Actions, resources, and condition keys for Amazon Step Functions
Amazon Step Functions (service prefix: states) provides the following
service-specific operations, resources, actions, and condition keys for use in IAM permission
policies.
References:
-
Learn how to configure this service.
-
View a list of the API operations available for this service.
-
Learn how to secure this service and its resources by using IAM permission policies.
-
View the programmatic service authorization reference
for this service.
Topics
API operations defined by Amazon Step Functions
The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.
| Operation | IAM action | Condition key | Possible value(s) | Access level |
|---|---|---|---|---|
|
CreateActivity |
Write |
|||
Tagging, Write |
||||
|
CreateStateMachine |
Write |
|||
Write |
||||
Tagging, Write |
||||
iam:PassedToService |
states.amazonaws.com |
Write |
||
|
CreateStateMachineAlias |
Write |
|||
|
DeleteActivity |
Write |
|||
|
DeleteStateMachine |
Write |
|||
|
DeleteStateMachineAlias |
Write |
|||
|
DeleteStateMachineVersion |
Write |
|||
|
DescribeActivity |
Read |
|||
|
DescribeExecution |
Read |
|||
|
DescribeMapRun |
Read |
|||
|
DescribeStateMachine |
Read |
|||
|
DescribeStateMachineAlias |
Read |
|||
|
DescribeStateMachineForExecution |
Read |
|||
|
GetActivityTask |
Write |
|||
|
GetExecutionHistory |
Read |
|||
|
ListActivities |
List |
|||
|
ListExecutions |
List |
|||
|
ListMapRuns |
List |
|||
|
ListStateMachineAliases |
List |
|||
|
ListStateMachineVersions |
List |
|||
|
ListStateMachines |
List |
|||
|
ListTagsForResource |
List |
|||
|
PublishStateMachineVersion |
Write |
|||
|
RedriveExecution |
Write |
|||
|
SendTaskFailure |
Write |
|||
|
SendTaskHeartbeat |
Write |
|||
|
SendTaskSuccess |
Write |
|||
|
StartExecution |
Read |
|||
Write |
||||
|
StartSyncExecution |
Write |
|||
|
StopExecution |
Write |
|||
|
TagResource |
Tagging, Write |
|||
|
TestState |
Read |
|||
Write |
||||
iam:PassedToService |
states.amazonaws.com |
Write |
||
|
UntagResource |
Tagging, Write |
|||
|
UpdateMapRun |
Write |
|||
|
UpdateStateMachine |
Write |
|||
Write |
||||
iam:PassedToService |
states.amazonaws.com |
Write |
||
|
UpdateStateMachineAlias |
Write |
|||
|
ValidateStateMachineDefinition |
Read |
Actions defined by Amazon Step Functions
You can specify the following actions in the Action element of an IAM
policy statement. Use policies to grant permissions to perform an operation in Amazon. When
you use an action in a policy, you usually allow or deny access to the API operation or CLI
command with the same name. However, in some cases, a single action controls access to more
than one operation. Alternatively, some operations require several different actions.
| Actions | Description | Resource types (*required) | Condition keys | Access level |
|---|---|---|---|---|
Grants permission to create an activity |
Write |
|||
Grants permission to create a state machine |
Write |
|||
Grants permission to create a state machine alias |
Write |
|||
Grants permission to delete an activity |
Write |
|||
Grants permission to delete a state machine |
Write |
|||
Grants permission to delete a state machine alias |
Write |
|||
Grants permission to delete a state machine version |
Write |
|||
Grants permission to describe an activity |
Read |
|||
Grants permission to describe an execution |
Read |
|||
Grants permission to describe a map run |
Read |
|||
Grants permission to describe a state machine |
Read |
|||
Grants permission to describe a state machine alias |
Read |
|||
Grants permission to describe the state machine for an execution |
Read |
|||
Grants permission to be used by workers to retrieve a task (with the specified activity ARN) which has been scheduled for execution by a running state machine |
Write |
|||
Grants permission to return the history of the specified execution as a list of events |
Read |
|||
Grants permission to list the existing activities |
List |
|||
Grants permission to list the executions of a state machine |
List |
|||
Grants permission to list the map runs of an execution |
List |
|||
Grants permission to list the aliases of a state machine |
List |
|||
Grants permission to list the versions of a state machine |
List |
|||
Grants permission to lists the existing state machines |
List |
|||
Grants permission to list tags for an Amazon Step Functions resource |
List |
|||
Grants permission to publish a state machine version |
Write |
|||
Grants permission to redrive an execution |
Write |
|||
Grants permission to report that the task identified by the taskToken failed |
Write |
|||
Grants permission to report to the service that the task represented by the specified taskToken is still making progress |
Write |
|||
Grants permission to report that the task identified by the taskToken completed successfully |
Write |
|||
Grants permission to start a state machine execution |
Write |
|||
Grants permission to start a Synchronous Express state machine execution |
Write |
|||
Grants permission to stop an execution |
Write |
|||
Grants permission to tag an Amazon Step Functions resource |
Tagging, Write |
|||
Grants permission to test a state machine definition |
Write |
|||
Grants permission to remove a tag from an Amazon Step Functions resource |
Tagging, Write |
|||
Grants permission to update a map run |
Write |
|||
Grants permission to update a state machine |
Write |
|||
Grants permission to update a state machine alias |
Write |
|||
Grants permission to validate a state machine definition |
Read |
Permission-only actions for Amazon Step Functions
The following actions are defined by Amazon Step Functions but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.
| Actions | Description | Resource types (*required) | Condition keys | Access level |
|---|---|---|---|---|
Grants permission to invoke the HTTP Task state |
Write |
|||
Grants permission to reveal sensitive data from an execution |
Read |
Resource types defined by Amazon Step Functions
The following resource types are defined by this service and can be used in the
Resource element of IAM permission policy statements.
| Resource types | ARN | Condition keys |
|---|---|---|
arn:${Partition}:states:${Region}:${Account}:activity:${ActivityName} |
||
arn:${Partition}:states:${Region}:${Account}:execution:${StateMachineName}:${ExecutionId} |
||
arn:${Partition}:states:${Region}:${Account}:express:${StateMachineName}:${ExecutionId}:${ExpressId} |
||
arn:${Partition}:states:${Region}:${Account}:execution:${StateMachineName}/${MapRunLabel}:${ExecutionId} |
||
arn:${Partition}:states:${Region}:${Account}:express:${StateMachineName}/${MapRunLabel}:${ExecutionId}:${ExpressId} |
||
arn:${Partition}:states:${Region}:${Account}:mapRun:${StateMachineName}/${MapRunLabel}:${MapRunId} |
||
arn:${Partition}:states:${Region}:${Account}:stateMachine:${StateMachineName} |
||
arn:${Partition}:states:${Region}:${Account}:stateMachine:${StateMachineName}:${StateMachineAliasName} |
||
arn:${Partition}:states:${Region}:${Account}:stateMachine:${StateMachineName}:${StateMachineVersionId} |
Condition keys for Amazon Step Functions
Amazon Step Functions defines the following condition keys that can be used in the
Condition element of an IAM policy.
| Condition keys | Description | Type |
|---|---|---|
Filters access by a tag key and value pair that is allowed in the request |
String |
|
Filters access by a tag key and value pair of a resource |
String |
|
Filters access by a list of tag keys that are allowed in the request |
ArrayOfString |
|
Filters access by the endpoint that the HTTP Task state allows in the request |
String |
|
Filters access by the method that the HTTP Task state allows in the request |
String |
|
Filters access by the qualifier of a state machine ARN |
ArrayOfString |