		distributionConfiguration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		image	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		imagePipeline	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		imageRecipe	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		infrastructureConfiguration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		lifecyclePolicy	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workflow	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to untag an Image Builder resource	component	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		containerRecipe	aws:ResourceTag/${TagKey} aws:TagKeys
		distributionConfiguration	aws:ResourceTag/${TagKey} aws:TagKeys
		image	aws:ResourceTag/${TagKey} aws:TagKeys
		imagePipeline	aws:ResourceTag/${TagKey} aws:TagKeys
		imageRecipe	aws:ResourceTag/${TagKey} aws:TagKeys
		infrastructureConfiguration	aws:ResourceTag/${TagKey} aws:TagKeys
		lifecyclePolicy	aws:ResourceTag/${TagKey} aws:TagKeys
		workflow	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateDistributionConfiguration	Grants permission to update an existing distribution configuration	distributionConfiguration*	aws:ResourceTag/${TagKey}	Write
UpdateImagePipeline	Grants permission to update an existing image pipeline	imagePipeline*	aws:ResourceTag/${TagKey}	Write
UpdateInfrastructureConfiguration	Grants permission to update an existing infrastructure configuration	infrastructureConfiguration*	aws:ResourceTag/${TagKey} imagebuilder:CreatedResourceTag/${TagKey} imagebuilder:CreatedResourceTagKeys imagebuilder:Ec2MetadataHttpTokens imagebuilder:StatusTopicArn	Write
UpdateLifecyclePolicy	Grants permission to update an existing lifecycle policy	lifecyclePolicy*	aws:ResourceTag/${TagKey} imagebuilder:LifecyclePolicyResourceType	Write

Resource types defined by Amazon EC2 Image Builder

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
allComponentBuildVersions	arn:${Partition}:imagebuilder:${Region}:${Account}:component/${ComponentName}/${ComponentVersion}/*
allImageBuildVersions	arn:${Partition}:imagebuilder:${Region}:${Account}:image/${ImageName}/${ImageVersion}/*
allWorkflowBuildVersions	arn:${Partition}:imagebuilder:${Region}:${Account}:workflow/${WorkflowType}/${WorkflowName}/${WorkflowVersion}/*
component	arn:${Partition}:imagebuilder:${Region}:${Account}:component/${ComponentName}/${ComponentVersion}/${ComponentBuildVersion}	aws:ResourceTag/${TagKey}
containerRecipe	arn:${Partition}:imagebuilder:${Region}:${Account}:container-recipe/${ContainerRecipeName}/${ContainerRecipeVersion}	aws:ResourceTag/${TagKey}
distributionConfiguration	arn:${Partition}:imagebuilder:${Region}:${Account}:distribution-configuration/${DistributionConfigurationName}	aws:ResourceTag/${TagKey}
image	arn:${Partition}:imagebuilder:${Region}:${Account}:image/${ImageName}/${ImageVersion}/${ImageBuildVersion}	aws:ResourceTag/${TagKey}
imagePipeline	arn:${Partition}:imagebuilder:${Region}:${Account}:image-pipeline/${ImagePipelineName}	aws:ResourceTag/${TagKey}
imageRecipe	arn:${Partition}:imagebuilder:${Region}:${Account}:image-recipe/${ImageRecipeName}/${ImageRecipeVersion}	aws:ResourceTag/${TagKey}
imageVersion	arn:${Partition}:imagebuilder:${Region}:${Account}:image/${ImageName}/${ImageVersion}	aws:ResourceTag/${TagKey}
infrastructureConfiguration	arn:${Partition}:imagebuilder:${Region}:${Account}:infrastructure-configuration/${ResourceId}	aws:ResourceTag/${TagKey}
lifecycleExecution	arn:${Partition}:imagebuilder:${Region}:${Account}:lifecycle-execution/${LifecycleExecutionId}
lifecyclePolicy	arn:${Partition}:imagebuilder:${Region}:${Account}:lifecycle-policy/${LifecyclePolicyName}	aws:ResourceTag/${TagKey}
workflow	arn:${Partition}:imagebuilder:${Region}:${Account}:workflow/${WorkflowType}/${WorkflowName}/${WorkflowVersion}/${WorkflowBuildVersion}	aws:ResourceTag/${TagKey}
workflowExecution	arn:${Partition}:imagebuilder:${Region}:${Account}:workflow-execution/${WorkflowExecutionId}
workflowStepExecution	arn:${Partition}:imagebuilder:${Region}:${Account}:workflow-step-execution/${WorkflowStepExecutionId}

Condition keys for Amazon EC2 Image Builder

Amazon EC2 Image Builder defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString
imagebuilder:CreatedResourceTag/${TagKey}	Filters access by the tag key-value pairs attached to the resource created by Image Builder	String
imagebuilder:CreatedResourceTagKeys	Filters access by the presence of tag keys in the request	ArrayOfString
imagebuilder:Ec2MetadataHttpTokens	Filters access by the EC2 Instance Metadata HTTP Token Requirement specified in the request	String
imagebuilder:LifecyclePolicyResourceType	Filters access by the Lifecycle Policy Resource Type specified in the request	String
imagebuilder:StatusTopicArn	Filters access by the SNS Topic Arn in the request to which terminal state notifications will be published	ARN

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon EC2 Auto Scaling (autoscaling)

Amazon EC2 Instance Connect (ec2-instance-connect)