Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Redshift

Amazon Redshift (service prefix: redshift) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Redshift
Actions defined by Amazon Redshift
Permission-only actions for Amazon Redshift
Resource types defined by Amazon Redshift
Condition keys for Amazon Redshift

API operations defined by Amazon Redshift

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AcceptReservedNodeExchange	redshift:AcceptReservedNodeExchange			Write
AddPartner	redshift:AddPartner			Write
AddPartner	redshift:DeletePartner			Write
AssociateDataShareConsumer	redshift:AssociateDataShareConsumer			Write
AuthorizeClusterSecurityGroupIngress	redshift:AuthorizeClusterSecurityGroupIngress			Write
AuthorizeDataShare	redshift:AuthorizeDataShare			Permissions management, Write
AuthorizeEndpointAccess	redshift:AuthorizeEndpointAccess			Permissions management, Write
AuthorizeSnapshotAccess	redshift:AuthorizeSnapshotAccess			Permissions management, Write
BatchDeleteClusterSnapshots	redshift:BatchDeleteClusterSnapshots			Write
BatchModifyClusterSnapshots	redshift:BatchModifyClusterSnapshots			Write
CancelResize	redshift:CancelResize			Write
CopyClusterSnapshot	redshift:CopyClusterSnapshot			Write
CreateAuthenticationProfile	redshift:CreateAuthenticationProfile			Write
CreateCluster	redshift:AssociateDataShareConsumer			Write
	redshift:CreateCluster			Write
	redshift:CreateTags			Tagging, Write
	redshift:RegisterNamespace			Write
	iam:PassRole	iam:PassedToService	redshift.amazonaws.com	Write
CreateClusterParameterGroup	redshift:CreateClusterParameterGroup			Write
CreateClusterParameterGroup	redshift:CreateTags			Tagging, Write
CreateClusterSnapshot	redshift:CreateClusterSnapshot			Write
CreateClusterSnapshot	redshift:CreateTags			Tagging, Write
CreateClusterSubnetGroup	redshift:CreateClusterSubnetGroup			Write
CreateClusterSubnetGroup	redshift:CreateTags			Tagging, Write
CreateCustomDomainAssociation	redshift:CreateCustomDomainAssociation			Write
CreateEndpointAccess	redshift:CreateEndpointAccess			Write
CreateEventSubscription	redshift:CreateEventSubscription			Write
CreateEventSubscription	redshift:CreateTags			Tagging, Write
CreateHsmClientCertificate	redshift:CreateHsmClientCertificate			Write
CreateHsmClientCertificate	redshift:CreateTags			Tagging, Write
CreateHsmConfiguration	redshift:CreateHsmConfiguration			Write
CreateHsmConfiguration	redshift:CreateTags			Tagging, Write
CreateIntegration	redshift:CreateIntegration			Write
CreateIntegration	redshift:CreateTags			Tagging, Write
CreateRedshiftIdcApplication	redshift:CreateRedshiftIdcApplication			Write
CreateRedshiftIdcApplication	redshift:CreateTags			Tagging, Write
CreateScheduledAction	redshift:CreateScheduledAction			Write
	redshift:PauseCluster			Write
	redshift:ResizeCluster			Write
	redshift:ResumeCluster			Write
	iam:PassRole	iam:PassedToService	redshift.amazonaws.com	Write
CreateSnapshotCopyGrant	redshift:CreateSnapshotCopyGrant			Permissions management, Write
CreateSnapshotCopyGrant	redshift:CreateTags			Tagging, Write
CreateSnapshotSchedule	redshift:CreateSnapshotSchedule			Write
CreateSnapshotSchedule	redshift:CreateTags			Tagging, Write
CreateTags	redshift:CreateTags			Tagging, Write
CreateTags	redshift:DeleteTags			Tagging, Write
CreateUsageLimit	redshift:CreateTags			Tagging, Write
CreateUsageLimit	redshift:CreateUsageLimit			Write
DeauthorizeDataShare	redshift:DeauthorizeDataShare			Permissions management, Write
DeleteAuthenticationProfile	redshift:DeleteAuthenticationProfile			Write
DeleteCluster	redshift:CreateClusterSnapshot			Write
DeleteCluster	redshift:DeleteCluster			Write
DeleteClusterParameterGroup	redshift:DeleteClusterParameterGroup			Write
DeleteClusterSecurityGroup	redshift:DeleteClusterSecurityGroup			Write
DeleteClusterSnapshot	redshift:DeleteClusterSnapshot			Write
DeleteClusterSubnetGroup	redshift:DeleteClusterSubnetGroup			Write
DeleteCustomDomainAssociation	redshift:DeleteCustomDomainAssociation			Write
DeleteEndpointAccess	redshift:DeleteEndpointAccess			Write
DeleteEventSubscription	redshift:DeleteEventSubscription			Write
DeleteHsmClientCertificate	redshift:DeleteHsmClientCertificate			Write
DeleteHsmConfiguration	redshift:DeleteHsmConfiguration			Write
DeleteIntegration	redshift:DeleteIntegration			Write
DeletePartner	redshift:DeletePartner			Write
DeleteRedshiftIdcApplication	redshift:DeleteRedshiftIdcApplication			Write
DeleteResourcePolicy	redshift:DeleteResourcePolicy			Permissions management, Write
DeleteScheduledAction	redshift:DeleteScheduledAction			Write
DeleteSnapshotCopyGrant	redshift:DeleteSnapshotCopyGrant			Write
DeleteSnapshotSchedule	redshift:DeleteSnapshotSchedule			Write
DeleteTags	redshift:DeleteTags			Tagging, Write
DeleteUsageLimit	redshift:DeleteUsageLimit			Write
DeregisterNamespace	redshift:DeregisterNamespace			Write
DescribeAccountAttributes	redshift:DescribeAccountAttributes			Read
DescribeAuthenticationProfiles	redshift:DescribeAuthenticationProfiles			Read
DescribeClusterDbRevisions	redshift:DescribeClusterDbRevisions			List
DescribeClusterParameterGroups	redshift:DescribeClusterParameterGroups			Read
DescribeClusterParameters	redshift:DescribeClusterParameters			Read
DescribeClusterSecurityGroups	redshift:DescribeClusterSecurityGroups			Read
DescribeClusterSnapshots	redshift:DescribeClusterSnapshots			Read
DescribeClusterSubnetGroups	redshift:DescribeClusterSubnetGroups			Read
DescribeClusterTracks	redshift:DescribeClusterTracks			List
DescribeClusterVersions	redshift:DescribeClusterVersions			Read
DescribeClusters	redshift:DescribeClusters			List
DescribeCustomDomainAssociations	redshift:DescribeCustomDomainAssociations			List
DescribeDataShares	redshift:DescribeDataShares			Read
DescribeDataSharesForConsumer	redshift:DescribeDataSharesForConsumer			Read
DescribeDataSharesForProducer	redshift:DescribeDataSharesForProducer			Read
DescribeDefaultClusterParameters	redshift:DescribeDefaultClusterParameters			Read
DescribeEndpointAccess	redshift:DescribeEndpointAccess			Read
DescribeEndpointAuthorization	redshift:DescribeEndpointAuthorization			List
DescribeEventCategories	redshift:DescribeEventCategories			Read
DescribeEventSubscriptions	redshift:DescribeEventSubscriptions			Read
DescribeEvents	redshift:DescribeEvents			List
DescribeHsmClientCertificates	redshift:DescribeHsmClientCertificates			Read
DescribeHsmConfigurations	redshift:DescribeHsmConfigurations			Read
DescribeInboundIntegrations	redshift:DescribeInboundIntegrations			List
DescribeIntegrations	redshift:DescribeIntegrations			List
DescribeLoggingStatus	redshift:DescribeLoggingStatus			Read
DescribeNodeConfigurationOptions	redshift:DescribeNodeConfigurationOptions			List
DescribeOrderableClusterOptions	redshift:DescribeOrderableClusterOptions			Read
DescribePartners	redshift:DescribePartners			Read
DescribeRedshiftIdcApplications	redshift:DescribeRedshiftIdcApplications			List
DescribeReservedNodeExchangeStatus	redshift:DescribeReservedNodeExchangeStatus			Read
DescribeReservedNodeOfferings	redshift:DescribeReservedNodeOfferings			Read
DescribeReservedNodes	redshift:DescribeReservedNodes			Read
DescribeResize	redshift:DescribeResize			Read
DescribeScheduledActions	redshift:DescribeScheduledActions			Read
DescribeSnapshotCopyGrants	redshift:DescribeSnapshotCopyGrants			Read
DescribeSnapshotSchedules	redshift:DescribeSnapshotSchedules			Read
DescribeStorage	redshift:DescribeStorage			Read
DescribeTableRestoreStatus	redshift:DescribeTableRestoreStatus			Read
DescribeTags	redshift:DescribeTags			Read
DescribeUsageLimits	redshift:DescribeUsageLimits			Read
DisableLogging	redshift:DisableLogging			Write
DisableSnapshotCopy	redshift:DisableSnapshotCopy			Write
DisassociateDataShareConsumer	redshift:DisassociateDataShareConsumer			Write
EnableLogging	redshift:EnableLogging			Write
EnableSnapshotCopy	redshift:EnableSnapshotCopy			Write
FailoverPrimaryCompute	redshift:FailoverPrimaryCompute			Write
GetClusterCredentials	redshift:CreateClusterUser			Permissions management, Write
	redshift:GetClusterCredentials			Write
	redshift:JoinGroup			Permissions management, Write
GetClusterCredentialsWithIAM	redshift:GetClusterCredentialsWithIAM			Write
GetIdentityCenterAuthToken	redshift:GetIdentityCenterAuthToken			Read
GetReservedNodeExchangeConfigurationOptions	redshift:GetReservedNodeExchangeConfigurationOptions			Read
GetReservedNodeExchangeOfferings	redshift:GetReservedNodeExchangeOfferings			Read
GetResourcePolicy	redshift:GetResourcePolicy			Read
ListRecommendations	redshift:ListRecommendations			List
ListRecommendations	redshift:ViewQueriesInConsole			List
ModifyAquaConfiguration	redshift:ModifyAquaConfiguration			Write
ModifyAuthenticationProfile	redshift:ModifyAuthenticationProfile			Write
ModifyCluster	redshift:ModifyCluster			Write
ModifyClusterDbRevision	redshift:ModifyClusterDbRevision			Write
ModifyClusterIamRoles	redshift:ModifyClusterIamRoles			Permissions management, Write
ModifyClusterIamRoles	iam:PassRole	iam:PassedToService	redshift.amazonaws.com	Write
ModifyClusterMaintenance	redshift:ModifyClusterMaintenance			Write
ModifyClusterParameterGroup	redshift:ModifyClusterParameterGroup			Write
ModifyClusterSnapshot	redshift:ModifyClusterSnapshot			Write
ModifyClusterSnapshotSchedule	redshift:ModifyClusterSnapshotSchedule			Write
ModifyClusterSubnetGroup	redshift:ModifyClusterSubnetGroup			Write
ModifyCustomDomainAssociation	redshift:ModifyCustomDomainAssociation			Write
ModifyEndpointAccess	redshift:ModifyEndpointAccess			Write
ModifyEventSubscription	redshift:ModifyEventSubscription			Write
ModifyIntegration	redshift:ModifyIntegration			Write
ModifyLakehouseConfiguration	redshift:AssociateDataShareConsumer			Write
	redshift:DeregisterNamespace			Write
	redshift:RegisterNamespace			Write
	iam:PassRole	iam:PassedToService	redshift.amazonaws.com	Write
ModifyRedshiftIdcApplication	redshift:ModifyRedshiftIdcApplication			Write
ModifyScheduledAction	redshift:ModifyScheduledAction			Write
	redshift:PauseCluster			Write
	redshift:ResizeCluster			Write
	redshift:ResumeCluster			Write
	iam:PassRole	iam:PassedToService	redshift.amazonaws.com	Write
ModifySnapshotCopyRetentionPeriod	redshift:ModifySnapshotCopyRetentionPeriod			Write
ModifySnapshotSchedule	redshift:ModifySnapshotSchedule			Write
ModifyUsageLimit	redshift:ModifyUsageLimit			Write
PauseCluster	redshift:PauseCluster			Write
PurchaseReservedNodeOffering	redshift:PurchaseReservedNodeOffering			Write
PutResourcePolicy	redshift:PutResourcePolicy			Permissions management, Write
RebootCluster	redshift:RebootCluster			Write
RegisterNamespace	redshift:RegisterNamespace			Write
RejectDataShare	redshift:RejectDataShare			Permissions management, Write
ResetClusterParameterGroup	redshift:ResetClusterParameterGroup			Write
ResizeCluster	redshift:ResizeCluster			Write
RestoreFromClusterSnapshot	redshift:AssociateDataShareConsumer			Write
	redshift:RegisterNamespace			Write
	redshift:RestoreFromClusterSnapshot			Write
	iam:PassRole	iam:PassedToService	redshift.amazonaws.com	Write
RestoreTableFromClusterSnapshot	redshift:RestoreTableFromClusterSnapshot			Write
ResumeCluster	redshift:ResumeCluster			Write
RevokeClusterSecurityGroupIngress	redshift:RevokeClusterSecurityGroupIngress			Write
RevokeEndpointAccess	redshift:RevokeEndpointAccess			Permissions management, Write
RevokeSnapshotAccess	redshift:RevokeSnapshotAccess			Permissions management, Write
RotateEncryptionKey	redshift:RotateEncryptionKey			Write
UpdatePartnerStatus	redshift:UpdatePartnerStatus			Write

Actions defined by Amazon Redshift

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptReservedNodeExchange	Grants permission to exchange a DC1 reserved node for a DC2 reserved node with no changes to the configuration			Write
AddPartner	Grants permission to add a partner integration to a cluster			Write
AssociateDataShareConsumer	Grants permission to associate a consumer to a datashare	datashare*	aws:ResourceTag/${TagKey} redshift:AllowWrites redshift:ConsumerArn	Write
AuthorizeClusterSecurityGroupIngress	Grants permission to add an inbound (ingress) rule to an Amazon Redshift security group	securitygroup*	aws:ResourceTag/${TagKey}	Write
AuthorizeClusterSecurityGroupIngress		securitygroupingress-ec2securitygroup*	aws:ResourceTag/${TagKey}	Write
AuthorizeDataShare	Grants permission to authorize the specified datashare consumer to consume a datashare	datashare*	aws:ResourceTag/${TagKey} redshift:AllowWrites redshift:ConsumerIdentifier	Permissions management, Write
AuthorizeEndpointAccess	Grants permission to authorize endpoint related activities for redshift-managed vpc endpoint	cluster	aws:ResourceTag/${TagKey}	Permissions management, Write
AuthorizeSnapshotAccess	Grants permission to the specified Amazon Web Services account to restore a snapshot	cluster	aws:ResourceTag/${TagKey}	Permissions management, Write
AuthorizeSnapshotAccess		snapshot*	aws:ResourceTag/${TagKey}	Permissions management, Write
BatchDeleteClusterSnapshots	Grants permission to delete snapshots in a batch of size upto 100	snapshot*	aws:ResourceTag/${TagKey}	Write
BatchModifyClusterSnapshots	Grants permission to modify settings for a list of snapshots	snapshot*	aws:ResourceTag/${TagKey}	Write
CancelResize	Grants permission to cancel a resize operation	cluster*	aws:ResourceTag/${TagKey}	Write
CopyClusterSnapshot	Grants permission to copy a cluster snapshot	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CopyClusterSnapshot	Grants permission to copy a cluster snapshot	snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAuthenticationProfile	Grants permission to create an Amazon Redshift authentication profile			Write
CreateCluster	Grants permission to create a cluster	cluster*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateClusterParameterGroup	Grants permission to create an Amazon Redshift parameter group	parametergroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateClusterSecurityGroup	Grants permission to create an Amazon Redshift security group	securitygroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateClusterSnapshot	Grants permission to create a manual snapshot of the specified cluster	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateClusterSnapshot		snapshot*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateClusterSubnetGroup	Grants permission to create an Amazon Redshift subnet group	subnetgroup*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateClusterUser	Grants permission to automatically create the specified Amazon Redshift user if it does not exist	dbuser*	redshift:DbUser	Permissions management, Write
CreateCustomDomainAssociation	Grants permission to create a custom domain name for a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
CreateEndpointAccess	Grants permission to create a redshift-managed vpc endpoint	cluster	aws:ResourceTag/${TagKey}	Write
CreateEventSubscription	Grants permission to create an Amazon Redshift event notification subscription	eventsubscription*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateHsmClientCertificate	Grants permission to create an HSM client certificate that a cluster uses to connect to an HSM	hsmclientcertificate*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateHsmConfiguration	Grants permission to create an HSM configuration that contains information required by a cluster to store and use database encryption keys in a hardware security module (HSM)	hsmconfiguration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateIntegration	Grants permission to create an Amazon Redshift zero-ETL integration	integration*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys redshift:IntegrationSourceArn redshift:IntegrationTargetArn	Write
CreateRedshiftIdcApplication	Grants permission to create a redshift idc application			Write
CreateScheduledAction	Grants permission to create an Amazon Redshift scheduled action			Write
CreateSnapshotCopyGrant	Grants permission to create a snapshot copy grant and encrypt copied snapshots in a destination Amazon Web Services Region	snapshotcopygrant*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Permissions management, Write
CreateSnapshotSchedule	Grants permission to create a snapshot schedule	snapshotschedule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTags	Grants permission to add one or more tags to a specified resource	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		eventsubscription	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		hsmclientcertificate	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		hsmconfiguration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		integration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		parametergroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		securitygroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		securitygroupingress-cidr	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		securitygroupingress-ec2securitygroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		snapshot	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		snapshotcopygrant	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		snapshotschedule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		subnetgroup	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		usagelimit	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateUsageLimit	Grants permission to create a usage limit	cluster	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateUsageLimit	Grants permission to create a usage limit	usagelimit*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeauthorizeDataShare	Grants permission to remove permission from the specified datashare consumer to consume a datashare	datashare*	aws:ResourceTag/${TagKey} redshift:ConsumerIdentifier	Permissions management, Write
DeleteAuthenticationProfile	Grants permission to delete an Amazon Redshift authentication profile			Write
DeleteCluster	Grants permission to delete a previously provisioned cluster	cluster*	aws:ResourceTag/${TagKey}	Write
DeleteClusterParameterGroup	Grants permission to delete an Amazon Redshift parameter group	parametergroup*	aws:ResourceTag/${TagKey}	Write
DeleteClusterSecurityGroup	Grants permission to delete an Amazon Redshift security group	securitygroup*	aws:ResourceTag/${TagKey}	Write
DeleteClusterSnapshot	Grants permission to delete a manual snapshot	cluster	aws:ResourceTag/${TagKey}	Write
DeleteClusterSnapshot	Grants permission to delete a manual snapshot	snapshot*	aws:ResourceTag/${TagKey}	Write
DeleteClusterSubnetGroup	Grants permission to delete a cluster subnet group	subnetgroup*	aws:ResourceTag/${TagKey}	Write
DeleteCustomDomainAssociation	Grants permission to delete a custom domain name for a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
DeleteEndpointAccess	Grants permission to delete a redshift-managed vpc endpoint			Write
DeleteEventSubscription	Grants permission to delete an Amazon Redshift event notification subscription	eventsubscription*	aws:ResourceTag/${TagKey}	Write
DeleteHsmClientCertificate	Grants permission to delete an HSM client certificate	hsmclientcertificate*	aws:ResourceTag/${TagKey}	Write
DeleteHsmConfiguration	Grants permission to delete an Amazon Redshift HSM configuration	hsmconfiguration*	aws:ResourceTag/${TagKey}	Write
DeleteIntegration	Grants permission to delete an Amazon Redshift zero-ETL integration	integration*	aws:ResourceTag/${TagKey}	Write
DeletePartner	Grants permission to delete a partner integration from a cluster	cluster	aws:ResourceTag/${TagKey}	Write
DeleteRedshiftIdcApplication	Grants permission to delete a redshift idc application	redshiftidcapplication*		Write
DeleteResourcePolicy	Grants permission to delete the resource policy for a specified resource	namespace*		Permissions management, Write
DeleteScheduledAction	Grants permission to delete an Amazon Redshift scheduled action			Write
DeleteSnapshotCopyGrant	Grants permission to delete a snapshot copy grant	snapshotcopygrant*	aws:ResourceTag/${TagKey}	Write
DeleteSnapshotSchedule	Grants permission to delete a snapshot schedule	snapshotschedule*	aws:ResourceTag/${TagKey}	Write
DeleteTags	Grants permission to delete a tag or tags from a resource	cluster	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		eventsubscription	aws:ResourceTag/${TagKey} aws:TagKeys
		hsmclientcertificate	aws:ResourceTag/${TagKey} aws:TagKeys
		hsmconfiguration	aws:ResourceTag/${TagKey} aws:TagKeys
		integration	aws:ResourceTag/${TagKey} aws:TagKeys
		parametergroup	aws:ResourceTag/${TagKey} aws:TagKeys
		securitygroup	aws:ResourceTag/${TagKey} aws:TagKeys
		securitygroupingress-cidr	aws:ResourceTag/${TagKey} aws:TagKeys
		securitygroupingress-ec2securitygroup	aws:ResourceTag/${TagKey} aws:TagKeys
		snapshot	aws:ResourceTag/${TagKey} aws:TagKeys
		snapshotcopygrant	aws:ResourceTag/${TagKey} aws:TagKeys
		snapshotschedule	aws:ResourceTag/${TagKey} aws:TagKeys
		subnetgroup	aws:ResourceTag/${TagKey} aws:TagKeys
		usagelimit	aws:ResourceTag/${TagKey} aws:TagKeys
DeleteUsageLimit	Grants permission to delete a usage limit	usagelimit*	aws:ResourceTag/${TagKey}	Write
DeregisterNamespace	Grants permission to deregister the specified namespace from a consumer			Write
DescribeAccountAttributes	Grants permission to describe attributes attached to the specified Amazon Web Services account			Read
DescribeAuthenticationProfiles	Grants permission to describe created Amazon Redshift authentication profiles			Read
DescribeClusterDbRevisions	Grants permission to describe database revisions for a cluster			List
DescribeClusterParameterGroups	Grants permission to describe Amazon Redshift parameter groups, including parameter groups you created and the default parameter group			Read
DescribeClusterParameters	Grants permission to describe parameters contained within an Amazon Redshift parameter group	parametergroup*	aws:ResourceTag/${TagKey}	Read
DescribeClusterSecurityGroups	Grants permission to describe Amazon Redshift security groups			Read
DescribeClusterSnapshots	Grants permission to describe one or more snapshot objects, which contain metadata about your cluster snapshots	cluster	aws:ResourceTag/${TagKey}	Read
DescribeClusterSubnetGroups	Grants permission to describe one or more cluster subnet group objects, which contain metadata about your cluster subnet groups			Read
DescribeClusterTracks	Grants permission to describe available maintenance tracks			List
DescribeClusterVersions	Grants permission to describe available Amazon Redshift cluster versions			Read
DescribeClusters	Grants permission to describe properties of provisioned clusters	cluster	aws:ResourceTag/${TagKey}	List
DescribeCustomDomainAssociations	Grants permission to describe custom domain names for a cluster			List
DescribeDataShares	Grants permission to describe datashares created and consumed by your clusters			Read
DescribeDataSharesForConsumer	Grants permission to describe only datashares consumed by your clusters			Read
DescribeDataSharesForProducer	Grants permission to describe only datashares created by your clusters			Read
DescribeDefaultClusterParameters	Grants permission to describe parameter settings for a parameter group family			Read
DescribeEndpointAccess	Grants permission to describe redshift-managed vpc endpoints	cluster	aws:ResourceTag/${TagKey}	Read
DescribeEndpointAuthorization	Grants permission to authorize describe activity for redshift-managed vpc endpoint	cluster	aws:ResourceTag/${TagKey}	List
DescribeEventCategories	Grants permission to describe event categories for all event source types, or for a specified source type			Read
DescribeEventSubscriptions	Grants permission to describe Amazon Redshift event notification subscriptions for the specified Amazon Web Services account			Read
DescribeEvents	Grants permission to describe events related to clusters, security groups, snapshots, and parameter groups for the past 14 days			List
DescribeHsmClientCertificates	Grants permission to describe HSM client certificates			Read
DescribeHsmConfigurations	Grants permission to describe Amazon Redshift HSM configurations			Read
DescribeInboundIntegrations	Grants permission to list the inbound integrations		redshift:InboundIntegrationArn	List
DescribeIntegrations	Grants permission to describe an Amazon Redshift zero-ETL integration	integration*	aws:ResourceTag/${TagKey}	List
DescribeLoggingStatus	Grants permission to describe whether information, such as queries and connection attempts, is being logged for a cluster	cluster*	aws:ResourceTag/${TagKey}	Read
DescribeNodeConfigurationOptions	Grants permission to describe properties of possible node configurations such as node type, number of nodes, and disk usage for the specified action type	cluster	aws:ResourceTag/${TagKey}	List
DescribeOrderableClusterOptions	Grants permission to describe orderable cluster options			Read
DescribePartners	Grants permission to retrieve information about the partner integrations defined for a cluster	cluster	aws:ResourceTag/${TagKey}	Read
DescribeRedshiftIdcApplications	Grants permission to describe redshift idc applications			List
DescribeReservedNodeExchangeStatus	Grants permission to describe exchange status details and associated metadata for a reserved-node exchange. Statuses include such values as in progress and requested			Read
DescribeReservedNodeOfferings	Grants permission to describe available reserved node offerings by Amazon Redshift			Read
DescribeReservedNodes	Grants permission to describe the reserved nodes			Read
DescribeResize	Grants permission to describe the last resize operation for a cluster	cluster*	aws:ResourceTag/${TagKey}	Read
DescribeScheduledActions	Grants permission to describe created Amazon Redshift scheduled actions			Read
DescribeSnapshotCopyGrants	Grants permission to describe snapshot copy grants owned by the specified Amazon Web Services account in the destination Amazon Web Services Region			Read
DescribeSnapshotSchedules	Grants permission to describe snapshot schedules	cluster	aws:ResourceTag/${TagKey}	Read
DescribeSnapshotSchedules	Grants permission to describe snapshot schedules	snapshotschedule*	aws:ResourceTag/${TagKey}	Read
DescribeStorage	Grants permission to describe account level backups storage size and provisional storage			Read
DescribeTableRestoreStatus	Grants permission to describe status of one or more table restore requests made using the RestoreTableFromClusterSnapshot API action	cluster	aws:ResourceTag/${TagKey}	Read
DescribeTags	Grants permission to describe tags	cluster	aws:ResourceTag/${TagKey}	Read
		eventsubscription	aws:ResourceTag/${TagKey}
		hsmclientcertificate	aws:ResourceTag/${TagKey}
		hsmconfiguration	aws:ResourceTag/${TagKey}
		integration	aws:ResourceTag/${TagKey}
		parametergroup	aws:ResourceTag/${TagKey}
		securitygroup	aws:ResourceTag/${TagKey}
		securitygroupingress-cidr	aws:ResourceTag/${TagKey}
		securitygroupingress-ec2securitygroup	aws:ResourceTag/${TagKey}
		snapshot	aws:ResourceTag/${TagKey}
		snapshotcopygrant	aws:ResourceTag/${TagKey}
		snapshotschedule	aws:ResourceTag/${TagKey}
		subnetgroup	aws:ResourceTag/${TagKey}
		usagelimit	aws:ResourceTag/${TagKey}
DescribeUsageLimits	Grants permission to describe usage limits	cluster	aws:ResourceTag/${TagKey}	Read
DescribeUsageLimits	Grants permission to describe usage limits	usagelimit*	aws:ResourceTag/${TagKey}	Read
DisableLogging	Grants permission to disable logging information, such as queries and connection attempts, for a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
DisableSnapshotCopy	Grants permission to disable the automatic copy of snapshots for a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
DisassociateDataShareConsumer	Grants permission to disassociate a consumer from a datashare	datashare*	aws:ResourceTag/${TagKey} redshift:ConsumerArn	Write
EnableLogging	Grants permission to enable logging information, such as queries and connection attempts, for a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
EnableSnapshotCopy	Grants permission to enable the automatic copy of snapshots for a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
FailoverPrimaryCompute	Grants permission to failover the primary compute of an Multi-AZ cluster to another AZ	cluster*	aws:ResourceTag/${TagKey}	Write
GetClusterCredentials	Grants permission to get temporary credentials to access an Amazon Redshift database by the specified Amazon Web Services account	dbname	redshift:DbName redshift:DbUser redshift:DurationSeconds	Write
GetClusterCredentials		dbuser*	redshift:DbName redshift:DbUser redshift:DurationSeconds	Write
GetClusterCredentialsWithIAM	Grants permission to get enhanced temporary credentials to access an Amazon Redshift database by the specified Amazon Web Services account	dbname	redshift:DbName redshift:DurationSeconds	Write
GetIdentityCenterAuthToken	Grants permission to get an authorized token for Identity Center users to access Redshift clusters	cluster*	aws:ResourceTag/${TagKey}	Read
GetReservedNodeExchangeConfigurationOptions	Grants permission to get the configuration options for the reserved-node exchange	cluster	aws:ResourceTag/${TagKey}	Read
GetReservedNodeExchangeOfferings	Grants permission to get an array of DC2 ReservedNodeOfferings that matches the payment type, term, and usage price of the given DC1 reserved node			Read
GetResourcePolicy	Grants permission to get the resource policy for a specified resource	namespace*		Read
JoinGroup	Grants permission to join the specified Amazon Redshift group	dbgroup*		Permissions management, Write
ListRecommendations	Grants permission to list Advisor recommendations	cluster	aws:ResourceTag/${TagKey}	List
ModifyAquaConfiguration	Grants permission to modify the AQUA configuration of a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
ModifyAuthenticationProfile	Grants permission to modify an existing Amazon Redshift authentication profile			Write
ModifyCluster	Grants permission to modify the settings of a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
ModifyClusterDbRevision	Grants permission to modify the database revision of a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
ModifyClusterIamRoles	Grants permission to modify the list of Amazon Identity and Access Management (IAM) roles that can be used by a cluster to access other Amazon services	cluster*	aws:ResourceTag/${TagKey}	Permissions management, Write
ModifyClusterMaintenance	Grants permission to modify the maintenance settings of a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
ModifyClusterParameterGroup	Grants permission to modify the parameters of a parameter group	parametergroup*	aws:ResourceTag/${TagKey}	Write
ModifyClusterSnapshot	Grants permission to modify the settings of a snapshot	snapshot*	aws:ResourceTag/${TagKey}	Write
ModifyClusterSnapshotSchedule	Grants permission to modify a snapshot schedule for a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
ModifyClusterSubnetGroup	Grants permission to modify a cluster subnet group to include the specified list of VPC subnets	subnetgroup*	aws:ResourceTag/${TagKey}	Write
ModifyCustomDomainAssociation	Grants permission to modify a custom domain name for a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
ModifyEndpointAccess	Grants permission to modify a redshift-managed vpc endpoint			Write
ModifyEventSubscription	Grants permission to modify an existing Amazon Redshift event notification subscription	eventsubscription*	aws:ResourceTag/${TagKey}	Write
ModifyIntegration	Grants permission to modify an Amazon Redshift zero-ETL integration	integration*	aws:ResourceTag/${TagKey}	Write
ModifyRedshiftIdcApplication	Grants permission to modify a redshift idc application	redshiftidcapplication*		Write
ModifyScheduledAction	Grants permission to modify an existing Amazon Redshift scheduled action			Write
ModifySnapshotCopyRetentionPeriod	Grants permission to modify the number of days to retain snapshots in the destination Amazon Web Services Region after they are copied from the source Amazon Web Services Region	cluster*	aws:ResourceTag/${TagKey}	Write
ModifySnapshotSchedule	Grants permission to modify a snapshot schedule	snapshotschedule*	aws:ResourceTag/${TagKey}	Write
ModifyUsageLimit	Grants permission to modify a usage limit	usagelimit*	aws:ResourceTag/${TagKey}	Write
PauseCluster	Grants permission to pause a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
PurchaseReservedNodeOffering	Grants permission to purchase a reserved node			Write
PutResourcePolicy	Grants permission to update the resource policy for a specified resource	namespace*		Permissions management, Write
RebootCluster	Grants permission to reboot a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
RegisterNamespace	Grants permission to register the specified namespace to a consumer			Write
RejectDataShare	Grants permission to decline a datashare shared from another account	datashare*	aws:ResourceTag/${TagKey}	Permissions management, Write
ResetClusterParameterGroup	Grants permission to set one or more parameters of a parameter group to their default values and set the source values of the parameters to "engine-default"	parametergroup*	aws:ResourceTag/${TagKey}	Write
ResizeCluster	Grants permission to change the size of a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
RestoreFromClusterSnapshot	Grants permission to create a cluster from a snapshot	cluster*	aws:ResourceTag/${TagKey} aws:TagKeys	Write
RestoreFromClusterSnapshot	Grants permission to create a cluster from a snapshot	snapshot*	aws:ResourceTag/${TagKey} aws:TagKeys	Write
RestoreTableFromClusterSnapshot	Grants permission to create a table from a table in an Amazon Redshift cluster snapshot	cluster*	aws:ResourceTag/${TagKey}	Write
RestoreTableFromClusterSnapshot		snapshot*	aws:ResourceTag/${TagKey}	Write
ResumeCluster	Grants permission to resume a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
RevokeClusterSecurityGroupIngress	Grants permission to revoke an ingress rule in an Amazon Redshift security group for a previously authorized IP range or Amazon EC2 security group	securitygroup*	aws:ResourceTag/${TagKey}	Write
RevokeClusterSecurityGroupIngress		securitygroupingress-ec2securitygroup*	aws:ResourceTag/${TagKey}	Write
RevokeEndpointAccess	Grants permission to revoke access for endpoint related activities for redshift-managed vpc endpoint	cluster	aws:ResourceTag/${TagKey}	Permissions management, Write
RevokeSnapshotAccess	Grants permission to revoke access from the specified Amazon Web Services account to restore a snapshot	cluster	aws:ResourceTag/${TagKey}	Permissions management, Write
RevokeSnapshotAccess		snapshot*	aws:ResourceTag/${TagKey}	Permissions management, Write
RotateEncryptionKey	Grants permission to rotate an encryption key for a cluster	cluster*	aws:ResourceTag/${TagKey}	Write
UpdatePartnerStatus	Grants permission to update the status of a partner integration	cluster	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon Redshift

The following actions are defined by Amazon Redshift but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AuthorizeInboundIntegration	Grants permission to Amazon Redshift to continuously validate that the target namespace can receive data replicated from the source ARN	namespace*		Write
CancelQuery	Grants permission to cancel a query through the Amazon Redshift console			Write
CancelQuerySession	Grants permission to see queries in the Amazon Redshift console	cluster	aws:ResourceTag/${TagKey}	Write
CreateInboundIntegration	Grants permission to the source principal to create an integration into the namespace of target data warehouse	namespace*		Write
CreateQev2IdcApplication	Grants permission to create a qev2 idc application			Write
CreateSavedQuery	Grants permission to create saved SQL queries through the Amazon Redshift console			Write
DeleteQev2IdcApplication	Grants permission to delete a qev2 idc application	qev2idcapplication*		Write
DeleteSavedQueries	Grants permission to delete saved SQL queries through the Amazon Redshift console			Write
DescribeAutonomicsDenylist	Grants permission to describe the list of resources that are denylisted from global autonomics decisions for a specified cluster	cluster*	aws:ResourceTag/${TagKey}	Read
DescribeQev2IdcApplications	Grants permission to describe qev2 idc applications			List
DescribeQuery	Grants permission to describe a query through the Amazon Redshift console			Read
DescribeSavedQueries	Grants permission to describe saved queries through the Amazon Redshift console			Read
DescribeTable	Grants permission to describe a table through the Amazon Redshift console			Read
ExecuteQuery	Grants permission to execute a query through the Amazon Redshift console			Write
FetchResults	Grants permission to fetch query results through the Amazon Redshift console			Read
ListDatabases	Grants permission to list databases through the Amazon Redshift console			List
ListSavedQueries	Grants permission to list saved queries through the Amazon Redshift console			List
ListSchemas	Grants permission to list schemas through the Amazon Redshift console			List
ListTables	Grants permission to list tables through the Amazon Redshift console			List
ModifyAutonomicsDenylist	Grants permission to add or remove resources from the global autonomics denylist for a specified cluster	cluster*	aws:ResourceTag/${TagKey}	Write
ModifyQev2IdcApplication	Grants permission to modify a qev2 idc application	qev2idcapplication*		Write
ModifySavedQuery	Grants permission to modify an existing saved query through the Amazon Redshift console			Write
ViewQueriesFromConsole	Grants permission to view query results through the Amazon Redshift console			List
ViewQueriesInConsole	Grants permission to terminate running queries and loads through the Amazon Redshift console	cluster	aws:ResourceTag/${TagKey}	List

Resource types defined by Amazon Redshift

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
cluster	arn:${Partition}:redshift:${Region}:${Account}:cluster:${ClusterName}	aws:ResourceTag/${TagKey}
datashare	arn:${Partition}:redshift:${Region}:${Account}:datashare:${ProducerClusterNamespace}/${DataShareName}	aws:ResourceTag/${TagKey}
dbgroup	arn:${Partition}:redshift:${Region}:${Account}:dbgroup:${ClusterName}/${DbGroup}
dbname	arn:${Partition}:redshift:${Region}:${Account}:dbname:${ClusterName}/${DbName}
dbuser	arn:${Partition}:redshift:${Region}:${Account}:dbuser:${ClusterName}/${DbUser}
eventsubscription	arn:${Partition}:redshift:${Region}:${Account}:eventsubscription:${EventSubscriptionName}	aws:ResourceTag/${TagKey}
hsmclientcertificate	arn:${Partition}:redshift:${Region}:${Account}:hsmclientcertificate:${HSMClientCertificateId}	aws:ResourceTag/${TagKey}
hsmconfiguration	arn:${Partition}:redshift:${Region}:${Account}:hsmconfiguration:${HSMConfigurationId}	aws:ResourceTag/${TagKey}
integration	arn:${Partition}:redshift:${Region}:${Account}:integration:${IntegrationIdentifier}	aws:ResourceTag/${TagKey}
namespace	arn:${Partition}:redshift:${Region}:${Account}:namespace:${ClusterNamespace}
parametergroup	arn:${Partition}:redshift:${Region}:${Account}:parametergroup:${ParameterGroupName}	aws:ResourceTag/${TagKey}
qev2idcapplication	arn:${Partition}:redshift:${Region}:${Account}:qev2idcapplication:${Qev2IdcApplicationId}
redshiftidcapplication	arn:${Partition}:redshift:${Region}:${Account}:redshiftidcapplication:${RedshiftIdcApplicationId}
securitygroup	arn:${Partition}:redshift:${Region}:${Account}:securitygroup:${SecurityGroupName}/ec2securitygroup/${Owner}/${Ec2SecurityGroupId}	aws:ResourceTag/${TagKey}
securitygroupingress-cidr	arn:${Partition}:redshift:${Region}:${Account}:securitygroupingress:${SecurityGroupName}/cidrip/${IpRange}	aws:ResourceTag/${TagKey}
securitygroupingress-ec2securitygroup	arn:${Partition}:redshift:${Region}:${Account}:securitygroupingress:${SecurityGroupName}/ec2securitygroup/${Owner}/${Ece2SecuritygroupId}	aws:ResourceTag/${TagKey}
snapshot	arn:${Partition}:redshift:${Region}:${Account}:snapshot:${ClusterName}/${SnapshotName}	aws:ResourceTag/${TagKey}
snapshotcopygrant	arn:${Partition}:redshift:${Region}:${Account}:snapshotcopygrant:${SnapshotCopyGrantName}	aws:ResourceTag/${TagKey}
snapshotschedule	arn:${Partition}:redshift:${Region}:${Account}:snapshotschedule:${ScheduleIdentifier}	aws:ResourceTag/${TagKey}
subnetgroup	arn:${Partition}:redshift:${Region}:${Account}:subnetgroup:${SubnetGroupName}	aws:ResourceTag/${TagKey}
usagelimit	arn:${Partition}:redshift:${Region}:${Account}:usagelimit:${UsageLimitId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Redshift

Amazon Redshift defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by actions based on the allowed set of values for each of the tags	String
aws:ResourceTag/${TagKey}	Filters access by actions based on tag-value associated with the resource	String
aws:TagKeys	Filters access by actions based on the presence of mandatory tags in the request	ArrayOfString
redshift:AllowWrites	Filters access by the allowWrites input parameter	Bool
redshift:ConsumerArn	Filters access by the datashare consumer arn	ARN
redshift:ConsumerIdentifier	Filters access by the datashare consumer	String
redshift:DbName	Filters access by the database name	String
redshift:DbUser	Filters access by the database user name	String
redshift:DurationSeconds	Filters access by the number of seconds until a temporary credential set expires	String
redshift:InboundIntegrationArn	Filters access by the ARN of an inbound zero-ETL Integration resource	ARN
redshift:IntegrationSourceArn	Filters access by the ARN of a zero-ETL Integration source	ARN
redshift:IntegrationTargetArn	Filters access by the ARN of a zero-ETL Integration target	ARN

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon RDS IAM Authentication (rds-db)

Amazon Redshift Data API (redshift-data)