Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Route 53 Resolver

Amazon Route 53 Resolver (service prefix: route53resolver) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Route 53 Resolver
Actions defined by Amazon Route 53 Resolver
Resource types defined by Amazon Route 53 Resolver
Condition keys for Amazon Route 53 Resolver

API operations defined by Amazon Route 53 Resolver

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Access level
AssociateFirewallRuleGroup	route53resolver:AssociateFirewallRuleGroup	Write
AssociateFirewallRuleGroup	route53resolver:TagResource	Tagging, Write
AssociateResolverEndpointIpAddress	route53resolver:AssociateResolverEndpointIpAddress	Write
AssociateResolverQueryLogConfig	route53resolver:AssociateResolverQueryLogConfig	Write
AssociateResolverRule	route53resolver:AssociateResolverRule	Write
BatchCreateFirewallRule	route53resolver:CreateFirewallRule	Write
BatchDeleteFirewallRule	route53resolver:DeleteFirewallRule	Write
BatchUpdateFirewallRule	route53resolver:UpdateFirewallRule	Write
CreateFirewallDomainList	route53resolver:CreateFirewallDomainList	Write
CreateFirewallDomainList	route53resolver:TagResource	Tagging, Write
CreateFirewallRule	route53resolver:CreateFirewallRule	Write
CreateFirewallRuleGroup	route53resolver:CreateFirewallRuleGroup	Write
CreateFirewallRuleGroup	route53resolver:TagResource	Tagging, Write
CreateOutpostResolver	route53resolver:CreateOutpostResolver	Write
CreateOutpostResolver	route53resolver:TagResource	Tagging, Write
CreateResolverEndpoint	route53resolver:CreateResolverEndpoint	Write
CreateResolverEndpoint	route53resolver:TagResource	Tagging, Write
CreateResolverQueryLogConfig	route53resolver:CreateResolverQueryLogConfig	Write
CreateResolverQueryLogConfig	route53resolver:TagResource	Tagging, Write
CreateResolverRule	route53resolver:CreateResolverRule	Write
CreateResolverRule	route53resolver:TagResource	Tagging, Write
DeleteFirewallDomainList	route53resolver:DeleteFirewallDomainList	Write
DeleteFirewallRule	route53resolver:DeleteFirewallRule	Write
DeleteFirewallRuleGroup	route53resolver:DeleteFirewallRuleGroup	Write
DeleteOutpostResolver	route53resolver:DeleteOutpostResolver	Write
DeleteResolverEndpoint	route53resolver:DeleteResolverEndpoint	Write
DeleteResolverQueryLogConfig	route53resolver:DeleteResolverQueryLogConfig	Write
DeleteResolverRule	route53resolver:DeleteResolverRule	Write
DisassociateFirewallRuleGroup	route53resolver:DisassociateFirewallRuleGroup	Write
DisassociateResolverEndpointIpAddress	route53resolver:DisassociateResolverEndpointIpAddress	Write
DisassociateResolverQueryLogConfig	route53resolver:DisassociateResolverQueryLogConfig	Write
DisassociateResolverRule	route53resolver:DisassociateResolverRule	Write
GetFirewallConfig	route53resolver:GetFirewallConfig	Read
GetFirewallDomainList	route53resolver:GetFirewallDomainList	Read
GetFirewallRuleGroup	route53resolver:GetFirewallRuleGroup	Read
GetFirewallRuleGroupAssociation	route53resolver:GetFirewallRuleGroupAssociation	Read
GetFirewallRuleGroupPolicy	route53resolver:GetFirewallRuleGroupPolicy	Read
GetOutpostResolver	route53resolver:GetOutpostResolver	Read
GetResolverConfig	route53resolver:GetResolverConfig	Read
GetResolverDnssecConfig	route53resolver:GetResolverDnssecConfig	Read
GetResolverEndpoint	route53resolver:GetResolverEndpoint	Read
GetResolverQueryLogConfig	route53resolver:GetResolverQueryLogConfig	Read
GetResolverQueryLogConfigAssociation	route53resolver:GetResolverQueryLogConfigAssociation	Read
GetResolverQueryLogConfigPolicy	route53resolver:GetResolverQueryLogConfigPolicy	Read
GetResolverRule	route53resolver:GetResolverRule	Read
GetResolverRuleAssociation	route53resolver:GetResolverRuleAssociation	Read
GetResolverRulePolicy	route53resolver:GetResolverRulePolicy	Read
ImportFirewallDomains	route53resolver:ImportFirewallDomains	Write
ListFirewallConfigs	route53resolver:ListFirewallConfigs	List
ListFirewallDomainLists	route53resolver:ListFirewallDomainLists	List
ListFirewallDomains	route53resolver:ListFirewallDomains	List
ListFirewallRuleGroupAssociations	route53resolver:ListFirewallRuleGroupAssociations	List
ListFirewallRuleGroups	route53resolver:ListFirewallRuleGroups	List
ListFirewallRuleTypes	route53resolver:ListFirewallRuleTypes	List
ListFirewallRules	route53resolver:ListFirewallRules	List
ListOutpostResolvers	route53resolver:ListOutpostResolvers	List
ListResolverConfigs	route53resolver:ListResolverConfigs	List
ListResolverDnssecConfigs	route53resolver:ListResolverDnssecConfigs	List
ListResolverEndpointIpAddresses	route53resolver:ListResolverEndpointIpAddresses	List
ListResolverEndpoints	route53resolver:ListResolverEndpoints	List
ListResolverQueryLogConfigAssociations	route53resolver:ListResolverQueryLogConfigAssociations	List
ListResolverQueryLogConfigs	route53resolver:ListResolverQueryLogConfigs	List
ListResolverRuleAssociations	route53resolver:ListResolverRuleAssociations	List
ListResolverRules	route53resolver:ListResolverRules	List
ListTagsForResource	route53resolver:ListTagsForResource	Read
PutFirewallRuleGroupPolicy	route53resolver:PutFirewallRuleGroupPolicy	Permissions management, Write
PutResolverQueryLogConfigPolicy	route53resolver:PutResolverQueryLogConfigPolicy	Permissions management, Write
PutResolverRulePolicy	route53resolver:PutResolverRulePolicy	Permissions management, Write
TagResource	route53resolver:TagResource	Tagging, Write
UntagResource	route53resolver:UntagResource	Tagging, Write
UpdateFirewallConfig	route53resolver:UpdateFirewallConfig	Write
UpdateFirewallDomains	route53resolver:UpdateFirewallDomains	Write
UpdateFirewallRule	route53resolver:UpdateFirewallRule	Write
UpdateFirewallRuleGroupAssociation	route53resolver:UpdateFirewallRuleGroupAssociation	Write
UpdateOutpostResolver	route53resolver:UpdateOutpostResolver	Write
UpdateResolverConfig	route53resolver:UpdateResolverConfig	Write
UpdateResolverDnssecConfig	route53resolver:UpdateResolverDnssecConfig	Write
UpdateResolverEndpoint	route53resolver:UpdateResolverEndpoint	Write
UpdateResolverRule	route53resolver:UpdateResolverRule	Write

Actions defined by Amazon Route 53 Resolver

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AssociateFirewallRuleGroup	Grants permission to associate an Amazon VPC with a specified firewall rule group	firewall-rule-group-association*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
AssociateResolverEndpointIpAddress	Grants permission to associate a specified IP address with a Resolver endpoint. This is an IP address that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound)	resolver-endpoint*	aws:ResourceTag/${TagKey}	Write
AssociateResolverQueryLogConfig	Grants permission to associate an Amazon VPC with a specified query logging configuration	resolver-query-log-config*	aws:ResourceTag/${TagKey}	Write
AssociateResolverRule	Grants permission to associate a specified Resolver rule with a specified VPC	resolver-rule*	aws:ResourceTag/${TagKey}	Write
CreateFirewallDomainList	Grants permission to create a Firewall domain list	firewall-domain-list*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateFirewallRule	Grants permission to create a Firewall rule within a Firewall rule group	firewall-domain-list*	aws:ResourceTag/${TagKey}	Write
CreateFirewallRule		firewall-rule-group*	aws:ResourceTag/${TagKey}	Write
CreateFirewallRuleGroup	Grants permission to create a Firewall rule group	firewall-rule-group*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateOutpostResolver	Grants permission to create a Route 53 Resolver on Outposts	outpost-resolver*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateResolverEndpoint	Grants permission to create a Resolver endpoint. There are two types of Resolver endpoints, inbound and outbound	resolver-endpoint*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateResolverQueryLogConfig	Grants permission to create a Resolver query logging configuration, which defines where you want Resolver to save DNS query logs that originate in your VPCs	resolver-query-log-config*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateResolverRule	Grants permission to define how to route queries originating from your VPC out of the VPC	resolver-rule*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteFirewallDomainList	Grants permission to delete a Firewall domain list	firewall-domain-list*	aws:ResourceTag/${TagKey}	Write
DeleteFirewallRule	Grants permission to delete a Firewall rule within a Firewall rule group	firewall-domain-list*	aws:ResourceTag/${TagKey}	Write
DeleteFirewallRule		firewall-rule-group*	aws:ResourceTag/${TagKey}	Write
DeleteFirewallRuleGroup	Grants permission to delete a Firewall rule group	firewall-rule-group*	aws:ResourceTag/${TagKey}	Write
DeleteOutpostResolver	Grants permission to delete a Route 53 Resolver on Outposts	outpost-resolver*	aws:ResourceTag/${TagKey}	Write
DeleteResolverEndpoint	Grants permission to delete a Resolver endpoint. The effect of deleting a Resolver endpoint depends on whether it's an inbound or an outbound endpoint	resolver-endpoint*	aws:ResourceTag/${TagKey}	Write
DeleteResolverQueryLogConfig	Grants permission to delete a Resolver query logging configuration	resolver-query-log-config*	aws:ResourceTag/${TagKey}	Write
DeleteResolverRule	Grants permission to delete a Resolver rule	resolver-rule*	aws:ResourceTag/${TagKey}	Write
DisassociateFirewallRuleGroup	Grants permission to remove the association between a specified Firewall rule group and a specified VPC	firewall-rule-group-association*	aws:ResourceTag/${TagKey}	Write
DisassociateResolverEndpointIpAddress	Grants permission to remove a specified IP address from a Resolver endpoint. This is an IP address that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound)	resolver-endpoint*	aws:ResourceTag/${TagKey}	Write
DisassociateResolverQueryLogConfig	Grants permission to remove the association between a specified Resolver query logging configuration and a specified VPC	resolver-query-log-config*	aws:ResourceTag/${TagKey}	Write
DisassociateResolverRule	Grants permission to remove the association between a specified Resolver rule and a specified VPC	resolver-rule*	aws:ResourceTag/${TagKey}	Write
GetFirewallConfig	Grants permission to get information about a specified Firewall config	firewall-config*	aws:ResourceTag/${TagKey}	Read
GetFirewallDomainList	Grants permission to get information about a specified Firewall domain list	firewall-domain-list*	aws:ResourceTag/${TagKey}	Read
GetFirewallRuleGroup	Grants permission to get information about a specified Firewall rule group	firewall-rule-group*	aws:ResourceTag/${TagKey}	Read
GetFirewallRuleGroupAssociation	Grants permission to get information about an association between a specified Firewall rule group and a VPC	firewall-rule-group-association*	aws:ResourceTag/${TagKey}	Read
GetFirewallRuleGroupPolicy	Grants permission to get information about a specified Firewall rule group policy, which specifies the Firewall rule group operations and resources that you want to allow another Amazon Web Services account to use	firewall-rule-group*	aws:ResourceTag/${TagKey}	Read
GetOutpostResolver	Grants permission to get information about a specified Route 53 Resolver on Outposts	outpost-resolver*	aws:ResourceTag/${TagKey}	Read
GetResolverConfig	Grants permission to get the Resolver Config status within the specified resource	resolver-config*		Read
GetResolverDnssecConfig	Grants permission to get the DNSSEC validation support status for DNS queries within the specified resource	resolver-dnssec-config*	aws:ResourceTag/${TagKey}	Read
GetResolverEndpoint	Grants permission to get information about a specified Resolver endpoint, such as whether it's an inbound or an outbound endpoint, and the IP addresses in your VPC that DNS queries are forwarded to on the way into or out of your VPC	resolver-endpoint*	aws:ResourceTag/${TagKey}	Read
GetResolverQueryLogConfig	Grants permission to get information about a specified Resolver query logging configuration, such as the number of VPCs that the configuration is logging queries for and the location that logs are sent to	resolver-query-log-config*	aws:ResourceTag/${TagKey}	Read
GetResolverQueryLogConfigAssociation	Grants permission to get information about a specified association between a Resolver query logging configuration and an Amazon VPC. When you associate a VPC with a query logging configuration, Resolver logs DNS queries that originate in that VPC			Read
GetResolverQueryLogConfigPolicy	Grants permission to get information about a specified Resolver query logging policy, which specifies the Resolver query logging operations and resources that you want to allow another Amazon Web Services account to use	resolver-query-log-config*	aws:ResourceTag/${TagKey}	Read
GetResolverRule	Grants permission to get information about a specified Resolver rule, such as the domain name that the rule forwards DNS queries for and the IP address that queries are forwarded to	autodefined-rule	aws:ResourceTag/${TagKey}	Read
GetResolverRule		resolver-rule	aws:ResourceTag/${TagKey}	Read
GetResolverRuleAssociation	Grants permission to get information about an association between a specified Resolver rule and a VPC	autodefined-rule	aws:ResourceTag/${TagKey}	Read
GetResolverRuleAssociation		resolver-rule	aws:ResourceTag/${TagKey}	Read
GetResolverRulePolicy	Grants permission to get information about a Resolver rule policy, which specifies the Resolver operations and resources that you want to allow another Amazon Web Services account to use	resolver-rule*	aws:ResourceTag/${TagKey}	Read
ImportFirewallDomains	Grants permission to add, remove or replace Firewall domains in a Firewall domain list	firewall-domain-list*	aws:ResourceTag/${TagKey}	Write
ListFirewallConfigs	Grants permission to list all the Firewall config that current Amazon Web Services account is able to check			List
ListFirewallDomainLists	Grants permission to list all the Firewall domain list that current Amazon Web Services account is able to use			List
ListFirewallDomains	Grants permission to list all the Firewall domain under a specified Firewall domain list	firewall-domain-list*	aws:ResourceTag/${TagKey}	List
ListFirewallRuleGroupAssociations	Grants permission to list information about associations between Amazon VPCs and Firewall rule group			List
ListFirewallRuleGroups	Grants permission to list all the Firewall rule group that current Amazon Web Services account is able to use			List
ListFirewallRuleTypes	Grants permission to list the types of Firewall rules that are available for use, including firewall advanced content category			List
ListFirewallRules	Grants permission to list all the Firewall rule under a specified Firewall rule group	firewall-rule-group*	aws:ResourceTag/${TagKey}	List
ListOutpostResolvers	Grants permission to list all instances of Route 53 Resolver on Outposts that were created using the current Amazon Web Services account			List
ListResolverConfigs	Grants permission to list Resolver Config statuses	resolver-config*		List
ListResolverDnssecConfigs	Grants permission to list the DNSSEC validation support status for DNS queries	resolver-dnssec-config*	aws:ResourceTag/${TagKey}	List
ListResolverEndpointIpAddresses	Grants permission to list the IP addresses that DNS queries pass through on the way to your network (outbound) or your VPCs (inbound) for a specified Resolver endpoint	resolver-endpoint*	aws:ResourceTag/${TagKey}	List
ListResolverEndpoints	Grants permission to list all the Resolver endpoints that were created using the current Amazon Web Services account			List
ListResolverQueryLogConfigAssociations	Grants permission to list information about associations between Amazon VPCs and query logging configurations			List
ListResolverQueryLogConfigs	Grants permission to list information about the specified query logging configurations, which define where you want Resolver to save DNS query logs and specify the VPCs that you want to log queries for			List
ListResolverRuleAssociations	Grants permission to list the associations that were created between Resolver rules and VPCs using the current Amazon Web Services account			List
ListResolverRules	Grants permission to list the Resolver rules that were created using the current Amazon Web Services account			List
ListTagsForResource	Grants permission to list the tags that you associated with the specified resource	firewall-domain-list	aws:ResourceTag/${TagKey}	Read
		firewall-rule-group	aws:ResourceTag/${TagKey}
		firewall-rule-group-association	aws:ResourceTag/${TagKey}
		outpost-resolver	aws:ResourceTag/${TagKey}
		resolver-endpoint	aws:ResourceTag/${TagKey}
		resolver-query-log-config	aws:ResourceTag/${TagKey}
		resolver-rule	aws:ResourceTag/${TagKey}
PutFirewallRuleGroupPolicy	Grants permission to specify an Amazon Web Services account that you want to share a Firewall rule group with, the Firewall rule group that you want to share, and the operations that you want the account to be able to perform on the configuration	firewall-rule-group*	aws:ResourceTag/${TagKey}	Permissions management, Write
PutResolverQueryLogConfigPolicy	Grants permission to specify an Amazon Web Services account that you want to share a query logging configuration with, the query logging configuration that you want to share, and the operations that you want the account to be able to perform on the configuration	resolver-query-log-config*	aws:ResourceTag/${TagKey}	Permissions management, Write
PutResolverRulePolicy	Grants permission to specify an Amazon Web Services account that you want to share rules with, the Resolver rules that you want to share, and the operations that you want the account to be able to perform on those rules	resolver-rule*	aws:ResourceTag/${TagKey}	Permissions management, Write
TagResource	Grants permission to add one or more tags to a specified resource	firewall-config	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		firewall-domain-list	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		firewall-rule-group	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		firewall-rule-group-association	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		outpost-resolver	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		resolver-dnssec-config	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		resolver-endpoint	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		resolver-query-log-config	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		resolver-rule	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove one or more tags from a specified resource	firewall-config	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		firewall-domain-list	aws:ResourceTag/${TagKey} aws:TagKeys
		firewall-rule-group	aws:ResourceTag/${TagKey} aws:TagKeys
		firewall-rule-group-association	aws:ResourceTag/${TagKey} aws:TagKeys
		outpost-resolver	aws:ResourceTag/${TagKey} aws:TagKeys
		resolver-dnssec-config	aws:ResourceTag/${TagKey} aws:TagKeys
		resolver-endpoint	aws:ResourceTag/${TagKey} aws:TagKeys
		resolver-query-log-config	aws:ResourceTag/${TagKey} aws:TagKeys
		resolver-rule	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateFirewallConfig	Grants permission to update selected settings for an Firewall config	firewall-config*	aws:ResourceTag/${TagKey}	Write
UpdateFirewallDomains	Grants permission to add, remove or replace Firewall domains in a Firewall domain list	firewall-domain-list*	aws:ResourceTag/${TagKey}	Write
UpdateFirewallRule	Grants permission to update selected settings for an Firewall rule in a Firewall rule group	firewall-domain-list*	aws:ResourceTag/${TagKey}	Write
UpdateFirewallRule		firewall-rule-group*	aws:ResourceTag/${TagKey}	Write
UpdateFirewallRuleGroupAssociation	Grants permission to update selected settings for an Firewall rule group association	firewall-rule-group-association*	aws:ResourceTag/${TagKey}	Write
UpdateOutpostResolver	Grants permission to update seletected settings for a specified Route 53 Resolver on Outposts	outpost-resolver*	aws:ResourceTag/${TagKey}	Write
UpdateResolverConfig	Grants permission to update the Resolver Config status within the specified resource	resolver-config*		Write
UpdateResolverDnssecConfig	Grants permission to update the DNSSEC validation support status for DNS queries within the specified resource	resolver-dnssec-config*	aws:ResourceTag/${TagKey}	Write
UpdateResolverEndpoint	Grants permission to update selected settings for an inbound or an outbound Resolver endpoint	resolver-endpoint*	aws:ResourceTag/${TagKey}	Write
UpdateResolverRule	Grants permission to update settings for a specified Resolver rule	resolver-rule*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Route 53 Resolver

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
autodefined-rule	arn:${Partition}:route53resolver:${Region}:${Account}:autodefined-rule/${ResourceId}	aws:ResourceTag/${TagKey}
firewall-config	arn:${Partition}:route53resolver:${Region}:${Account}:firewall-config/${ResourceId}	aws:ResourceTag/${TagKey}
firewall-domain-list	arn:${Partition}:route53resolver:${Region}:${Account}:firewall-domain-list/${ResourceId}	aws:ResourceTag/${TagKey}
firewall-rule-group	arn:${Partition}:route53resolver:${Region}:${Account}:firewall-rule-group/${ResourceId}	aws:ResourceTag/${TagKey}
firewall-rule-group-association	arn:${Partition}:route53resolver:${Region}:${Account}:firewall-rule-group-association/${ResourceId}	aws:ResourceTag/${TagKey}
outpost-resolver	arn:${Partition}:route53resolver:${Region}:${Account}:outpost-resolver/${ResourceId}	aws:ResourceTag/${TagKey}
resolver-config	arn:${Partition}:route53resolver:${Region}:${Account}:resolver-config/${ResourceId}
resolver-dnssec-config	arn:${Partition}:route53resolver:${Region}:${Account}:resolver-dnssec-config/${ResourceId}	aws:ResourceTag/${TagKey}
resolver-endpoint	arn:${Partition}:route53resolver:${Region}:${Account}:resolver-endpoint/${ResourceId}	aws:ResourceTag/${TagKey}
resolver-query-log-config	arn:${Partition}:route53resolver:${Region}:${Account}:resolver-query-log-config/${ResourceId}	aws:ResourceTag/${TagKey}
resolver-rule	arn:${Partition}:route53resolver:${Region}:${Account}:resolver-rule/${ResourceId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Route 53 Resolver

Amazon Route 53 Resolver defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by the presence of tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Route 53 Profiles (route53profiles)

Amazon S3 (s3)