Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon IoT

Amazon IoT (service prefix: iot) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

API operations defined by Amazon IoT

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	SDK client	IAM action	Condition key	Possible value(s)	Access level
AcceptCertificateTransfer	iot	iot:AcceptCertificateTransfer			Write
AddThingToBillingGroup	iot	iot:AddThingToBillingGroup			Write
AddThingToThingGroup	iot	iot:AddThingToThingGroup			Write
AssociateSbomWithPackageVersion	iot	iot:AssociateSbomWithPackageVersion			Write
AssociateTargetsWithJob	iot	iot:AssociateTargetsWithJob			Write
AttachPolicy	iot	iot:AttachPolicy			Permissions management, Write
AttachPrincipalPolicy	iot	iot:AttachPrincipalPolicy			Permissions management, Write
AttachSecurityProfile	iot	iot:AttachSecurityProfile			Write
AttachThingPrincipal	iot	iot:AttachThingPrincipal			Write
CancelAuditMitigationActionsTask	iot	iot:CancelAuditMitigationActionsTask			Write
CancelAuditTask	iot	iot:CancelAuditTask			Write
CancelCertificateTransfer	iot	iot:CancelCertificateTransfer			Write
CancelDetectMitigationActionsTask	iot	iot:CancelDetectMitigationActionsTask			Write
CancelJob	iot	iot:CancelJob			Write
CancelJobExecution	iot	iot:CancelJobExecution			Write
ClearDefaultAuthorizer	iot	iot:ClearDefaultAuthorizer			Write
CreateAuditSuppression	iot	iot:CreateAuditSuppression			Write
CreateAuthorizer	iot	iot:CreateAuthorizer			Write
CreateAuthorizer	iot	iot:TagResource			Tagging, Write
CreateBillingGroup	iot	iot:CreateBillingGroup			Write
CreateBillingGroup	iot	iot:TagResource			Tagging, Write
CreateCertificateFromCsr	iot	iot:CreateCertificateFromCsr			Write
CreateCertificateProvider	iot	iot:CreateCertificateProvider			Write
CreateCertificateProvider	iot	iot:TagResource			Tagging, Write
CreateCommand	iot	iot:CreateCommand			Write
		iot:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
CreateCustomMetric	iot	iot:CreateCustomMetric			Write
CreateCustomMetric	iot	iot:TagResource			Tagging, Write
CreateDimension	iot	iot:CreateDimension			Write
CreateDimension	iot	iot:TagResource			Tagging, Write
CreateDomainConfiguration	iot	iot:CreateDomainConfiguration			Write
CreateDomainConfiguration	iot	iot:TagResource			Tagging, Write
CreateDynamicThingGroup	iot	iot:CreateDynamicThingGroup			Write
CreateDynamicThingGroup	iot	iot:TagResource			Tagging, Write
CreateFleetMetric	iot	iot:CreateFleetMetric			Write
CreateFleetMetric	iot	iot:TagResource			Tagging, Write
CreateJob	iot	iot:CreateJob			Write
		iot:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
CreateJobTemplate	iot	iot:CreateJobTemplate			Write
		iot:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
CreateKeysAndCertificate	iot	iot:CreateKeysAndCertificate			Write
CreateMitigationAction	iot	iot:CreateMitigationAction			Write
		iot:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
CreateOTAUpdate	iot	iot:CreateOTAUpdate			Write
		iot:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
CreatePackage	iot	iot:CreatePackage			Write
CreatePackage	iot	iot:TagResource			Tagging, Write
CreatePackageVersion	iot	iot:CreatePackageVersion			Write
CreatePackageVersion	iot	iot:TagResource			Tagging, Write
CreatePolicy	iot	iot:CreatePolicy			Permissions management, Write
CreatePolicy	iot	iot:TagResource			Tagging, Write
CreatePolicyVersion	iot	iot:CreatePolicyVersion			Permissions management, Write
CreateProvisioningClaim	iot	iot:CreateProvisioningClaim			Write
CreateProvisioningTemplate	iot	iot:CreateProvisioningTemplate			Write
		iot:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
CreateProvisioningTemplateVersion	iot	iot:CreateProvisioningTemplateVersion			Write
CreateRoleAlias	iot	iot:CreateRoleAlias			Write
		iot:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
CreateScheduledAudit	iot	iot:CreateScheduledAudit			Write
CreateScheduledAudit	iot	iot:TagResource			Tagging, Write
CreateSecurityProfile	iot	iot:CreateSecurityProfile			Write
		iot:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
CreateStream	iot	iot:CreateStream			Write
		iot:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
CreateThing	iot	iot:CreateThing			Write
CreateThingGroup	iot	iot:CreateThingGroup			Write
CreateThingGroup	iot	iot:TagResource			Tagging, Write
CreateThingType	iot	iot:CreateThingType			Write
CreateThingType	iot	iot:TagResource			Tagging, Write
CreateTopicRule	iot	iot:CreateTopicRule			Write
		iot:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
CreateTopicRuleDestination	iot	iot:CreateTopicRuleDestination			Write
CreateTopicRuleDestination	iot	iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
DeleteAccountAuditConfiguration	iot	iot:DeleteAccountAuditConfiguration			Write
DeleteAuditSuppression	iot	iot:DeleteAuditSuppression			Write
DeleteAuthorizer	iot	iot:DeleteAuthorizer			Write
DeleteBillingGroup	iot	iot:DeleteBillingGroup			Write
DeleteCACertificate	iot	iot:DeleteCACertificate			Write
DeleteCertificate	iot	iot:DeleteCertificate			Write
DeleteCertificateProvider	iot	iot:DeleteCertificateProvider			Write
DeleteCommand	iot	iot:DeleteCommand			Write
DeleteCommandExecution	iot	iot:DeleteCommandExecution			Write
DeleteCustomMetric	iot	iot:DeleteCustomMetric			Write
DeleteDimension	iot	iot:DeleteDimension			Write
DeleteDomainConfiguration	iot	iot:DeleteDomainConfiguration			Write
DeleteDynamicThingGroup	iot	iot:DeleteDynamicThingGroup			Write
DeleteFleetMetric	iot	iot:DeleteFleetMetric			Write
DeleteJob	iot	iot:DeleteJob			Write
DeleteJobExecution	iot	iot:DeleteJobExecution			Write
DeleteJobTemplate	iot	iot:DeleteJobTemplate			Write
DeleteMitigationAction	iot	iot:DeleteMitigationAction			Write
DeleteOTAUpdate	iot	iot:DeleteOTAUpdate			Write
DeletePackage	iot	iot:DeletePackage			Write
DeletePackageVersion	iot	iot:DeletePackageVersion			Write
DeletePolicy	iot	iot:DeletePolicy			Permissions management, Write
DeletePolicyVersion	iot	iot:DeletePolicyVersion			Permissions management, Write
DeleteProvisioningTemplate	iot	iot:DeleteProvisioningTemplate			Write
DeleteProvisioningTemplateVersion	iot	iot:DeleteProvisioningTemplateVersion			Write
DeleteRegistrationCode	iot	iot:DeleteRegistrationCode			Write
DeleteRoleAlias	iot	iot:DeleteRoleAlias			Write
DeleteScheduledAudit	iot	iot:DeleteScheduledAudit			Write
DeleteSecurityProfile	iot	iot:DeleteSecurityProfile			Write
DeleteStream	iot	iot:DeleteStream			Write
DeleteThing	iot	iot:DeleteThing			Write
DeleteThingGroup	iot	iot:DeleteThingGroup			Write
DeleteThingType	iot	iot:DeleteThingType			Write
DeleteTopicRule	iot	iot:DeleteTopicRule			Write
DeleteTopicRuleDestination	iot	iot:DeleteTopicRuleDestination			Write
DeleteV2LoggingLevel	iot	iot:DeleteV2LoggingLevel			Write
DeprecateThingType	iot	iot:DeprecateThingType			Write
DescribeAccountAuditConfiguration	iot	iot:DescribeAccountAuditConfiguration			Read
DescribeAuditFinding	iot	iot:DescribeAuditFinding			Read
DescribeAuditMitigationActionsTask	iot	iot:DescribeAuditMitigationActionsTask			Read
DescribeAuditSuppression	iot	iot:DescribeAuditSuppression			Read
DescribeAuditTask	iot	iot:DescribeAuditTask			Read
DescribeAuthorizer	iot	iot:DescribeAuthorizer			Read
DescribeBillingGroup	iot	iot:DescribeBillingGroup			Read
DescribeCACertificate	iot	iot:DescribeCACertificate			Read
DescribeCertificate	iot	iot:DescribeCertificate			Read
DescribeCertificateProvider	iot	iot:DescribeCertificateProvider			Read
DescribeCustomMetric	iot	iot:DescribeCustomMetric			Read
DescribeDefaultAuthorizer	iot	iot:DescribeDefaultAuthorizer			Read
DescribeDetectMitigationActionsTask	iot	iot:DescribeDetectMitigationActionsTask			Read
DescribeDimension	iot	iot:DescribeDimension			Read
DescribeDomainConfiguration	iot	iot:DescribeDomainConfiguration			Read
DescribeEncryptionConfiguration	iot	iot:DescribeEncryptionConfiguration			Read
DescribeEndpoint	iot	iot:DescribeEndpoint			Read
DescribeEventConfigurations	iot	iot:DescribeEventConfigurations			Read
DescribeFleetMetric	iot	iot:DescribeFleetMetric			Read
DescribeIndex	iot	iot:DescribeIndex			Read
DescribeJob	iot	iot:DescribeJob			Read
DescribeJobExecution	iot	iot:DescribeJobExecution			Read
DescribeJobTemplate	iot	iot:DescribeJobTemplate			Read
DescribeManagedJobTemplate	iot	iot:DescribeManagedJobTemplate			Read
DescribeMitigationAction	iot	iot:DescribeMitigationAction			Read
DescribeProvisioningTemplate	iot	iot:DescribeProvisioningTemplate			Read
DescribeProvisioningTemplateVersion	iot	iot:DescribeProvisioningTemplateVersion			Read
DescribeRoleAlias	iot	iot:DescribeRoleAlias			Read
DescribeScheduledAudit	iot	iot:DescribeScheduledAudit			Read
DescribeSecurityProfile	iot	iot:DescribeSecurityProfile			Read
DescribeStream	iot	iot:DescribeStream			Read
DescribeThing	iot	iot:DescribeThing			Read
DescribeThingGroup	iot	iot:DescribeThingGroup			Read
DescribeThingRegistrationTask	iot	iot:DescribeThingRegistrationTask			Read
DescribeThingType	iot	iot:DescribeThingType			Read
DetachPolicy	iot	iot:DetachPolicy			Permissions management, Write
DetachPrincipalPolicy	iot	iot:DetachPrincipalPolicy			Permissions management, Write
DetachSecurityProfile	iot	iot:DetachSecurityProfile			Write
DetachThingPrincipal	iot	iot:DetachThingPrincipal			Write
DisableTopicRule	iot	iot:DisableTopicRule			Write
DisassociateSbomFromPackageVersion	iot	iot:DisassociateSbomFromPackageVersion			Write
EnableTopicRule	iot	iot:EnableTopicRule			Write
GetBehaviorModelTrainingSummaries	iot	iot:GetBehaviorModelTrainingSummaries			List
GetBucketsAggregation	iot	iot:GetBucketsAggregation			Read
GetCardinality	iot	iot:GetCardinality			Read
GetCommand	iot	iot:GetCommand			Read
GetCommandExecution	iot	iot:GetCommandExecution			Read
GetEffectivePolicies	iot	iot:GetEffectivePolicies			Read
GetIndexingConfiguration	iot	iot:GetIndexingConfiguration			Read
GetJobDocument	iot	iot:GetJobDocument			Read
GetLoggingOptions	iot	iot:GetLoggingOptions			Read
GetOTAUpdate	iot	iot:GetOTAUpdate			Read
GetPackage	iot	iot:GetPackage			Read
GetPackageConfiguration	iot	iot:GetPackageConfiguration			Read
GetPackageVersion	iot	iot:GetPackageVersion			Read
GetPercentiles	iot	iot:GetPercentiles			Read
GetPolicy	iot	iot:GetPolicy			Read
GetPolicyVersion	iot	iot:GetPolicyVersion			Read
GetRegistrationCode	iot	iot:GetRegistrationCode			Read
GetStatistics	iot	iot:GetStatistics			Read
GetThingConnectivityData	iot	iot:GetThingConnectivityData			Read
GetTopicRule	iot	iot:GetTopicRule			Read
GetTopicRuleDestination	iot	iot:GetTopicRuleDestination			Read
GetV2LoggingOptions	iot	iot:GetV2LoggingOptions			Read
ListActiveViolations	iot	iot:ListActiveViolations			List
ListAttachedPolicies	iot	iot:ListAttachedPolicies			List
ListAuditFindings	iot	iot:ListAuditFindings			List
ListAuditMitigationActionsExecutions	iot	iot:ListAuditMitigationActionsExecutions			List
ListAuditMitigationActionsTasks	iot	iot:ListAuditMitigationActionsTasks			List
ListAuditSuppressions	iot	iot:ListAuditSuppressions			List
ListAuditTasks	iot	iot:ListAuditTasks			List
ListAuthorizers	iot	iot:ListAuthorizers			List
ListBillingGroups	iot	iot:ListBillingGroups			List
ListCACertificates	iot	iot:ListCACertificates			List
ListCertificateProviders	iot	iot:ListCertificateProviders			List
ListCertificates	iot	iot:ListCertificates			List
ListCertificatesByCA	iot	iot:ListCertificatesByCA			List
ListCommandExecutions	iot	iot:ListCommandExecutions			List
ListCommands	iot	iot:ListCommands			List
ListCustomMetrics	iot	iot:ListCustomMetrics			List
ListDetectMitigationActionsExecutions	iot	iot:ListDetectMitigationActionsExecutions			List
ListDetectMitigationActionsTasks	iot	iot:ListDetectMitigationActionsTasks			List
ListDimensions	iot	iot:ListDimensions			List
ListDomainConfigurations	iot	iot:ListDomainConfigurations			List
ListFleetMetrics	iot	iot:ListFleetMetrics			List
ListIndices	iot	iot:ListIndices			List
ListJobExecutionsForJob	iot	iot:ListJobExecutionsForJob			List
ListJobExecutionsForThing	iot	iot:ListJobExecutionsForThing			List
ListJobTemplates	iot	iot:ListJobTemplates			List
ListJobs	iot	iot:ListJobs			List
ListManagedJobTemplates	iot	iot:ListManagedJobTemplates			List
ListMetricValues	iot	iot:ListMetricValues			List
ListMitigationActions	iot	iot:ListMitigationActions			List
ListOTAUpdates	iot	iot:ListOTAUpdates			List
ListOutgoingCertificates	iot	iot:ListOutgoingCertificates			List
ListPackageVersions	iot	iot:ListPackageVersions			List
ListPackages	iot	iot:ListPackages			List
ListPolicies	iot	iot:ListPolicies			List
ListPolicyPrincipals	iot	iot:ListPolicyPrincipals			List
ListPolicyVersions	iot	iot:ListPolicyVersions			List
ListPrincipalPolicies	iot	iot:ListPrincipalPolicies			List
ListPrincipalThings	iot	iot:ListPrincipalThings			List
ListPrincipalThingsV2	iot	iot:ListPrincipalThingsV2			List
ListProvisioningTemplateVersions	iot	iot:ListProvisioningTemplateVersions			List
ListProvisioningTemplates	iot	iot:ListProvisioningTemplates			List
ListRelatedResourcesForAuditFinding	iot	iot:ListRelatedResourcesForAuditFinding			List
ListRoleAliases	iot	iot:ListRoleAliases			List
ListSbomValidationResults	iot	iot:ListSbomValidationResults			List
ListScheduledAudits	iot	iot:ListScheduledAudits			List
ListSecurityProfiles	iot	iot:ListSecurityProfiles			List
ListSecurityProfilesForTarget	iot	iot:ListSecurityProfilesForTarget			List
ListStreams	iot	iot:ListStreams			List
ListTagsForResource	iot	iot:ListTagsForResource			Read
ListTargetsForPolicy	iot	iot:ListTargetsForPolicy			List
ListTargetsForSecurityProfile	iot	iot:ListTargetsForSecurityProfile			List
ListThingGroups	iot	iot:ListThingGroups			List
ListThingGroupsForThing	iot	iot:ListThingGroupsForThing			List
ListThingPrincipals	iot	iot:ListThingPrincipals			List
ListThingPrincipalsV2	iot	iot:ListThingPrincipalsV2			List
ListThingRegistrationTaskReports	iot	iot:ListThingRegistrationTaskReports			List
ListThingRegistrationTasks	iot	iot:ListThingRegistrationTasks			List
ListThingTypes	iot	iot:ListThingTypes			List
ListThings	iot	iot:ListThings			List
ListThingsInBillingGroup	iot	iot:ListThingsInBillingGroup			List
ListThingsInThingGroup	iot	iot:ListThingsInThingGroup			List
ListTopicRuleDestinations	iot	iot:ListTopicRuleDestinations			List
ListTopicRules	iot	iot:ListTopicRules			List
ListV2LoggingLevels	iot	iot:ListV2LoggingLevels			List
ListViolationEvents	iot	iot:ListViolationEvents			List
PutVerificationStateOnViolation	iot	iot:PutVerificationStateOnViolation			Write
RegisterCACertificate	iot	iot:RegisterCACertificate			Write
		iot:TagResource			Tagging, Write
		iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
RegisterCertificate	iot	iot:RegisterCertificate			Write
RegisterCertificateWithoutCA	iot	iot:RegisterCertificateWithoutCA			Write
RegisterThing	iot	iot:RegisterThing			Write
RejectCertificateTransfer	iot	iot:RejectCertificateTransfer			Write
RemoveThingFromBillingGroup	iot	iot:RemoveThingFromBillingGroup			Write
RemoveThingFromThingGroup	iot	iot:RemoveThingFromThingGroup			Write
ReplaceTopicRule	iot	iot:ReplaceTopicRule			Write
ReplaceTopicRule	iot	iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
SearchIndex	iot	iot:SearchIndex			Read
SetDefaultAuthorizer	iot	iot:SetDefaultAuthorizer			Permissions management, Write
SetDefaultPolicyVersion	iot	iot:SetDefaultPolicyVersion			Permissions management, Write
SetLoggingOptions	iot	iot:SetLoggingOptions			Write
SetLoggingOptions	iot	iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
SetV2LoggingLevel	iot	iot:SetV2LoggingLevel			Write
SetV2LoggingOptions	iot	iot:SetV2LoggingOptions			Write
SetV2LoggingOptions	iot	iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
StartAuditMitigationActionsTask	iot	iot:StartAuditMitigationActionsTask			Write
StartDetectMitigationActionsTask	iot	iot:StartDetectMitigationActionsTask			Write
StartOnDemandAuditTask	iot	iot:StartOnDemandAuditTask			Write
StartThingRegistrationTask	iot	iot:StartThingRegistrationTask			Write
StartThingRegistrationTask	iot	iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
StopThingRegistrationTask	iot	iot:StopThingRegistrationTask			Write
TagResource	iot	iot:TagResource			Tagging, Write
TestAuthorization	iot	iot:TestAuthorization			Read
TestInvokeAuthorizer	iot	iot:TestInvokeAuthorizer			Read
TransferCertificate	iot	iot:TransferCertificate			Write
UntagResource	iot	iot:UntagResource			Tagging, Write
UpdateAccountAuditConfiguration	iot	iot:UpdateAccountAuditConfiguration			Write
UpdateAccountAuditConfiguration	iot	iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
UpdateAuditSuppression	iot	iot:UpdateAuditSuppression			Write
UpdateAuthorizer	iot	iot:UpdateAuthorizer			Write
UpdateBillingGroup	iot	iot:UpdateBillingGroup			Write
UpdateCACertificate	iot	iot:UpdateCACertificate			Write
UpdateCACertificate	iot	iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
UpdateCertificate	iot	iot:UpdateCertificate			Write
UpdateCertificateProvider	iot	iot:UpdateCertificateProvider			Write
UpdateCommand	iot	iot:UpdateCommand			Write
UpdateCustomMetric	iot	iot:UpdateCustomMetric			Write
UpdateDimension	iot	iot:UpdateDimension			Write
UpdateDomainConfiguration	iot	iot:UpdateDomainConfiguration			Write
UpdateDynamicThingGroup	iot	iot:UpdateDynamicThingGroup			Write
UpdateEncryptionConfiguration	iot	iot:UpdateEncryptionConfiguration			Write
UpdateEncryptionConfiguration	iot	iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
UpdateEventConfigurations	iot	iot:UpdateEventConfigurations			Write
UpdateFleetMetric	iot	iot:UpdateFleetMetric			Write
UpdateIndexingConfiguration	iot	iot:UpdateIndexingConfiguration			Write
UpdateJob	iot	iot:UpdateJob			Write
UpdateJob	iot	iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
UpdateMitigationAction	iot	iot:UpdateMitigationAction			Write
UpdateMitigationAction	iot	iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
UpdatePackage	iot	iot:UpdatePackage			Write
UpdatePackageConfiguration	iot	iot:UpdatePackageConfiguration			Write
UpdatePackageConfiguration	iot	iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
UpdatePackageVersion	iot	iot:UpdatePackageVersion			Write
UpdateProvisioningTemplate	iot	iot:UpdateProvisioningTemplate			Write
UpdateProvisioningTemplate	iot	iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
UpdateRoleAlias	iot	iot:UpdateRoleAlias			Write
UpdateRoleAlias	iot	iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
UpdateScheduledAudit	iot	iot:UpdateScheduledAudit			Write
UpdateSecurityProfile	iot	iot:UpdateSecurityProfile			Write
UpdateSecurityProfile	iot	iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
UpdateStream	iot	iot:UpdateStream			Write
UpdateStream	iot	iam:PassRole	iam:PassedToService	iot.amazonaws.com	Write
UpdateThing	iot	iot:UpdateThing			Write
UpdateThingGroup	iot	iot:UpdateThingGroup			Write
UpdateThingGroupsForThing	iot	iot:UpdateThingGroupsForThing			Write
UpdateThingType	iot	iot:UpdateThingType			Write
UpdateTopicRuleDestination	iot	iot:UpdateTopicRuleDestination			Write
ValidateSecurityProfileBehaviors	iot	iot:ValidateSecurityProfileBehaviors			Read
CloseTunnel	iotsecuretunneling	iot:CloseTunnel			Write
DescribeTunnel	iotsecuretunneling	iot:DescribeTunnel			Read
ListTagsForResource	iotsecuretunneling	iot:ListTagsForResource			Read
ListTunnels	iotsecuretunneling	iot:ListTunnels			List
OpenTunnel	iotsecuretunneling	iot:OpenTunnel			Write
RotateTunnelAccessToken	iotsecuretunneling	iot:RotateTunnelAccessToken			Write
TagResource	iotsecuretunneling	iot:TagResource			Tagging, Write
UntagResource	iotsecuretunneling	iot:UntagResource			Tagging, Write

Actions defined by Amazon IoT

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptCertificateTransfer	Grants permission to accept a pending certificate transfer	cert*		Write
AddThingToBillingGroup	Grants permission to add a thing to the specified billing group	billinggroup*	aws:ResourceTag/${TagKey}	Write
AddThingToBillingGroup		thing*		Write
AddThingToThingGroup	Grants permission to add a thing to the specified thing group	thing*		Write
AddThingToThingGroup		thinggroup*	aws:ResourceTag/${TagKey}	Write
AssociateSbomWithPackageVersion	Grants permission to associate SBOM files to a package version	packageversion*	aws:ResourceTag/${TagKey}	Write
AssociateTargetsWithJob	Grants permission to associate a group with a continuous job	job*	aws:ResourceTag/${TagKey}	Write
		thing*
		thinggroup*	aws:ResourceTag/${TagKey}
AttachPolicy	Grants permission to attach a policy to the specified target	cert		Permissions management, Write
AttachPolicy		thinggroup	aws:ResourceTag/${TagKey}	Permissions management, Write
AttachPrincipalPolicy	Grants permission to attach the specified policy to the specified principal (certificate or other credential)	cert		Permissions management, Write
AttachSecurityProfile	Grants permission to associate a Device Defender security profile with a thing group or with this account	custommetric	aws:ResourceTag/${TagKey}	Write
		dimension	aws:ResourceTag/${TagKey}
		securityprofile*	aws:ResourceTag/${TagKey}
		thinggroup	aws:ResourceTag/${TagKey}
AttachThingPrincipal	Grants permission to attach the specified principal to the specified thing	cert	iot:thingArn	Write
CancelAuditMitigationActionsTask	Grants permission to cancel a mitigation action task that is in progress			Write
CancelAuditTask	Grants permission to cancel an audit that is in progress. The audit can be either scheduled or on-demand			Write
CancelCertificateTransfer	Grants permission to cancel a pending transfer for the specified certificate	cert*		Write
CancelDetectMitigationActionsTask	Grants permission to cancel a Device Defender ML Detect mitigation action			Write
CancelJob	Grants permission to cancel a job	job*	aws:ResourceTag/${TagKey}	Write
CancelJobExecution	Grants permission to cancel a job execution on a particular device	job*	aws:ResourceTag/${TagKey}	Write
CancelJobExecution		thing*		Write
ClearDefaultAuthorizer	Grants permission to clear the default authorizer			Write
CloseTunnel	Grants permission to close a tunnel	tunnel*	aws:ResourceTag/${TagKey} iot:Delete	Write
ConfirmTopicRuleDestination	Grants permission to confirm a http url TopicRuleDestinationDestination	destination*		Write
Connect	Grants permission to connect as the specified client	client*		Write
CreateAuditSuppression	Grants permission to create a Device Defender audit suppression			Write
CreateAuthorizer	Grants permission to create an authorizer	authorizer*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateBillingGroup	Grants permission to create a billing group	billinggroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCertificateFromCsr	Grants permission to create an X.509 certificate using the specified certificate signing request			Write
CreateCertificateProvider	Grants permission to create a certificate provider	certificateprovider*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCommand	Grants permission to create a command that can be used to start new executions against a device	command*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCustomMetric	Grants permission to create a custom metric for device side metric reporting and monitoring	custommetric*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDimension	Grants permission to define a dimension that can be used to to limit the scope of a metric used in a security profile	dimension*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateDomainConfiguration	Grants permission to create a domain configuration	domainconfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys iot:DomainName	Write
CreateDynamicThingGroup	Grants permission to create a Dynamic Thing Group	dynamicthinggroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFleetMetric	Grants permission to create a fleet metric	fleetmetric*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFleetMetric	Grants permission to create a fleet metric	index*	aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateJob	Grants permission to create a job	job*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		jobtemplate	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		package	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		packageversion	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		thing*	aws:RequestTag/${TagKey} aws:TagKeys
		thinggroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateJobTemplate	Grants permission to create a job template	job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		jobtemplate*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		package	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		packageversion	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateKeysAndCertificate	Grants permission to create a 2048 bit RSA key pair and issues an X.509 certificate using the issued public key			Write
CreateMitigationAction	Grants permission to define an action that can be applied to audit findings by using StartAuditMitigationActionsTask	mitigationaction*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateOTAUpdate	Grants permission to create an OTA update job	otaupdate*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePackage	Grants permission to create a software package that you can deploy to your devices	package*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePackageVersion	Grants permission to create a version under the specified package	package*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePackageVersion		packageversion*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreatePolicy	Grants permission to create an Amazon IoT policy	policy*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Permissions management, Write
CreatePolicyVersion	Grants permission to create a new version of the specified Amazon IoT policy	policy*	aws:ResourceTag/${TagKey}	Permissions management, Write
CreateProvisioningClaim	Grants permission to create a provisioning claim	provisioningtemplate*	aws:ResourceTag/${TagKey}	Write
CreateProvisioningTemplate	Grants permission to create a fleet provisioning template	provisioningtemplate*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateProvisioningTemplateVersion	Grants permission to create a new version of a fleet provisioning template	provisioningtemplate*	aws:ResourceTag/${TagKey}	Write
CreateRoleAlias	Grants permission to create a role alias	rolealias*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateScheduledAudit	Grants permission to create a scheduled audit that is run at a specified time interval	scheduledaudit*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSecurityProfile	Grants permission to create a Device Defender security profile	custommetric	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		dimension	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		securityprofile*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateStream	Grants permission to create a new Amazon IoT stream	stream*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateThing	Grants permission to create a thing in the thing registry	billinggroup	aws:ResourceTag/${TagKey}	Write
CreateThing	Grants permission to create a thing in the thing registry	thing*		Write
CreateThingGroup	Grants permission to create a thing group	thinggroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateThingType	Grants permission to create a new thing type	thingtype*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTopicRule	Grants permission to create a rule	rule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTopicRuleDestination	Grants permission to create a TopicRuleDestination			Write
DeleteAccountAuditConfiguration	Grants permission to delete the audit configuration associated with the account			Write
DeleteAuditSuppression	Grants permission to delete a Device Defender audit suppression			Write
DeleteAuthorizer	Grants permission to delete the specified authorizer	authorizer*	aws:ResourceTag/${TagKey}	Write
DeleteBillingGroup	Grants permission to delete the specified billing group	billinggroup*	aws:ResourceTag/${TagKey}	Write
DeleteCACertificate	Grants permission to delete a registered CA certificate	cacert*	aws:ResourceTag/${TagKey}	Write
DeleteCertificate	Grants permission to delete the specified certificate	cert*		Write
DeleteCertificateProvider	Grants permission to delete a certificate provider	certificateprovider*	aws:ResourceTag/${TagKey}	Write
DeleteCommand	Grants permission to delete a command	command*	aws:ResourceTag/${TagKey}	Write
DeleteCommandExecution	Grants permission to delete a command execution	client		Write
DeleteCommandExecution	Grants permission to delete a command execution	thing		Write
DeleteConnection	Grants permission to disconnect the specified connection	client*		Write
DeleteCustomMetric	Grants permission to deletes the specified custom metric from your Amazon Web Services account	custommetric*	aws:ResourceTag/${TagKey}	Write
DeleteDimension	Grants permission to remove the specified dimension from your Amazon Web Services account	dimension*	aws:ResourceTag/${TagKey}	Write
DeleteDomainConfiguration	Grants permission to delete a domain configuration	domainconfiguration*	aws:ResourceTag/${TagKey}	Write
DeleteDynamicThingGroup	Grants permission to delete the specified Dynamic Thing Group	dynamicthinggroup*	aws:ResourceTag/${TagKey}	Write
DeleteFleetMetric	Grants permission to delete the specified fleet metric	fleetmetric*	aws:ResourceTag/${TagKey}	Write
DeleteJob	Grants permission to delete a job and its related job executions	job*	aws:ResourceTag/${TagKey}	Write
DeleteJobExecution	Grants permission to delete a job execution	job*	aws:ResourceTag/${TagKey}	Write
DeleteJobExecution	Grants permission to delete a job execution	thing*		Write
DeleteJobTemplate	Grants permission to delete a job template	jobtemplate*	aws:ResourceTag/${TagKey}	Write
DeleteMitigationAction	Grants permission to delete a defined mitigation action from your Amazon Web Services account	mitigationaction*	aws:ResourceTag/${TagKey}	Write
DeleteOTAUpdate	Grants permission to delete an OTA update job	otaupdate*	aws:ResourceTag/${TagKey}	Write
DeletePackage	Grants permission to delete a package	package*	aws:ResourceTag/${TagKey}	Write
DeletePackageVersion	Grants permission to delete a version of the specified package	package*	aws:ResourceTag/${TagKey}	Write
DeletePackageVersion		packageversion*	aws:ResourceTag/${TagKey}	Write
DeletePolicy	Grants permission to delete the specified policy	policy*	aws:ResourceTag/${TagKey}	Permissions management, Write
DeletePolicyVersion	Grants permission to Delete the specified version of the specified policy	policy*	aws:ResourceTag/${TagKey}	Permissions management, Write
DeleteProvisioningTemplate	Grants permission to delete a fleet provisioning template	provisioningtemplate*	aws:ResourceTag/${TagKey}	Write
DeleteProvisioningTemplateVersion	Grants permission to delete a fleet provisioning template version	provisioningtemplate*	aws:ResourceTag/${TagKey}	Write
DeleteRegistrationCode	Grants permission to delete a CA certificate registration code			Write
DeleteRoleAlias	Grants permission to delete the specified role alias	rolealias*	aws:ResourceTag/${TagKey}	Write
DeleteScheduledAudit	Grants permission to delete a scheduled audit	scheduledaudit*	aws:ResourceTag/${TagKey}	Write
DeleteSecurityProfile	Grants permission to delete a Device Defender security profile	custommetric	aws:ResourceTag/${TagKey}	Write
		dimension	aws:ResourceTag/${TagKey}
		securityprofile*	aws:ResourceTag/${TagKey}
DeleteStream	Grants permission to delete a specified stream	stream*	aws:ResourceTag/${TagKey}	Write
DeleteThing	Grants permission to delete the specified thing	thing*		Write
DeleteThingGroup	Grants permission to delete the specified thing group	thinggroup*	aws:ResourceTag/${TagKey}	Write
DeleteThingShadow	Grants permission to delete the specified thing shadow	thing*		Write
DeleteThingType	Grants permission to delete the specified thing type	thingtype*	aws:ResourceTag/${TagKey}	Write
DeleteTopicRule	Grants permission to delete the specified rule	rule*	aws:ResourceTag/${TagKey}	Write
DeleteTopicRuleDestination	Grants permission to delete a TopicRuleDestination	destination*		Write
DeleteV2LoggingLevel	Grants permission to delete the specified v2 logging level			Write
DeprecateThingType	Grants permission to deprecate the specified thing type	thingtype*	aws:ResourceTag/${TagKey}	Write
DescribeAccountAuditConfiguration	Grants permission to get information about audit configurations for the account			Read
DescribeAuditFinding	Grants permission to get information about a single audit finding. Properties include the reason for noncompliance, the severity of the issue, and when the audit that returned the finding was started			Read
DescribeAuditMitigationActionsTask	Grants permission to get information about an audit mitigation task that is used to apply mitigation actions to a set of audit findings			Read
DescribeAuditSuppression	Grants permission to get information about a Device Defender audit suppression			Read
DescribeAuditTask	Grants permission to get information about a Device Defender audit			Read
DescribeAuthorizer	Grants permission to describe an authorizer	authorizer*	aws:ResourceTag/${TagKey}	Read
DescribeBillingGroup	Grants permission to get information about the specified billing group	billinggroup*	aws:ResourceTag/${TagKey}	Read
DescribeCACertificate	Grants permission to describe a registered CA certificate	cacert*	aws:ResourceTag/${TagKey}	Read
DescribeCertificate	Grants permission to get information about the specified certificate	cert*		Read
DescribeCertificateProvider	Grants permission to describe a certificate provider	certificateprovider*	aws:ResourceTag/${TagKey}	Read
DescribeCustomMetric	Grants permission to describe a custom metric that is defined in your Amazon Web Services account	custommetric*	aws:ResourceTag/${TagKey}	Read
DescribeDefaultAuthorizer	Grants permission to describe the default authorizer			Read
DescribeDetectMitigationActionsTask	Grants permission to describe a Device Defender ML Detect mitigation action			Read
DescribeDimension	Grants permission to get details about a dimension that is defined in your Amazon Web Services account	dimension*	aws:ResourceTag/${TagKey}	Read
DescribeDomainConfiguration	Grants permission to get information about the domain configuration	domainconfiguration*	aws:ResourceTag/${TagKey}	Read
DescribeEncryptionConfiguration	Grants permission to describe the encryption configuration for the account			Read
DescribeEndpoint	Grants permission to get a unique endpoint specific to the Amazon Web Services account making the call			Read
DescribeEventConfigurations	Grants permission to get account event configurations			Read
DescribeFleetMetric	Grants permission to get information about the specified fleet metric	fleetmetric*	aws:ResourceTag/${TagKey}	Read
DescribeIndex	Grants permission to get information about the specified index	index*		Read
DescribeJob	Grants permission to describe a job	job*	aws:ResourceTag/${TagKey}	Read
DescribeJobExecution	Grants permission to describe a job execution	job	aws:ResourceTag/${TagKey}	Read
DescribeJobExecution	Grants permission to describe a job execution	thing		Read
DescribeJobTemplate	Grants permission to describe a job template	jobtemplate*	aws:ResourceTag/${TagKey}	Read
DescribeManagedJobTemplate	Grants permission to describe a managed job template	jobtemplate*	aws:ResourceTag/${TagKey}	Read
DescribeMitigationAction	Grants permission to get information about a mitigation action	mitigationaction*	aws:ResourceTag/${TagKey}	Read
DescribeProvisioningTemplate	Grants permission to get information about a fleet provisioning template	provisioningtemplate*	aws:ResourceTag/${TagKey}	Read
DescribeProvisioningTemplateVersion	Grants permission to get information about a fleet provisioning template version	provisioningtemplate*	aws:ResourceTag/${TagKey}	Read
DescribeRoleAlias	Grants permission to describe a role alias	rolealias*	aws:ResourceTag/${TagKey}	Read
DescribeScheduledAudit	Grants permission to get information about a scheduled audit	scheduledaudit*	aws:ResourceTag/${TagKey}	Read
DescribeSecurityProfile	Grants permission to get information about a Device Defender security profile	securityprofile*	aws:ResourceTag/${TagKey}	Read
DescribeStream	Grants permission to get information about the specified stream	stream*	aws:ResourceTag/${TagKey}	Read
DescribeThing	Grants permission to get information about the specified thing	thing*		Read
DescribeThingGroup	Grants permission to get information about the specified thing group	thinggroup*	aws:ResourceTag/${TagKey}	Read
DescribeThingRegistrationTask	Grants permission to get information about the bulk thing registration task			Read
DescribeThingType	Grants permission to get information about the specified thing type	thingtype*	aws:ResourceTag/${TagKey}	Read
DescribeTunnel	Grants permission to describe a tunnel	tunnel*	aws:ResourceTag/${TagKey}	Read
DetachPolicy	Grants permission to detach a policy from the specified target	cert		Permissions management, Write
DetachPolicy		thinggroup	aws:ResourceTag/${TagKey}	Permissions management, Write
DetachPrincipalPolicy	Grants permission to remove the specified policy from the specified certificate	cert		Permissions management, Write
DetachSecurityProfile	Grants permission to disassociate a Device Defender security profile from a thing group or from this account	custommetric	aws:ResourceTag/${TagKey}	Write
		dimension	aws:ResourceTag/${TagKey}
		securityprofile*	aws:ResourceTag/${TagKey}
		thinggroup	aws:ResourceTag/${TagKey}
DetachThingPrincipal	Grants permission to detach the specified principal from the specified thing	cert	iot:thingArn	Write
DisableTopicRule	Grants permission to disable the specified rule	rule*	aws:ResourceTag/${TagKey}	Write
DisassociateSbomFromPackageVersion	Grants permission to disassociate SBOM files from a package version	packageversion*	aws:ResourceTag/${TagKey}	Write
EnableTopicRule	Grants permission to enable the specified rule	rule*	aws:ResourceTag/${TagKey}	Write
GetBehaviorModelTrainingSummaries	Grants permission to fetch a Device Defender's ML Detect Security Profile training model's status	securityprofile	aws:ResourceTag/${TagKey}	List
GetBucketsAggregation	Grants permission to get buckets aggregation for IoT fleet index	index*		Read
GetCardinality	Grants permission to get cardinality for IoT fleet index	index*		Read
GetCommand	Grants permission to get the information about the command	command*	aws:ResourceTag/${TagKey}	Read
GetCommandExecution	Grants permission to get the information of a command execution	client		Read
GetCommandExecution		thing		Read
GetConnection	Grants permission to retrieve the specified connection information	client*	iot:IncludeSocketInformation	Write
GetEffectivePolicies	Grants permission to get effective policies	cert		Read
GetIndexingConfiguration	Grants permission to get current fleet indexing configuration			Read
GetJobDocument	Grants permission to get a job document	job*	aws:ResourceTag/${TagKey}	Read
GetLoggingOptions	Grants permission to get the logging options			Read
GetOTAUpdate	Grants permission to get the information about the OTA update job	otaupdate*	aws:ResourceTag/${TagKey}	Read
GetPackage	Grants permission to get the information about the package	package*	aws:ResourceTag/${TagKey}	Read
GetPackageConfiguration	Grants permission to get the package configuration of the account			Read
GetPackageVersion	Grants permission to get the version of the package	package*	aws:ResourceTag/${TagKey}	Read
GetPackageVersion	Grants permission to get the version of the package	packageversion*	aws:ResourceTag/${TagKey}	Read
GetPercentiles	Grants permission to get percentiles for IoT fleet index	index*		Read
GetPolicy	Grants permission to get information about the specified policy with the policy document of the default version	policy*	aws:ResourceTag/${TagKey}	Read
GetPolicyVersion	Grants permission to get information about the specified policy version	policy*	aws:ResourceTag/${TagKey}	Read
GetRegistrationCode	Grants permission to get a registration code used to register a CA certificate with Amazon IoT			Read
GetRetainedMessage	Grants permission to get the retained message on the specified topic	topic*		Read
GetStatistics	Grants permission to get statistics for IoT fleet index	index*		Read
GetThingConnectivityData	Grants permission to get the thing's connectivity data	thing*	iot:IncludeSocketInformation	Read
GetThingShadow	Grants permission to get the thing shadow	thing*		Read
GetTopicRule	Grants permission to get information about the specified rule	rule*	aws:ResourceTag/${TagKey}	Read
GetTopicRuleDestination	Grants permission to get a TopicRuleDestination	destination*		Read
GetV2LoggingOptions	Grants permission to get v2 logging options			Read
ListActiveViolations	Grants permission to list the active violations for a given Device Defender security profile or Thing	securityprofile	aws:ResourceTag/${TagKey}	List
ListActiveViolations		thing		List
ListAttachedPolicies	Grants permission to list the policies attached to the specified thing group			List
ListAuditFindings	Grants permission to list the findings (results) of a Device Defender audit or of the audits performed during a specified time period			List
ListAuditMitigationActionsExecutions	Grants permission to get the status of audit mitigation action tasks that were executed			List
ListAuditMitigationActionsTasks	Grants permission to get a list of audit mitigation action tasks that match the specified filters			List
ListAuditSuppressions	Grants permission to list your Device Defender audit suppressions			List
ListAuditTasks	Grants permission to list the Device Defender audits that have been performed during a given time period			List
ListAuthorizers	Grants permission to list the authorizers registered in your account			List
ListBillingGroups	Grants permission to list all billing groups			List
ListCACertificates	Grants permission to list the CA certificates registered for your Amazon Web Services account			List
ListCertificateProviders	Grants permission to list certificate providers in the account			List
ListCertificates	Grants permission to list your certificates			List
ListCertificatesByCA	Grants permission to list the device certificates signed by the specified CA certificate			List
ListCommandExecutions	Grants permission to list commands executions in the account	client		List
		command	aws:ResourceTag/${TagKey}
		thing
ListCommands	Grants permission to list commands in the account			List
ListCustomMetrics	Grants permission to list the custom metrics in your Amazon Web Services account			List
ListDetectMitigationActionsExecutions	Grants permission to lists mitigation actions executions for a Device Defender ML Detect Security Profile	thing		List
ListDetectMitigationActionsTasks	Grants permission to list Device Defender ML Detect mitigation actions tasks			List
ListDimensions	Grants permission to list the dimensions that are defined for your Amazon Web Services account			List
ListDomainConfigurations	Grants permission to list the domain configuration created by your Amazon Web Services account			List
ListFleetMetrics	Grants permission to list the fleet metrics in your account			List
ListIndices	Grants permission to list all indices for fleet index			List
ListJobExecutionsForJob	Grants permission to list the job executions for a job	job*	aws:ResourceTag/${TagKey}	List
ListJobExecutionsForThing	Grants permission to list the job executions for the specified thing	thing*		List
ListJobTemplates	Grants permission to list job templates			List
ListJobs	Grants permission to list jobs			List
ListManagedJobTemplates	Grants permission to list managed job templates			List
ListMetricValues	Grants permissions to list the metric values for a thing based on the metricName, and dimension if specified	thing*		List
ListMitigationActions	Grants permission to get a list of all mitigation actions that match the specified filter criteria			List
ListNamedShadowsForThing	Grants permission to list all named shadows for a given thing	thing*		List
ListOTAUpdates	Grants permission to list OTA update jobs in the account			List
ListOutgoingCertificates	Grants permission to list certificates that are being transfered but not yet accepted			List
ListPackageVersions	Grants permission to list versions for a package in the account			List
ListPackages	Grants permission to list packages in the account			List
ListPolicies	Grants permission to list your policies			List
ListPolicyPrincipals	Grants permission to list the principals associated with the specified policy			List
ListPolicyVersions	Grants permission to list the versions of the specified policy, and identifies the default version	policy*	aws:ResourceTag/${TagKey}	List
ListPrincipalPolicies	Grants permission to list the policies attached to the specified principal. If you use an Amazon Cognito identity, the ID needs to be in Amazon Cognito Identity format			List
ListPrincipalThings	Grants permission to list the things associated with the specified principal	cert		List
ListPrincipalThingsV2	Grants permission to list the things associated with the specified principal	cert		List
ListProvisioningTemplateVersions	Grants permission to get a list of fleet provisioning template versions	provisioningtemplate*	aws:ResourceTag/${TagKey}	List
ListProvisioningTemplates	Grants permission to list the fleet provisioning templates in your Amazon Web Services account			List
ListRelatedResourcesForAuditFinding	Grants permission to list related resources for a single audit finding			List
ListRetainedMessages	Grants permission to list the retained messages for your account			List
ListRoleAliases	Grants permission to list role aliases			List
ListSbomValidationResults	Grants permission to list SBOM validation results of a package version	packageversion*	aws:ResourceTag/${TagKey}	List
ListScheduledAudits	Grants permission to list all of your scheduled audits			List
ListSecurityProfiles	Grants permission to list the Device Defender security profiles you have created	custommetric	aws:ResourceTag/${TagKey}	List
ListSecurityProfiles		dimension	aws:ResourceTag/${TagKey}	List
ListSecurityProfilesForTarget	Grants permission to list the Device Defender security profiles attached to a target	thinggroup	aws:ResourceTag/${TagKey}	List
ListStreams	Grants permission to list the streams in your account			List
ListSubscriptions	Grants permission to retrieve the specified connection's subscriptions	client*		Write
ListTagsForResource	Grants permission to list all tags for a given resource	authorizer	aws:ResourceTag/${TagKey}	Read
		billinggroup	aws:ResourceTag/${TagKey}
		cacert	aws:ResourceTag/${TagKey}
		certificateprovider	aws:ResourceTag/${TagKey}
		command	aws:ResourceTag/${TagKey}
		custommetric	aws:ResourceTag/${TagKey}
		dimension	aws:ResourceTag/${TagKey}
		domainconfiguration	aws:ResourceTag/${TagKey}
		dynamicthinggroup	aws:ResourceTag/${TagKey}
		fleetmetric	aws:ResourceTag/${TagKey}
		job	aws:ResourceTag/${TagKey}
		jobtemplate	aws:ResourceTag/${TagKey}
		mitigationaction	aws:ResourceTag/${TagKey}
		otaupdate	aws:ResourceTag/${TagKey}
		policy	aws:ResourceTag/${TagKey}
		provisioningtemplate	aws:ResourceTag/${TagKey}
		rolealias	aws:ResourceTag/${TagKey}
		rule	aws:ResourceTag/${TagKey}
		scheduledaudit	aws:ResourceTag/${TagKey}
		securityprofile	aws:ResourceTag/${TagKey}
		stream	aws:ResourceTag/${TagKey}
		thinggroup	aws:ResourceTag/${TagKey}
		thingtype	aws:ResourceTag/${TagKey}
ListTargetsForPolicy	Grants permission to list targets for the specified policy	policy*	aws:ResourceTag/${TagKey}	List
ListTargetsForSecurityProfile	Grants permission to list the targets associated with a given Device Defender security profile	securityprofile*	aws:ResourceTag/${TagKey}	List
ListThingGroups	Grants permission to list all thing groups			List
ListThingGroupsForThing	Grants permission to list thing groups to which the specified thing belongs	thing*		List
ListThingPrincipals	Grants permission to list the principals associated with the specified thing	thing*		List
ListThingPrincipalsV2	Grants permission to list the principals associated with the specified thing	thing*		List
ListThingRegistrationTaskReports	Grants permission to list information about bulk thing registration tasks			List
ListThingRegistrationTasks	Grants permission to list bulk thing registration tasks			List
ListThingTypes	Grants permission to list all thing types			List
ListThings	Grants permission to list all things			List
ListThingsInBillingGroup	Grants permission to list all things in the specified billing group	billinggroup*	aws:ResourceTag/${TagKey}	List
ListThingsInThingGroup	Grants permission to list all things in the specified thing group	thinggroup*	aws:ResourceTag/${TagKey}	List
ListTopicRuleDestinations	Grants permission to list all TopicRuleDestinations			List
ListTopicRules	Grants permission to list the rules for the specific topic			List
ListTunnels	Grants permission to list tunnels			List
ListV2LoggingLevels	Grants permission to list the v2 logging levels			List
ListViolationEvents	Grants permission to list the Device Defender security profile violations discovered during the given time period	securityprofile	aws:ResourceTag/${TagKey}	List
ListViolationEvents		thing		List
OpenTunnel	Grants permission to open a tunnel		aws:RequestTag/${TagKey} aws:TagKeys iot:ThingGroupArn iot:TunnelDestinationService	Write
Publish	Grants permission to publish to the specified topic	topic*		Write
PutVerificationStateOnViolation	Grants permission to put verification state on a violation			Write
Receive	Grants permission to receive from the specified topic	topic*		Write
RegisterCACertificate	Grants permission to register a CA certificate with Amazon IoT		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
RegisterCertificate	Grants permission to register a device certificate with Amazon IoT			Write
RegisterCertificateWithoutCA	Grants permission to register a device certificate with Amazon IoT without a registered CA (certificate authority)			Write
RegisterThing	Grants permission to register your thing			Write
RejectCertificateTransfer	Grants permission to reject a pending certificate transfer	cert*		Write
RemoveThingFromBillingGroup	Grants permission to remove thing from the specified billing group	billinggroup*	aws:ResourceTag/${TagKey}	Write
RemoveThingFromBillingGroup		thing*		Write
RemoveThingFromThingGroup	Grants permission to remove thing from the specified thing group	thing*		Write
RemoveThingFromThingGroup		thinggroup*	aws:ResourceTag/${TagKey}	Write
ReplaceTopicRule	Grants permission to replace the specified rule	rule*	aws:ResourceTag/${TagKey}	Write
RetainPublish	Grants permission to publish a retained message to the specified topic	topic*		Write
RotateTunnelAccessToken	Grants permission to rotate the access token of a tunnel	tunnel*	aws:ResourceTag/${TagKey} iot:ClientMode iot:ThingGroupArn iot:TunnelDestinationService	Write
SearchIndex	Grants permission to search IoT fleet index	index*		Read
SendDirectMessage	Grants permission to send a direct message to an IoT client	client*	iot:Topic	Write
SetDefaultAuthorizer	Grants permission to set the default authorizer. This will be used if a websocket connection is made without specifying an authorizer	authorizer*	aws:ResourceTag/${TagKey}	Permissions management, Write
SetDefaultPolicyVersion	Grants permission to set the specified version of the specified policy as the policy's default (operative) version	policy*	aws:ResourceTag/${TagKey}	Permissions management, Write
SetLoggingOptions	Grants permission to set the logging options			Write
SetV2LoggingLevel	Grants permission to set the v2 logging level			Write
SetV2LoggingOptions	Grants permission to set the v2 logging options			Write
StartAuditMitigationActionsTask	Grants permission to start a task that applies a set of mitigation actions to the specified target			Write
StartCommandExecution	Grants permission to start a new command execution	client	iot:CommandExecutionParameterBoolean/${CommandParameterName} iot:CommandExecutionParameterNumber/${CommandParameterName} iot:CommandExecutionParameterString/${CommandParameterName}	Write
		command*	aws:ResourceTag/${TagKey} iot:CommandExecutionParameterBoolean/${CommandParameterName} iot:CommandExecutionParameterNumber/${CommandParameterName} iot:CommandExecutionParameterString/${CommandParameterName}
		thing	iot:CommandExecutionParameterBoolean/${CommandParameterName} iot:CommandExecutionParameterNumber/${CommandParameterName} iot:CommandExecutionParameterString/${CommandParameterName}
StartDetectMitigationActionsTask	Grants permission to start a Device Defender ML Detect mitigation actions task	securityprofile	aws:ResourceTag/${TagKey}	Write
StartOnDemandAuditTask	Grants permission to start an on-demand Device Defender audit			Write
StartThingRegistrationTask	Grants permission to start a bulk thing registration task			Write
StopThingRegistrationTask	Grants permission to stop a bulk thing registration task			Write
Subscribe	Grants permission to subscribe to the specified TopicFilter	topicfilter*		Write
TagResource	Grants permission to tag a specified resource	authorizer	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		billinggroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		cacert	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		certificateprovider	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		command	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		custommetric	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		dimension	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		domainconfiguration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		dynamicthinggroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		fleetmetric	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		job	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		jobtemplate	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		mitigationaction	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		otaupdate	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		package	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		packageversion	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		policy	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		provisioningtemplate	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		rolealias	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		rule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		scheduledaudit	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		securityprofile	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		stream	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		thinggroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		thingtype	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
TestAuthorization	Grants permission to test the policies evaluation for group policies	cert		Read
TestInvokeAuthorizer	Grants permission to test invoke the specified custom authorizer for testing purposes	authorizer*	aws:ResourceTag/${TagKey}	Read
TransferCertificate	Grants permission to transfer the specified certificate to the specified Amazon Web Services account	cert*		Write
UntagResource	Grants permission to untag a specified resource	authorizer	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		billinggroup	aws:ResourceTag/${TagKey} aws:TagKeys
		cacert	aws:ResourceTag/${TagKey} aws:TagKeys
		certificateprovider	aws:ResourceTag/${TagKey} aws:TagKeys
		command	aws:ResourceTag/${TagKey} aws:TagKeys
		custommetric	aws:ResourceTag/${TagKey} aws:TagKeys
		dimension	aws:ResourceTag/${TagKey} aws:TagKeys
		domainconfiguration	aws:ResourceTag/${TagKey} aws:TagKeys
		dynamicthinggroup	aws:ResourceTag/${TagKey} aws:TagKeys
		fleetmetric	aws:ResourceTag/${TagKey} aws:TagKeys
		job	aws:ResourceTag/${TagKey} aws:TagKeys
		jobtemplate	aws:ResourceTag/${TagKey} aws:TagKeys
		mitigationaction	aws:ResourceTag/${TagKey} aws:TagKeys
		otaupdate	aws:ResourceTag/${TagKey} aws:TagKeys
		package	aws:ResourceTag/${TagKey} aws:TagKeys
		packageversion	aws:ResourceTag/${TagKey} aws:TagKeys
		policy	aws:ResourceTag/${TagKey} aws:TagKeys
		provisioningtemplate	aws:ResourceTag/${TagKey} aws:TagKeys
		rolealias	aws:ResourceTag/${TagKey} aws:TagKeys
		rule	aws:ResourceTag/${TagKey} aws:TagKeys
		scheduledaudit	aws:ResourceTag/${TagKey} aws:TagKeys
		securityprofile	aws:ResourceTag/${TagKey} aws:TagKeys
		stream	aws:ResourceTag/${TagKey} aws:TagKeys
		thinggroup	aws:ResourceTag/${TagKey} aws:TagKeys
		thingtype	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAccountAuditConfiguration	Grants permission to configure or reconfigure the Device Defender audit settings for this account			Write
UpdateAuditSuppression	Grants permission to update a Device Defender audit suppression			Write
UpdateAuthorizer	Grants permission to update an authorizer	authorizer*	aws:ResourceTag/${TagKey}	Write
UpdateBillingGroup	Grants permission to update information associated with the specified billing group	billinggroup*	aws:ResourceTag/${TagKey}	Write
UpdateCACertificate	Grants permission to update a registered CA certificate	cacert*	aws:ResourceTag/${TagKey}	Write
UpdateCertificate	Grants permission to update the status of the specified certificate. This operation is idempotent	cert*		Write
UpdateCertificateProvider	Grants permission to update a certificate provider	certificateprovider*	aws:ResourceTag/${TagKey}	Write
UpdateCommand	Grants permission to update a command	command*	aws:ResourceTag/${TagKey}	Write
UpdateCustomMetric	Grants permission to update the specified custom metric	custommetric*	aws:ResourceTag/${TagKey}	Write
UpdateDimension	Grants permission to update the definition for a dimension	dimension*	aws:ResourceTag/${TagKey}	Write
UpdateDomainConfiguration	Grants permission to update a domain configuration	domainconfiguration*	aws:ResourceTag/${TagKey}	Write
UpdateDynamicThingGroup	Grants permission to update a Dynamic Thing Group	dynamicthinggroup*	aws:ResourceTag/${TagKey}	Write
UpdateEncryptionConfiguration	Grants permission to update the encryption configuration for the account			Write
UpdateEventConfigurations	Grants permission to update event configurations			Write
UpdateFleetMetric	Grants permission to update a fleet metric	fleetmetric*	aws:ResourceTag/${TagKey}	Write
UpdateFleetMetric	Grants permission to update a fleet metric	index*		Write
UpdateIndexingConfiguration	Grants permission to update fleet indexing configuration			Write
UpdateJob	Grants permission to update a job	job*	aws:ResourceTag/${TagKey}	Write
UpdateMitigationAction	Grants permission to update the definition for the specified mitigation action	mitigationaction*	aws:ResourceTag/${TagKey}	Write
UpdatePackage	Grants permission to update a package	package*	aws:ResourceTag/${TagKey}	Write
UpdatePackageConfiguration	Grants permission to update the package configuration of the account			Write
UpdatePackageVersion	Grants permission to update the version of the specified package	package*	aws:ResourceTag/${TagKey}	Write
UpdatePackageVersion		packageversion*	aws:ResourceTag/${TagKey}	Write
UpdateProvisioningTemplate	Grants permission to update a fleet provisioning template	provisioningtemplate*	aws:ResourceTag/${TagKey}	Write
UpdateRoleAlias	Grants permission to update the role alias	rolealias*	aws:ResourceTag/${TagKey}	Write
UpdateScheduledAudit	Grants permission to update a scheduled audit, including what checks are performed and how often the audit takes place	scheduledaudit*	aws:ResourceTag/${TagKey}	Write
UpdateSecurityProfile	Grants permission to update a Device Defender security profile	custommetric	aws:ResourceTag/${TagKey}	Write
		dimension	aws:ResourceTag/${TagKey}
		securityprofile*	aws:ResourceTag/${TagKey}
UpdateStream	Grants permission to update the data for a stream	stream*	aws:ResourceTag/${TagKey}	Write
UpdateThing	Grants permission to update information associated with the specified thing	thing*		Write
UpdateThingGroup	Grants permission to update information associated with the specified thing group	thinggroup*	aws:ResourceTag/${TagKey}	Write
UpdateThingGroupsForThing	Grants permission to update the thing groups to which the thing belongs	thing*		Write
UpdateThingGroupsForThing		thinggroup	aws:ResourceTag/${TagKey}	Write
UpdateThingShadow	Grants permission to update the thing shadow	thing*		Write
UpdateThingType	Grants permission to update information associated with the specified thing type	thingtype*	aws:ResourceTag/${TagKey}	Write
UpdateTopicRuleDestination	Grants permission to update a TopicRuleDestination	destination*		Write
ValidateSecurityProfileBehaviors	Grants permission to validate a Device Defender security profile behaviors specification			Read

Resource types defined by Amazon IoT

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
authorizer	arn:${Partition}:iot:${Region}:${Account}:authorizer/${AuthorizerName}	aws:ResourceTag/${TagKey}
billinggroup	arn:${Partition}:iot:${Region}:${Account}:billinggroup/${BillingGroupName}	aws:ResourceTag/${TagKey}
cacert	arn:${Partition}:iot:${Region}:${Account}:cacert/${CACertificate}	aws:ResourceTag/${TagKey}
cert	arn:${Partition}:iot:${Region}:${Account}:cert/${Certificate}
certificateprovider	arn:${Partition}:iot:${Region}:${Account}:certificateprovider/${CertificateProviderName}	aws:ResourceTag/${TagKey}
client	arn:${Partition}:iot:${Region}:${Account}:client/${ClientId}
command	arn:${Partition}:iot:${Region}:${Account}:command/${CommandId}	aws:ResourceTag/${TagKey}
custommetric	arn:${Partition}:iot:${Region}:${Account}:custommetric/${MetricName}	aws:ResourceTag/${TagKey}
destination	arn:${Partition}:iot:${Region}:${Account}:ruledestination/${DestinationType}/${Uuid}
dimension	arn:${Partition}:iot:${Region}:${Account}:dimension/${DimensionName}	aws:ResourceTag/${TagKey}
domainconfiguration	arn:${Partition}:iot:${Region}:${Account}:domainconfiguration/${DomainConfigurationName}/${Id}	aws:ResourceTag/${TagKey}
dynamicthinggroup	arn:${Partition}:iot:${Region}:${Account}:thinggroup/${ThingGroupName}	aws:ResourceTag/${TagKey}
fleetmetric	arn:${Partition}:iot:${Region}:${Account}:fleetmetric/${FleetMetricName}	aws:ResourceTag/${TagKey}
index	arn:${Partition}:iot:${Region}:${Account}:index/${IndexName}
job	arn:${Partition}:iot:${Region}:${Account}:job/${JobId}	aws:ResourceTag/${TagKey}
jobtemplate	arn:${Partition}:iot:${Region}:${Account}:jobtemplate/${JobTemplateId}	aws:ResourceTag/${TagKey}
mitigationaction	arn:${Partition}:iot:${Region}:${Account}:mitigationaction/${MitigationActionName}	aws:ResourceTag/${TagKey}
otaupdate	arn:${Partition}:iot:${Region}:${Account}:otaupdate/${OtaUpdateId}	aws:ResourceTag/${TagKey}
package	arn:${Partition}:iot:${Region}:${Account}:package/${PackageName}	aws:ResourceTag/${TagKey}
packageversion	arn:${Partition}:iot:${Region}:${Account}:package/${PackageName}/version/${VersionName}	aws:ResourceTag/${TagKey}
policy	arn:${Partition}:iot:${Region}:${Account}:policy/${PolicyName}	aws:ResourceTag/${TagKey}
provisioningtemplate	arn:${Partition}:iot:${Region}:${Account}:provisioningtemplate/${ProvisioningTemplate}	aws:ResourceTag/${TagKey}
rolealias	arn:${Partition}:iot:${Region}:${Account}:rolealias/${RoleAlias}	aws:ResourceTag/${TagKey}
rule	arn:${Partition}:iot:${Region}:${Account}:rule/${RuleName}	aws:ResourceTag/${TagKey}
scheduledaudit	arn:${Partition}:iot:${Region}:${Account}:scheduledaudit/${ScheduleName}	aws:ResourceTag/${TagKey}
securityprofile	arn:${Partition}:iot:${Region}:${Account}:securityprofile/${SecurityProfileName}	aws:ResourceTag/${TagKey}
stream	arn:${Partition}:iot:${Region}:${Account}:stream/${StreamId}	aws:ResourceTag/${TagKey}
thing	arn:${Partition}:iot:${Region}:${Account}:thing/${ThingName}
thinggroup	arn:${Partition}:iot:${Region}:${Account}:thinggroup/${ThingGroupName}	aws:ResourceTag/${TagKey}
thingtype	arn:${Partition}:iot:${Region}:${Account}:thingtype/${ThingTypeName}	aws:ResourceTag/${TagKey}
topic	arn:${Partition}:iot:${Region}:${Account}:topic/${TopicName}
topicfilter	arn:${Partition}:iot:${Region}:${Account}:topicfilter/${TopicFilter}
tunnel	arn:${Partition}:iot:${Region}:${Account}:tunnel/${TunnelId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon IoT

Amazon IoT defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by a tag key that is present in the request	String
aws:ResourceTag/${TagKey}	Filters access by a tag key component of a tag associated to the IoT resource in the request	String
aws:TagKeys	Filters access by a list of tag keys associated to the IoT resource in the request	ArrayOfString
iot:ClientMode	Filters access by the mode of the client for IoT Tunnel	String
iot:CommandExecutionParameterBoolean/${CommandParameterName}	Filters access by the command parameter name and boolean value	Bool
iot:CommandExecutionParameterNumber/${CommandParameterName}	Filters access by the command parameter name and numeric value	Numeric
iot:CommandExecutionParameterString/${CommandParameterName}	Filters access by the command parameter name and string value	String
iot:Delete	Filters access by a flag indicating whether or not to also delete an IoT Tunnel immediately when making iot:CloseTunnel request	Bool
iot:DomainName	Filters access by based on the domain name of an IoT DomainConfiguration	String
iot:IncludeSocketInformation	Filters access by GetConnection and GetThingConnectivityData includeSocketInformation request parameter	Bool
iot:ThingGroupArn	Filters access by a list of IoT Thing Group ARNs that the destination IoT Thing belongs to for an IoT Tunnel	ArrayOfARN
iot:Topic	Filters access by based on the topic	String
iot:TunnelDestinationService	Filters access by a list of destination services for an IoT Tunnel	ArrayOfString
iot:thingArn	Filters access by the ARN of an IoT Thing	ARN

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Invoicing Service (invoicing)

Amazon IoT Analytics (iotanalytics)