Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Simple Workflow Service

Amazon Simple Workflow Service (service prefix: swf) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Simple Workflow Service
Actions defined by Amazon Simple Workflow Service
Permission-only actions for Amazon Simple Workflow Service
Resource types defined by Amazon Simple Workflow Service
Condition keys for Amazon Simple Workflow Service

API operations defined by Amazon Simple Workflow Service

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CountClosedWorkflowExecutions	swf:CountClosedWorkflowExecutions			Read
CountOpenWorkflowExecutions	swf:CountOpenWorkflowExecutions			Read
CountPendingActivityTasks	swf:CountPendingActivityTasks			Read
CountPendingDecisionTasks	swf:CountPendingDecisionTasks			Read
DeleteActivityType	swf:DeleteActivityType			Write
DeleteWorkflowType	swf:DeleteWorkflowType			Write
DeprecateActivityType	swf:DeprecateActivityType			Write
DeprecateDomain	swf:DeprecateDomain			Write
DeprecateWorkflowType	swf:DeprecateWorkflowType			Write
DescribeActivityType	swf:DescribeActivityType			Read
DescribeDomain	swf:DescribeDomain			Read
DescribeWorkflowExecution	swf:DescribeWorkflowExecution			Read
DescribeWorkflowType	swf:DescribeWorkflowType			Read
GetWorkflowExecutionHistory	swf:GetWorkflowExecutionHistory			Read
ListActivityTypes	swf:ListActivityTypes			List
ListClosedWorkflowExecutions	swf:ListClosedWorkflowExecutions			List
ListDomains	swf:ListDomains			List
ListOpenWorkflowExecutions	swf:ListOpenWorkflowExecutions			List
ListTagsForResource	swf:ListTagsForResource			List
ListWorkflowTypes	swf:ListWorkflowTypes			List
PollForActivityTask	swf:PollForActivityTask			Write
PollForDecisionTask	swf:PollForDecisionTask			Write
RecordActivityTaskHeartbeat	swf:RecordActivityTaskHeartbeat			Write
RegisterActivityType	swf:RegisterActivityType			Write
RegisterDomain	swf:RegisterDomain			Write
RegisterDomain	swf:TagResource			Tagging, Write
RegisterWorkflowType	swf:RegisterWorkflowType			Write
RegisterWorkflowType	iam:PassRole	iam:PassedToService	swf.amazonaws.com	Write
RequestCancelWorkflowExecution	swf:RequestCancelWorkflowExecution			Write
RespondActivityTaskCanceled	swf:RespondActivityTaskCanceled			Write
RespondActivityTaskCompleted	swf:RespondActivityTaskCompleted			Write
RespondActivityTaskFailed	swf:RespondActivityTaskFailed			Write
RespondDecisionTaskCompleted	swf:RespondDecisionTaskCompleted			Write
RespondDecisionTaskCompleted	iam:PassRole	iam:PassedToService	swf.amazonaws.com	Write
SignalWorkflowExecution	swf:SignalWorkflowExecution			Write
StartWorkflowExecution	swf:StartWorkflowExecution			Write
StartWorkflowExecution	iam:PassRole	iam:PassedToService	swf.amazonaws.com	Write
TagResource	swf:TagResource			Tagging, Write
TerminateWorkflowExecution	swf:TerminateWorkflowExecution			Write
UndeprecateActivityType	swf:UndeprecateActivityType			Write
UndeprecateDomain	swf:UndeprecateDomain			Write
UndeprecateWorkflowType	swf:UndeprecateWorkflowType			Write
UntagResource	swf:UntagResource			Tagging, Write

Actions defined by Amazon Simple Workflow Service

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CountClosedWorkflowExecutions	Grants permission to return the number of closed workflow executions within the given domain that meet the specified filtering criteria	domain*	aws:ResourceTag/${TagKey} swf:tagFilter.tag swf:typeFilter.name swf:typeFilter.version	Read
CountOpenWorkflowExecutions	Grants permission to return the number of open workflow executions within the given domain that meet the specified filtering criteria	domain*	aws:ResourceTag/${TagKey} swf:tagFilter.tag swf:typeFilter.name swf:typeFilter.version	Read
CountPendingActivityTasks	Grants permission to return the estimated number of activity tasks in the specified task list	domain*	aws:ResourceTag/${TagKey} swf:taskList.name	Read
CountPendingDecisionTasks	Grants permission to return the estimated number of decision tasks in the specified task list	domain*	aws:ResourceTag/${TagKey} swf:taskList.name	Read
DeleteActivityType	Grants permission to delete the specified activity type	domain*	aws:ResourceTag/${TagKey} swf:activityType.name swf:activityType.version	Write
DeleteWorkflowType	Grants permission to delete the specified workflow type	domain*	aws:ResourceTag/${TagKey} swf:workflowType.name swf:workflowType.version	Write
DeprecateActivityType	Grants permission to deprecate the specified activity type	domain*	aws:ResourceTag/${TagKey} swf:activityType.name swf:activityType.version	Write
DeprecateDomain	Grants permission to deprecate the specified domain	domain*	aws:ResourceTag/${TagKey}	Write
DeprecateWorkflowType	Grants permission to deprecate the specified workflow type	domain*	aws:ResourceTag/${TagKey} swf:workflowType.name swf:workflowType.version	Write
DescribeActivityType	Grants permission to return information about the specified activity type	domain*	aws:ResourceTag/${TagKey} swf:activityType.name swf:activityType.version	Read
DescribeDomain	Grants permission to return information about the specified domain, including its description and status	domain*	aws:ResourceTag/${TagKey}	Read
DescribeWorkflowExecution	Grants permission to return information about the specified workflow execution including its type and some statistics	domain*	aws:ResourceTag/${TagKey}	Read
DescribeWorkflowType	Grants permission to return information about the specified workflow type	domain*	aws:ResourceTag/${TagKey} swf:workflowType.name swf:workflowType.version	Read
GetWorkflowExecutionHistory	Grants permission to return the history of the specified workflow execution	domain*	aws:ResourceTag/${TagKey}	Read
ListActivityTypes	Grants permission to return information about all activities registered in the specified domain that match the specified name and registration status	domain*	aws:ResourceTag/${TagKey}	List
ListClosedWorkflowExecutions	Grants permission to return a list of closed workflow executions in the specified domain that meet the filtering criteria	domain*	aws:ResourceTag/${TagKey} swf:tagFilter.tag swf:typeFilter.name swf:typeFilter.version	List
ListDomains	Grants permission to return the list of domains registered in the account			List
ListOpenWorkflowExecutions	Grants permission to return a list of open workflow executions in the specified domain that meet the filtering criteria	domain*	aws:ResourceTag/${TagKey} swf:tagFilter.tag swf:typeFilter.name swf:typeFilter.version	List
ListTagsForResource	Grants permission to list tags for an Amazon SWF resource	domain	aws:ResourceTag/${TagKey}	List
ListWorkflowTypes	Grants permission to return information about workflow types in the specified domain	domain*	aws:ResourceTag/${TagKey}	List
PollForActivityTask	Grants permission to workers to get an ActivityTask from the specified activity taskList	domain*	aws:ResourceTag/${TagKey} swf:taskList.name	Write
PollForDecisionTask	Grants permission to deciders to get a DecisionTask from the specified decision taskList	domain*	aws:ResourceTag/${TagKey} swf:taskList.name	Write
RecordActivityTaskHeartbeat	Grants permission to workers to report to the service that the ActivityTask represented by the specified taskToken is still making progress	domain*	aws:ResourceTag/${TagKey}	Write
RegisterActivityType	Grants permission to register a new activity type along with its configuration settings in the specified domain	domain*	aws:ResourceTag/${TagKey} swf:defaultTaskList.name swf:name swf:version	Write
RegisterDomain	Grants permission to register a new domain		aws:RequestTag/${TagKey} aws:TagKeys	Write
RegisterWorkflowType	Grants permission to register a new workflow type and its configuration settings in the specified domain	domain*	aws:ResourceTag/${TagKey} swf:defaultTaskList.name swf:name swf:version	Write
RequestCancelWorkflowExecution	Grants permission to record a WorkflowExecutionCancelRequested event in the currently running workflow execution identified by the given domain, workflowId, and runId	domain*	aws:ResourceTag/${TagKey}	Write
RespondActivityTaskCanceled	Grants permission to workers to tell the service that the ActivityTask identified by the taskToken was successfully canceled	domain*	aws:ResourceTag/${TagKey}	Write
RespondActivityTaskCompleted	Grants permission to workers to tell the service that the ActivityTask identified by the taskToken completed successfully with a result (if provided)	domain*	aws:ResourceTag/${TagKey} swf:activityType.name swf:activityType.version swf:tagList.member.0 swf:tagList.member.1 swf:tagList.member.2 swf:tagList.member.3 swf:tagList.member.4 swf:taskList.name swf:workflowType.name swf:workflowType.version	Write
RespondActivityTaskFailed	Grants permission to workers to tell the service that the ActivityTask identified by the taskToken has failed with reason (if specified)	domain*	aws:ResourceTag/${TagKey}	Write
RespondDecisionTaskCompleted	Grants permission to deciders to tell the service that the DecisionTask identified by the taskToken has successfully completed	domain*	aws:ResourceTag/${TagKey}	Write
SignalWorkflowExecution	Grants permission to record a WorkflowExecutionSignaled event in the workflow execution history and create a decision task for the workflow execution identified by the given domain, workflowId and runId	domain*	aws:ResourceTag/${TagKey}	Write
StartWorkflowExecution	Grants permission to start an execution of the workflow type in the specified domain using the provided workflowId and input data	domain*	aws:ResourceTag/${TagKey} swf:tagList.member.0 swf:tagList.member.1 swf:tagList.member.2 swf:tagList.member.3 swf:tagList.member.4 swf:taskList.name swf:workflowType.name swf:workflowType.version	Write
TagResource	Grants permission to tag an Amazon SWF resource	domain	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
TerminateWorkflowExecution	Grants permission to record a WorkflowExecutionTerminated event and force closure of the workflow execution identified by the given domain, runId, and workflowId	domain*	aws:ResourceTag/${TagKey}	Write
UndeprecateActivityType	Grants permission to undeprecate a previously deprecated activity type	domain*	aws:ResourceTag/${TagKey} swf:activityType.name swf:activityType.version	Write
UndeprecateDomain	Grants permission to undeprecate a previously deprecated domain	domain*	aws:ResourceTag/${TagKey}	Write
UndeprecateWorkflowType	Grants permission to undeprecate a previously deprecated workflow type	domain*	aws:ResourceTag/${TagKey} swf:workflowType.name swf:workflowType.version	Write
UntagResource	Grants permission to remove a tag from an Amazon SWF resource	domain	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write

Permission-only actions for Amazon Simple Workflow Service

The following actions are defined by Amazon Simple Workflow Service but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CancelTimer	Grants permission to cancel a previously started timer and record a TimerCanceled event in the history	domain*	aws:ResourceTag/${TagKey}	Write
CancelWorkflowExecution	Grants permission to close the workflow execution and record a WorkflowExecutionCanceled event in the history	domain*	aws:ResourceTag/${TagKey}	Write
CompleteWorkflowExecution	Grants permission to close the workflow execution and record a WorkflowExecutionCompleted event in the history	domain*	aws:ResourceTag/${TagKey}	Write
ContinueAsNewWorkflowExecution	Grants permission to close the workflow execution and start a new workflow execution of the same type using the same workflow ID and a unique run Id	domain*	aws:ResourceTag/${TagKey}	Write
FailWorkflowExecution	Grants permission to close the workflow execution and record a WorkflowExecutionFailed event in the history	domain*	aws:ResourceTag/${TagKey}	Write
RecordMarker	Grants permission to record a MarkerRecorded event in the history	domain*	aws:ResourceTag/${TagKey}	Write
RequestCancelActivityTask	Grants permission to attempt to cancel a previously scheduled activity task	domain*	aws:ResourceTag/${TagKey}	Write
RequestCancelExternalWorkflowExecution	Grants permission to request that a request be made to cancel the specified external workflow execution	domain*	aws:ResourceTag/${TagKey}	Write
ScheduleActivityTask	Grants permission to schedule an activity task	domain*	aws:ResourceTag/${TagKey}	Write
SignalExternalWorkflowExecution	Grants permission to request a signal to be delivered to the specified external workflow execution and records	domain*	aws:ResourceTag/${TagKey}	Write
StartChildWorkflowExecution	Grants permission to request that a child workflow execution be started	domain*	aws:ResourceTag/${TagKey}	Write
StartTimer	Grants permission to start a timer for a workflow execution	domain*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Simple Workflow Service

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
domain	arn:${Partition}:swf::${Account}:/domain/${DomainName}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Simple Workflow Service

Amazon Simple Workflow Service defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by tag of the request	String
aws:ResourceTag/${TagKey}	Filters access by tag of the resource	String
aws:TagKeys	Filters access by tag of the key	ArrayOfString
swf:activityType.name	Filters access by the name of the activity type	String
swf:activityType.version	Filters access by the version of the activity type	String
swf:defaultTaskList.name	Filters access by the name of the default task list	String
swf:name	Filters access by the name of activities or workflows	String
swf:tagFilter.tag	Filters access by the value of tagFilter.tag	String
swf:tagList.member.0	Filters access by the specified tag	String
swf:tagList.member.1	Filters access by the specified tag	String
swf:tagList.member.2	Filters access by the specified tag	String
swf:tagList.member.3	Filters access by the specified tag	String
swf:tagList.member.4	Filters access by the specified tag	String
swf:taskList.name	Filters access by the name of the tasklist	String
swf:typeFilter.name	Filters access by the name of the type filter	String
swf:typeFilter.version	Filters access by the version of the type filter	String
swf:version	Filters access by the version of activities or workflows	String
swf:workflowType.name	Filters access by the name of the workflow type	String
swf:workflowType.version	Filters access by the version of the workflow type	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon SageMaker (sagemaker)

Amazon SimpleDB (sdb)