Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon MemoryDB

Amazon MemoryDB (service prefix: memorydb) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon MemoryDB
Actions defined by Amazon MemoryDB
Permission-only actions for Amazon MemoryDB
Resource types defined by Amazon MemoryDB
Condition keys for Amazon MemoryDB

API operations defined by Amazon MemoryDB

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
BatchUpdateCluster	memorydb:BatchUpdateCluster	Write
CopySnapshot	memorydb:CopySnapshot	Write
CreateACL	memorydb:CreateAcl	Write
CreateACL	memorydb:TagResource	Tagging, Write
CreateCluster	memorydb:CreateCluster	Write
CreateCluster	memorydb:TagResource	Tagging, Write
CreateMultiRegionCluster	memorydb:CreateMultiRegionCluster	Write
CreateMultiRegionCluster	memorydb:TagResource	Tagging, Write
CreateParameterGroup	memorydb:CreateParameterGroup	Write
CreateParameterGroup	memorydb:TagResource	Tagging, Write
CreateSnapshot	memorydb:CreateSnapshot	Write
CreateSnapshot	memorydb:TagResource	Tagging, Write
CreateSubnetGroup	memorydb:CreateSubnetGroup	Write
CreateSubnetGroup	memorydb:TagResource	Tagging, Write
CreateUser	memorydb:CreateUser	Write
CreateUser	memorydb:TagResource	Tagging, Write
DeleteACL	memorydb:DeleteAcl	Write
DeleteCluster	memorydb:CreateSnapshot	Write
DeleteCluster	memorydb:DeleteCluster	Write
DeleteMultiRegionCluster	memorydb:DeleteMultiRegionCluster	Write
DeleteParameterGroup	memorydb:DeleteParameterGroup	Write
DeleteSnapshot	memorydb:DeleteSnapshot	Write
DeleteSubnetGroup	memorydb:DeleteSubnetGroup	Write
DeleteUser	memorydb:DeleteUser	Write
DescribeACLs	memorydb:DescribeAcls	Read
DescribeClusters	memorydb:DescribeClusters	Read
DescribeEngineVersions	memorydb:DescribeEngineVersions	Read
DescribeEvents	memorydb:DescribeEvents	Read
DescribeMultiRegionClusters	memorydb:DescribeMultiRegionClusters	Read
DescribeMultiRegionParameterGroups	memorydb:DescribeMultiRegionParameterGroups	Read
DescribeMultiRegionParameters	memorydb:DescribeMultiRegionParameters	Read
DescribeParameterGroups	memorydb:DescribeParameterGroups	Read
DescribeParameters	memorydb:DescribeParameters	Read
DescribeReservedNodes	memorydb:DescribeReservedNodes	Read
DescribeReservedNodesOfferings	memorydb:DescribeReservedNodesOfferings	Read
DescribeServiceUpdates	memorydb:DescribeServiceUpdates	Read
DescribeSnapshots	memorydb:DescribeSnapshots	Read
DescribeSubnetGroups	memorydb:DescribeSubnetGroups	Read
DescribeUsers	memorydb:DescribeUsers	Read
FailoverShard	memorydb:FailoverShard	Write
ListAllowedMultiRegionClusterUpdates	memorydb:ListAllowedMultiRegionClusterUpdates	Read
ListAllowedNodeTypeUpdates	memorydb:ListAllowedNodeTypeUpdates	Read
ListTags	memorydb:ListTags	Read
PurchaseReservedNodesOffering	memorydb:PurchaseReservedNodesOffering	Write
PurchaseReservedNodesOffering	memorydb:TagResource	Tagging, Write
ResetParameterGroup	memorydb:ResetParameterGroup	Write
TagResource	memorydb:TagResource	Tagging, Write
UntagResource	memorydb:UntagResource	Tagging, Write
UpdateACL	memorydb:UpdateAcl	Write
UpdateCluster	memorydb:UpdateCluster	Write
UpdateMultiRegionCluster	memorydb:UpdateMultiRegionCluster	Write
UpdateParameterGroup	memorydb:UpdateParameterGroup	Write
UpdateSubnetGroup	memorydb:UpdateSubnetGroup	Write
UpdateUser	memorydb:UpdateUser	Write

Actions defined by Amazon MemoryDB

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
BatchUpdateCluster	Grants permissions to apply service updates	cluster*	aws:ResourceTag/${TagKey}	Write
Connect	Allows an IAM user or role to connect as a specified MemoryDB user to a node in a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
Connect		user*	aws:ResourceTag/${TagKey}	Write
CopySnapshot	Grants permissions to make a copy of an existing snapshot	snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAcl	Grants permissions to create a new access control list	user*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateCluster	Grants permissions to create a cluster	acl*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys memorydb:TLSEnabled	Write
		multiregioncluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys memorydb:TLSEnabled
		parametergroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys memorydb:TLSEnabled
		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys memorydb:TLSEnabled
		subnetgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys memorydb:TLSEnabled
CreateMultiRegionCluster	Grants permissions to create a Multi-Region cluster	multiregionparametergroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys memorydb:TLSEnabled	Write
CreateParameterGroup	Grants permissions to create a new parameter group		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateSnapshot	Grants permissions to create a backup of a cluster at the current point in time	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateSubnetGroup	Grants permissions to create a new subnet group		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateUser	Grants permissions to create a new user		aws:RequestTag/${TagKey} aws:TagKeys memorydb:UserAuthenticationMode	Write
DeleteAcl	Grants permissions to delete an access control list	acl*	aws:ResourceTag/${TagKey}	Write
DeleteCluster	Grants permissions to delete a previously provisioned cluster	cluster*	aws:ResourceTag/${TagKey}	Write
		multiregioncluster	aws:ResourceTag/${TagKey} memorydb:TLSEnabled
		snapshot	aws:ResourceTag/${TagKey}
DeleteMultiRegionCluster	Grants permissions to delete a Multi-Region cluster	multiregioncluster*	aws:ResourceTag/${TagKey} memorydb:TLSEnabled	Write
DeleteParameterGroup	Grants permissions to delete a parameter group	parametergroup*	aws:ResourceTag/${TagKey}	Write
DeleteSnapshot	Grants permissions to delete a snapshot	snapshot*	aws:ResourceTag/${TagKey}	Write
DeleteSubnetGroup	Grants permissions to delete a subnet group	subnetgroup*	aws:ResourceTag/${TagKey}	Write
DeleteUser	Grants permissions to delete a user	user*	aws:ResourceTag/${TagKey}	Write
DescribeAcls	Grants permissions to retrieve information about access control lists	acl*	aws:ResourceTag/${TagKey}	Read
DescribeClusters	Grants permissions to retrieve information about all provisioned clusters if no cluster identifier is specified, or about a specific cluster if a cluster identifier is supplied	cluster*	aws:ResourceTag/${TagKey}	Read
DescribeEngineVersions	Grants permissions to list of the available engines and their versions			Read
DescribeEvents	Grants permissions to retrieve events related to clusters, subnet groups, and parameter groups			Read
DescribeMultiRegionClusters	Grants permissions to retrieve information about all Multi-Region clusters if no cluster identifier is specified, or about a specific Multi-Region cluster if a cluster identifier is supplied	multiregioncluster*	aws:ResourceTag/${TagKey} memorydb:TLSEnabled	Read
DescribeMultiRegionParameterGroups	Grants permissions to retrieve information about Multi-Region parameter groups	multiregionparametergroup*		Read
DescribeMultiRegionParameters	Grants permissions to retrieve a detailed parameter list for a particular Multi-Region parameter group	multiregionparametergroup*		Read
DescribeParameterGroups	Grants permissions to retrieve information about parameter groups	parametergroup*	aws:ResourceTag/${TagKey}	Read
DescribeParameters	Grants permissions to retrieve a detailed parameter list for a particular parameter group	parametergroup*	aws:ResourceTag/${TagKey}	Read
DescribeReservedNodes	Grants permissions to retrieve reserved nodes	reservednode*	aws:ResourceTag/${TagKey}	Read
DescribeReservedNodesOfferings	Grants permissions to retrieve reserved nodes offerings			Read
DescribeServiceUpdates	Grants permissions to retrieve details of the service updates			Read
DescribeSnapshots	Grants permissions to retrieve information about cluster snapshots	snapshot*	aws:ResourceTag/${TagKey}	Read
DescribeSubnetGroups	Grants permissions to retrieve a list of subnet group	subnetgroup*	aws:ResourceTag/${TagKey}	Read
DescribeUsers	Grants permissions to retrieve information about users	user*	aws:ResourceTag/${TagKey}	Read
FailoverShard	Grants permissions to test automatic failover on a specified shard in a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
ListAllowedMultiRegionClusterUpdates	Grants permissions to list available Multi-Region cluster updates	multiregioncluster*	aws:ResourceTag/${TagKey} memorydb:TLSEnabled	Read
ListAllowedNodeTypeUpdates	Grants permissions to list available node type updates	cluster*	aws:ResourceTag/${TagKey}	Read
ListTags	Grants permissions to list cost allocation tags	acl	aws:ResourceTag/${TagKey}	Read
		cluster	aws:ResourceTag/${TagKey}
		multiregioncluster	aws:ResourceTag/${TagKey} memorydb:TLSEnabled
		parametergroup	aws:ResourceTag/${TagKey}
		snapshot	aws:ResourceTag/${TagKey}
		subnetgroup	aws:ResourceTag/${TagKey}
		user	aws:ResourceTag/${TagKey}
PurchaseReservedNodesOffering	Grants permissions to purchase a new reserved node	reservednode*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
ResetParameterGroup	Grants permissions to modify the parameters of a parameter group to the engine or system default value	parametergroup*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permissions to add up to 10 cost allocation tags to the named resource	acl	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		multiregioncluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys memorydb:TLSEnabled
		parametergroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		reservednode	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		subnetgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		user	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permissions to remove the tags identified by the TagKeys list from a resource	acl	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		cluster	aws:ResourceTag/${TagKey} aws:TagKeys
		multiregioncluster	aws:ResourceTag/${TagKey} aws:TagKeys memorydb:TLSEnabled
		parametergroup	aws:ResourceTag/${TagKey} aws:TagKeys
		snapshot	aws:ResourceTag/${TagKey} aws:TagKeys
		subnetgroup	aws:ResourceTag/${TagKey} aws:TagKeys
		user	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAcl	Grants permissions to update an access control list	acl*	aws:ResourceTag/${TagKey}	Write
UpdateAcl	Grants permissions to update an access control list	user*	aws:ResourceTag/${TagKey}	Write
UpdateCluster	Grants permissions to update the settings for a cluster	acl	aws:ResourceTag/${TagKey}	Write
		cluster*	aws:ResourceTag/${TagKey}
		parametergroup	aws:ResourceTag/${TagKey}
UpdateMultiRegionCluster	Grants permissions to update the settings for a Multi-Region cluster	multiregioncluster*	aws:ResourceTag/${TagKey} memorydb:TLSEnabled	Write
UpdateMultiRegionCluster		multiregionparametergroup	aws:ResourceTag/${TagKey}	Write
UpdateParameterGroup	Grants permissions to update parameters in a parameter group	parametergroup*	aws:ResourceTag/${TagKey}	Write
UpdateSubnetGroup	Grants permissions to update a subnet group	subnetgroup*	aws:ResourceTag/${TagKey}	Write
UpdateUser	Grants permissions to update a user	user*	aws:ResourceTag/${TagKey} memorydb:UserAuthenticationMode	Write

Permission-only actions for Amazon MemoryDB

The following actions are defined by Amazon MemoryDB but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
PauseMultiRegionClusterReplication	Grants permission to pause replication for a Multi-Region cluster	multiregioncluster*	aws:ResourceTag/${TagKey} memorydb:TLSEnabled	Write

Actions

Description

Resource types (*required)

Condition keys

Access level

PauseMultiRegionClusterReplication

Grants permission to pause replication for a Multi-Region cluster

multiregioncluster*

aws:ResourceTag/${TagKey}

memorydb:TLSEnabled

Write

Resource types defined by Amazon MemoryDB

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
acl	arn:${Partition}:memorydb:${Region}:${Account}:acl/${AclName}	aws:ResourceTag/${TagKey}
cluster	arn:${Partition}:memorydb:${Region}:${Account}:cluster/${ClusterName}	aws:ResourceTag/${TagKey}
multiregioncluster	arn:${Partition}:memorydb::${Account}:multiregioncluster/${ClusterName}	aws:ResourceTag/${TagKey} memorydb:TLSEnabled
multiregionparametergroup	arn:${Partition}:memorydb::${Account}:multiregionparametergroup/${MultiRegionParameterGroupName}
parametergroup	arn:${Partition}:memorydb:${Region}:${Account}:parametergroup/${ParameterGroupName}	aws:ResourceTag/${TagKey}
reservednode	arn:${Partition}:memorydb:${Region}:${Account}:reservednode/${ReservationID}	aws:ResourceTag/${TagKey}
snapshot	arn:${Partition}:memorydb:${Region}:${Account}:snapshot/${SnapshotName}	aws:ResourceTag/${TagKey}
subnetgroup	arn:${Partition}:memorydb:${Region}:${Account}:subnetgroup/${SubnetGroupName}	aws:ResourceTag/${TagKey}
user	arn:${Partition}:memorydb:${Region}:${Account}:user/${UserName}	aws:ResourceTag/${TagKey}

Condition keys for Amazon MemoryDB

Amazon MemoryDB defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters actions based on the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters actions based on the tags associated with the resource	String
aws:TagKeys	Filters actions based on the tag keys that are passed in the request	ArrayOfString
memorydb:TLSEnabled	Filters access by the TLSEnabled parameter present in the request or defaults to true value if parameter is not present	Bool
memorydb:UserAuthenticationMode	Filters access by the UserAuthenticationMode.Type parameter in the request	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Managed Workflows for Apache Airflow (airflow)

Amazon Message Delivery Service (ec2messages)