Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Managed Streaming for Apache Kafka

Amazon Managed Streaming for Apache Kafka (service prefix: kafka) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Managed Streaming for Apache Kafka
Actions defined by Amazon Managed Streaming for Apache Kafka
Resource types defined by Amazon Managed Streaming for Apache Kafka
Condition keys for Amazon Managed Streaming for Apache Kafka

API operations defined by Amazon Managed Streaming for Apache Kafka

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
BatchAssociateScramSecret	kafka:BatchAssociateScramSecret			Write
BatchDisassociateScramSecret	kafka:BatchDisassociateScramSecret			Write
CreateCluster	kafka:CreateCluster			Write
CreateCluster	kafka:TagResource			Tagging, Write
CreateClusterV2	kafka:CreateClusterV2			Write
CreateClusterV2	kafka:TagResource			Tagging, Write
CreateConfiguration	kafka:CreateConfiguration			Write
CreateReplicator	kafka:CreateReplicator			Write
	kafka:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	kafka.amazonaws.com	Write
CreateTopic	kafka-cluster:Connect			Write
CreateTopic	kafka-cluster:CreateTopic			Write
CreateVpcConnection	kafka:CreateVpcConnection			Write
CreateVpcConnection	kafka:TagResource			Tagging, Write
DeleteCluster	kafka:DeleteCluster			Write
DeleteClusterPolicy	kafka:DeleteClusterPolicy			Write
DeleteConfiguration	kafka:DeleteConfiguration			Write
DeleteReplicator	kafka:DeleteReplicator			Write
DeleteTopic	kafka-cluster:Connect			Write
	kafka-cluster:DeleteTopic			Write
	kafka-cluster:DescribeTopic			List
DeleteVpcConnection	kafka:DeleteVpcConnection			Write
DescribeCluster	kafka:DescribeCluster			Read
DescribeClusterOperation	kafka:DescribeClusterOperation			Read
DescribeClusterOperationV2	kafka:DescribeClusterOperationV2			Read
DescribeClusterV2	kafka:DescribeClusterV2			Read
DescribeConfiguration	kafka:DescribeConfiguration			Read
DescribeConfigurationRevision	kafka:DescribeConfigurationRevision			Read
DescribeReplicator	kafka:DescribeReplicator			Read
DescribeReplicator	kafka:ListTagsForResource			Read
DescribeTopic	kafka-cluster:Connect			Write
	kafka-cluster:DescribeTopic			List
	kafka-cluster:DescribeTopicDynamicConfiguration			List
DescribeTopicPartitions	kafka-cluster:Connect			Write
	kafka-cluster:DescribeTopic			List
	kafka-cluster:DescribeTopicDynamicConfiguration			List
DescribeVpcConnection	kafka:DescribeVpcConnection			Read
GetBootstrapBrokers	kafka:GetBootstrapBrokers			Read
GetClusterPolicy	kafka:GetClusterPolicy			Read
GetCompatibleKafkaVersions	kafka:GetCompatibleKafkaVersions			List
ListClientVpcConnections	kafka:ListClientVpcConnections			List
ListClusterOperations	kafka:ListClusterOperations			List
ListClusterOperationsV2	kafka:ListClusterOperationsV2			List
ListClusters	kafka:ListClusters			List
ListClustersV2	kafka:ListClustersV2			List
ListConfigurationRevisions	kafka:ListConfigurationRevisions			List
ListConfigurations	kafka:ListConfigurations			List
ListKafkaVersions	kafka:ListKafkaVersions			List
ListNodes	kafka:ListNodes			List
ListReplicators	kafka:ListReplicators			List
ListScramSecrets	kafka:ListScramSecrets			List
ListTagsForResource	kafka:ListTagsForResource			Read
ListTopics	kafka-cluster:Connect			Write
ListTopics	kafka-cluster:DescribeTopic			List
ListVpcConnections	kafka:ListVpcConnections			List
PutClusterPolicy	kafka:PutClusterPolicy			Write
RebootBroker	kafka:RebootBroker			Write
RejectClientVpcConnection	kafka:RejectClientVpcConnection			Write
TagResource	kafka:TagResource			Tagging, Write
UntagResource	kafka:UntagResource			Tagging, Write
UpdateBrokerCount	kafka:UpdateBrokerCount			Write
UpdateBrokerStorage	kafka:UpdateBrokerStorage			Write
UpdateBrokerType	kafka:UpdateBrokerType			Write
UpdateClusterConfiguration	kafka:UpdateClusterConfiguration			Write
UpdateClusterKafkaVersion	kafka:UpdateClusterKafkaVersion			Write
UpdateConfiguration	kafka:UpdateConfiguration			Write
UpdateConnectivity	kafka:UpdateConnectivity			Write
UpdateMonitoring	kafka:UpdateMonitoring			Write
UpdateRebalancing	kafka:UpdateRebalancing			Write
UpdateReplicationInfo	kafka:UpdateReplicationInfo			Write
UpdateSecurity	kafka:UpdateSecurity			Write
UpdateStorage	kafka:UpdateStorage			Write
UpdateTopic	kafka-cluster:AlterTopic			Write
	kafka-cluster:AlterTopicDynamicConfiguration			Write
	kafka-cluster:Connect			Write
	kafka-cluster:DescribeTopic			List

Actions defined by Amazon Managed Streaming for Apache Kafka

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchAssociateScramSecret	Grants permission to associate one or more Scram Secrets with an Amazon MSK cluster	cluster*	aws:ResourceTag/${TagKey}	Write
BatchDisassociateScramSecret	Grants permission to disassociate one or more Scram Secrets from an Amazon MSK cluster	cluster*	aws:ResourceTag/${TagKey}	Write
CreateCluster	Grants permission to create an MSK cluster	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateClusterV2	Grants permission to create an MSK cluster	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConfiguration	Grants permission to create an MSK configuration	configuration*		Write
CreateReplicator	Grants permission to create a MSK replicator	replicator*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTopic	Grants permission to create a Kafka topic in an MSK cluster	topic*		Write
CreateVpcConnection	Grants permission to create a MSK VPC connection	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateVpcConnection	Grants permission to create a MSK VPC connection	vpc-connection*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteCluster	Grants permission to delete an MSK cluster	cluster*	aws:ResourceTag/${TagKey}	Write
DeleteClusterPolicy	Grants permission to delete a cluster resource-based policy	cluster*	aws:ResourceTag/${TagKey}	Write
DeleteConfiguration	Grants permission to delete the specified MSK configuration	configuration*		Write
DeleteReplicator	Grants permission to delete a MSK replicator	replicator*	aws:ResourceTag/${TagKey}	Write
DeleteTopic	Grants permission to delete a Kafka topic from an MSK cluster	topic*		Write
DeleteVpcConnection	Grants permission to delete a MSK VPC connection	vpc-connection*	aws:ResourceTag/${TagKey}	Write
DescribeCluster	Grants permission to describe an MSK cluster	cluster*	aws:ResourceTag/${TagKey}	Read
DescribeClusterOperation	Grants permission to describe the cluster operation that is specified by the given ARN			Read
DescribeClusterOperationV2	Grants permission to describe the cluster operation that is specified by the given ARN			Read
DescribeClusterV2	Grants permission to describe an MSK cluster	cluster*	aws:ResourceTag/${TagKey}	Read
DescribeConfiguration	Grants permission to describe an MSK configuration	configuration*		Read
DescribeConfigurationRevision	Grants permission to describe an MSK configuration revision	configuration*		Read
DescribeReplicator	Grants permission to describe a MSK replicator	replicator*	aws:ResourceTag/${TagKey}	Read
DescribeTopic	Grants permission to return metadata details about a specific Kafka topic	topic*		Read
DescribeTopicPartitions	Grants permission to list all partitions of a specific topic	topic*		Read
DescribeVpcConnection	Grants permission to describe a MSK VPC connection	vpc-connection*	aws:ResourceTag/${TagKey}	Read
GetBootstrapBrokers	Grants permission to get connection details for the brokers in an MSK cluster			Read
GetClusterPolicy	Grants permission to describe a cluster resource-based policy	cluster*	aws:ResourceTag/${TagKey}	Read
GetCompatibleKafkaVersions	Grants permission to get a list of the Apache Kafka versions to which you can update an MSK cluster			List
ListClientVpcConnections	Grants permission to list all MSK VPC connections created for a cluster	cluster*	aws:ResourceTag/${TagKey}	List
ListClusterOperations	Grants permission to return a list of all the operations that have been performed on the specified MSK cluster	cluster*	aws:ResourceTag/${TagKey}	List
ListClusterOperationsV2	Grants permission to return a list of all the operations that have been performed on the specified MSK cluster	cluster*	aws:ResourceTag/${TagKey}	List
ListClusters	Grants permission to list all MSK clusters in this account			List
ListClustersV2	Grants permission to list all MSK clusters in this account			List
ListConfigurationRevisions	Grants permission to list all revisions for an MSK configuration in this account	configuration*		List
ListConfigurations	Grants permission to list all MSK configurations in this account			List
ListKafkaVersions	Grants permission to list all Apache Kafka versions supported by Amazon MSK			List
ListNodes	Grants permission to list brokers in an MSK cluster	cluster*	aws:ResourceTag/${TagKey}	List
ListReplicators	Grants permission to list all MSK replicators in this account			List
ListScramSecrets	Grants permission to list the Scram Secrets associated with an Amazon MSK cluster	cluster*	aws:ResourceTag/${TagKey}	List
ListTagsForResource	Grants permission to list tags of an MSK resource	cluster*	aws:ResourceTag/${TagKey}	Read
ListTopics	Grants permission to list all Kafka topics for a specified MSK cluster	cluster*	aws:ResourceTag/${TagKey}	List
ListVpcConnections	Grants permission to list all MSK VPC connections that this account uses			List
PutClusterPolicy	Grants permission to create or update the resource-based policy for a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
RebootBroker	Grants permission to reboot broker	cluster*	aws:ResourceTag/${TagKey}	Write
RejectClientVpcConnection	Grants permission to reject a MSK VPC connection	cluster*	aws:ResourceTag/${TagKey}	Write
RejectClientVpcConnection	Grants permission to reject a MSK VPC connection	vpc-connection*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag an MSK resource	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TagResource	Grants permission to tag an MSK resource	vpc-connection	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from an MSK resource	cluster	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UntagResource	Grants permission to remove tags from an MSK resource	vpc-connection	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
UpdateBrokerCount	Grants permission to update the number of brokers of the MSK cluster	cluster*	aws:ResourceTag/${TagKey}	Write
UpdateBrokerStorage	Grants permission to update the storage size of the brokers of the MSK cluster	cluster*	aws:ResourceTag/${TagKey}	Write
UpdateBrokerType	Grants permission to update the broker type of an Amazon MSK cluster	cluster*	aws:ResourceTag/${TagKey}	Write
UpdateClusterConfiguration	Grants permission to update the configuration of the MSK cluster	cluster*	aws:ResourceTag/${TagKey}	Write
UpdateClusterConfiguration		configuration*		Write
UpdateClusterKafkaVersion	Grants permission to update the MSK cluster to the specified Apache Kafka version	cluster*	aws:ResourceTag/${TagKey}	Write
UpdateConfiguration	Grants permission to create a new revision of the MSK configuration	configuration*		Write
UpdateConnectivity	Grants permission to update the connectivity settings for the MSK cluster	cluster*	aws:ResourceTag/${TagKey} kafka:publicAccessEnabled	Write
UpdateMonitoring	Grants permission to update the monitoring settings for the MSK cluster	cluster*	aws:ResourceTag/${TagKey}	Write
UpdateRebalancing	Grants permission to update the intelligent rebalancing status of the MSK cluster	cluster*	aws:ResourceTag/${TagKey}	Write
UpdateReplicationInfo	Grants permission to update the replication info of the MSK replicator	replicator*	aws:ResourceTag/${TagKey}	Write
UpdateSecurity	Grants permission to update the security settings for the MSK cluster	cluster*	aws:ResourceTag/${TagKey}	Write
UpdateStorage	Grants permission to update the EBS storage (size or provisioned throughput) associated with MSK brokers or set cluster storage mode to TIERED	cluster*	aws:ResourceTag/${TagKey}	Write
UpdateTopic	Grants permission to update the configuration of a Kafka topic in an MSK cluster	topic*		Write

Resource types defined by Amazon Managed Streaming for Apache Kafka

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
cluster	arn:${Partition}:kafka:${Region}:${Account}:cluster/${ClusterName}/${Uuid}	aws:ResourceTag/${TagKey}
configuration	arn:${Partition}:kafka:${Region}:${Account}:configuration/${ConfigurationName}/${Uuid}
group	arn:${Partition}:kafka:${Region}:${Account}:group/${ClusterName}/${ClusterUuid}/${GroupName}
replicator	arn:${Partition}:kafka:${Region}:${Account}:replicator/${ReplicatorName}/${Uuid}	aws:ResourceTag/${TagKey}
topic	arn:${Partition}:kafka:${Region}:${Account}:topic/${ClusterName}/${ClusterUuid}/${TopicName}
transactional-id	arn:${Partition}:kafka:${Region}:${Account}:transactional-id/${ClusterName}/${ClusterUuid}/${TransactionalId}
vpc-connection	arn:${Partition}:kafka:${Region}:${VpcOwnerAccount}:vpc-connection/${ClusterOwnerAccount}/${ClusterName}/${Uuid}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Managed Streaming for Apache Kafka

Amazon Managed Streaming for Apache Kafka defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString
kafka:publicAccessEnabled	Filters access by the presence of public access enabled in the request	Bool

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Kinesis Video Streams (kinesisvideo)

Amazon Managed Workflows for Apache Airflow (airflow)