Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Transfer Family

Amazon Transfer Family (service prefix: transfer) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Transfer Family
Actions defined by Amazon Transfer Family
Resource types defined by Amazon Transfer Family
Condition keys for Amazon Transfer Family

API operations defined by Amazon Transfer Family

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateAccess	transfer:CreateAccess			Write
CreateAccess	iam:PassRole	iam:PassedToService	transfer.amazonaws.com	Write
CreateAgreement	transfer:CreateAgreement			Write
	transfer:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	transfer.amazonaws.com	Write
CreateConnector	transfer:CreateConnector			Write
	transfer:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	transfer.amazonaws.com	Write
CreateProfile	transfer:CreateProfile			Write
CreateProfile	transfer:TagResource			Tagging, Write
CreateServer	transfer:CreateServer			Write
	transfer:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	transfer.amazonaws.com	Write
CreateUser	transfer:CreateUser			Write
	transfer:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	transfer.amazonaws.com	Write
CreateWebApp	transfer:CreateWebApp			Write
	transfer:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	transfer.amazonaws.com	Write
CreateWorkflow	transfer:CreateWorkflow			Write
CreateWorkflow	transfer:TagResource			Tagging, Write
DeleteAccess	transfer:DeleteAccess			Write
DeleteAgreement	transfer:DeleteAgreement			Write
DeleteCertificate	transfer:DeleteCertificate			Write
DeleteConnector	transfer:DeleteConnector			Write
DeleteHostKey	transfer:DeleteHostKey			Write
DeleteProfile	transfer:DeleteProfile			Write
DeleteServer	transfer:DeleteServer			Write
DeleteSshPublicKey	transfer:DeleteSshPublicKey			Write
DeleteUser	transfer:DeleteUser			Write
DeleteWebApp	transfer:DeleteWebApp			Write
DeleteWebAppCustomization	transfer:DeleteWebAppCustomization			Write
DeleteWorkflow	transfer:DeleteWorkflow			Write
DescribeAccess	transfer:DescribeAccess			Read
DescribeAgreement	transfer:DescribeAgreement			Read
DescribeCertificate	transfer:DescribeCertificate			Read
DescribeConnector	transfer:DescribeConnector			Read
DescribeExecution	transfer:DescribeExecution			Read
DescribeHostKey	transfer:DescribeHostKey			Read
DescribeProfile	transfer:DescribeProfile			Read
DescribeSecurityPolicy	transfer:DescribeSecurityPolicy			Read
DescribeServer	transfer:DescribeServer			Read
DescribeUser	transfer:DescribeUser			Read
DescribeWebApp	transfer:DescribeWebApp			Read
DescribeWebAppCustomization	transfer:DescribeWebAppCustomization			Read
DescribeWorkflow	transfer:DescribeWorkflow			Read
ImportCertificate	transfer:ImportCertificate			Write
ImportCertificate	transfer:TagResource			Tagging, Write
ImportHostKey	transfer:ImportHostKey			Write
ImportHostKey	transfer:TagResource			Tagging, Write
ImportSshPublicKey	transfer:ImportSshPublicKey			Write
ListAccesses	transfer:ListAccesses			Read
ListAgreements	transfer:ListAgreements			Read
ListCertificates	transfer:ListCertificates			Read
ListConnectors	transfer:ListConnectors			Read
ListExecutions	transfer:ListExecutions			Read
ListFileTransferResults	transfer:ListFileTransferResults			Read
ListHostKeys	transfer:ListHostKeys			Read
ListProfiles	transfer:ListProfiles			Read
ListSecurityPolicies	transfer:ListSecurityPolicies			List
ListServers	transfer:ListServers			List
ListTagsForResource	transfer:ListTagsForResource			Read
ListUsers	transfer:ListUsers			List
ListWebApps	transfer:ListWebApps			List
ListWorkflows	transfer:ListWorkflows			List
SendWorkflowStepState	transfer:SendWorkflowStepState			Write
StartDirectoryListing	transfer:StartDirectoryListing			Write
StartFileTransfer	transfer:StartFileTransfer			Write
StartRemoteDelete	transfer:StartRemoteDelete			Write
StartRemoteMove	transfer:StartRemoteMove			Write
StartServer	transfer:StartServer			Write
StopServer	transfer:StopServer			Write
TagResource	transfer:TagResource			Tagging, Write
TestConnection	transfer:TestConnection			Write
TestIdentityProvider	transfer:TestIdentityProvider			Read
UntagResource	transfer:UntagResource			Tagging, Write
UpdateAccess	transfer:UpdateAccess			Write
UpdateAccess	iam:PassRole	iam:PassedToService	transfer.amazonaws.com	Write
UpdateAgreement	transfer:UpdateAgreement			Write
UpdateAgreement	iam:PassRole	iam:PassedToService	transfer.amazonaws.com	Write
UpdateCertificate	transfer:UpdateCertificate			Write
UpdateConnector	transfer:UpdateConnector			Write
UpdateConnector	iam:PassRole	iam:PassedToService	transfer.amazonaws.com	Write
UpdateHostKey	transfer:UpdateHostKey			Write
UpdateProfile	transfer:UpdateProfile			Write
UpdateServer	transfer:UpdateServer			Write
UpdateServer	iam:PassRole	iam:PassedToService	transfer.amazonaws.com	Write
UpdateUser	transfer:UpdateUser			Write
UpdateUser	iam:PassRole	iam:PassedToService	transfer.amazonaws.com	Write
UpdateWebApp	transfer:UpdateWebApp			Write
UpdateWebApp	iam:PassRole	iam:PassedToService	transfer.amazonaws.com	Write
UpdateWebAppCustomization	transfer:UpdateWebAppCustomization			Write

Actions defined by Amazon Transfer Family

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateAccess	Grants permission to add an access associated with a server	server*	aws:ResourceTag/${TagKey}	Write
CreateAgreement	Grants permission to add an agreement associated with a server	server*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateConnector	Grants permission to create a connector	profile	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys transfer:RequestConnectorProtocol transfer:RequestSecurityPolicyName	Write
CreateProfile	Grants permission to create a profile		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateServer	Grants permission to create a server		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys transfer:RequestSecurityPolicyName transfer:RequestServerDomain transfer:RequestServerEndpointType transfer:RequestServerProtocols	Write
CreateUser	Grants permission to add a user associated with a server	server*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateWebApp	Grants permission to create a webapp		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateWorkflow	Grants permission to create a workflow		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
DeleteAccess	Grants permission to delete access	server*	aws:ResourceTag/${TagKey}	Write
DeleteAgreement	Grants permission to delete agreement	agreement*	aws:ResourceTag/${TagKey}	Write
DeleteCertificate	Grants permission to delete certificate	certificate*	aws:ResourceTag/${TagKey}	Write
DeleteConnector	Grants permission to delete connector	connector*	aws:ResourceTag/${TagKey}	Write
DeleteHostKey	Grants permission to delete a host key associated with a server	host-key*	aws:ResourceTag/${TagKey}	Write
DeleteProfile	Grants permission to delete profile	profile*	aws:ResourceTag/${TagKey}	Write
DeleteServer	Grants permission to delete a server	server*	aws:ResourceTag/${TagKey}	Write
DeleteSshPublicKey	Grants permission to delete an SSH public key from a user	user*	aws:ResourceTag/${TagKey}	Write
DeleteUser	Grants permission to delete a user associated with a server	user*	aws:ResourceTag/${TagKey}	Write
DeleteWebApp	Grants permission to delete webapp	webapp*	aws:ResourceTag/${TagKey}	Write
DeleteWebAppCustomization	Grants permission to delete webapp customization	webapp*	aws:ResourceTag/${TagKey}	Write
DeleteWorkflow	Grants permission to delete a workflow	workflow*	aws:ResourceTag/${TagKey}	Write
DescribeAccess	Grants permission to describe an access assigned to a server	server*	aws:ResourceTag/${TagKey}	Read
DescribeAgreement	Grants permission to describe an agreement assigned to a server	agreement*	aws:ResourceTag/${TagKey}	Read
DescribeCertificate	Grants permission to describe a certificate	certificate*	aws:ResourceTag/${TagKey}	Read
DescribeConnector	Grants permission to describe a connector	connector*	aws:ResourceTag/${TagKey}	Read
DescribeExecution	Grants permission to describe an execution associated with a workflow	workflow*	aws:ResourceTag/${TagKey}	Read
DescribeHostKey	Grants permission to describe a host key associated with a server	host-key*	aws:ResourceTag/${TagKey}	Read
DescribeProfile	Grants permission to describe a profile	profile*	aws:ResourceTag/${TagKey}	Read
DescribeSecurityPolicy	Grants permission to describe a security policy			Read
DescribeServer	Grants permission to describe a server	server*	aws:ResourceTag/${TagKey}	Read
DescribeUser	Grants permission to describe a user associated with a server	user*	aws:ResourceTag/${TagKey}	Read
DescribeWebApp	Grants permission to describe a webapp	webapp*	aws:ResourceTag/${TagKey}	Read
DescribeWebAppCustomization	Grants permission to describe a webapp customization	webapp*	aws:ResourceTag/${TagKey}	Read
DescribeWorkflow	Grants permission to describe a workflow	workflow*	aws:ResourceTag/${TagKey}	Read
ImportCertificate	Grants permission to add a certificate		aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
ImportHostKey	Grants permission to add a host key to a server	server*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
ImportSshPublicKey	Grants permission to add an SSH public key to a user	user*	aws:ResourceTag/${TagKey}	Write
ListAccesses	Grants permission to list accesses	server*	aws:ResourceTag/${TagKey}	Read
ListAgreements	Grants permission to list agreements	server*	aws:ResourceTag/${TagKey}	Read
ListCertificates	Grants permission to list certificates			Read
ListConnectors	Grants permission to list connectors			Read
ListExecutions	Grants permission to list executions associated with a workflow	workflow*	aws:ResourceTag/${TagKey}	Read
ListFileTransferResults	Grants permission to list file transfer statuses for connectors	connector*	aws:ResourceTag/${TagKey}	Read
ListHostKeys	Grants permission to list host keys associated with a server	server*	aws:ResourceTag/${TagKey}	Read
ListProfiles	Grants permission to list profiles			Read
ListSecurityPolicies	Grants permission to list security policies			List
ListServers	Grants permission to list servers			List
ListTagsForResource	Grants permission to list tags for an Amazon Transfer Family resource	agreement	aws:ResourceTag/${TagKey}	Read
		certificate	aws:ResourceTag/${TagKey}
		connector	aws:ResourceTag/${TagKey}
		host-key	aws:ResourceTag/${TagKey}
		profile	aws:ResourceTag/${TagKey}
		server	aws:ResourceTag/${TagKey}
		user	aws:ResourceTag/${TagKey}
		workflow	aws:ResourceTag/${TagKey}
ListUsers	Grants permission to list users associated with a server	server*	aws:ResourceTag/${TagKey}	List
ListWebApps	Grants permission to list webapps			List
ListWorkflows	Grants permission to list workflows			List
SendWorkflowStepState	Grants permission to send a callback for asynchronous custom steps	workflow*	aws:ResourceTag/${TagKey}	Write
StartDirectoryListing	Grants permission to initiate a list operation on a remote server using a connector	connector*	aws:ResourceTag/${TagKey}	Write
StartFileTransfer	Grants permission to initiate a connector file transfer	connector*	aws:ResourceTag/${TagKey}	Write
StartRemoteDelete	Grants permission to initiate a connector delete operation on remote server	connector*	aws:ResourceTag/${TagKey}	Write
StartRemoteMove	Grants permission to initiate a connector move operation on remote server	connector*	aws:ResourceTag/${TagKey}	Write
StartServer	Grants permission to start a server	server*	aws:ResourceTag/${TagKey}	Write
StopServer	Grants permission to stop a server	server*	aws:ResourceTag/${TagKey}	Write
TagResource	Grants permission to tag an Amazon Transfer Family resource	agreement	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		certificate	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		connector	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		host-key	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		profile	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		server	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		user	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		webapp	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workflow	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
TestConnection	Grants permission to test a connector's connection to remote server	connector*	aws:ResourceTag/${TagKey}	Write
TestIdentityProvider	Grants permission to test a server's custom identity provider	user*	aws:ResourceTag/${TagKey}	Read
UntagResource	Grants permission to untag an Amazon Transfer Family resource	agreement	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		certificate	aws:ResourceTag/${TagKey} aws:TagKeys
		connector	aws:ResourceTag/${TagKey} aws:TagKeys
		host-key	aws:ResourceTag/${TagKey} aws:TagKeys
		profile	aws:ResourceTag/${TagKey} aws:TagKeys
		server	aws:ResourceTag/${TagKey} aws:TagKeys
		user	aws:ResourceTag/${TagKey} aws:TagKeys
		webapp	aws:ResourceTag/${TagKey} aws:TagKeys
		workflow	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateAccess	Grants permission to update access			Write
UpdateAgreement	Grants permission to update an agreement	agreement*	aws:ResourceTag/${TagKey}	Write
UpdateCertificate	Grants permission to update a certificate	certificate*	aws:ResourceTag/${TagKey}	Write
UpdateConnector	Grants permission to update a connector	connector*	aws:ResourceTag/${TagKey} transfer:RequestSecurityPolicyName	Write
UpdateConnector	Grants permission to update a connector	profile	aws:ResourceTag/${TagKey} transfer:RequestSecurityPolicyName	Write
UpdateHostKey	Grants permission to update a host key	host-key*	aws:ResourceTag/${TagKey}	Write
UpdateProfile	Grants permission to update a profile	profile*	aws:ResourceTag/${TagKey}	Write
UpdateServer	Grants permission to update the configuration of a server	server*	aws:ResourceTag/${TagKey} transfer:RequestSecurityPolicyName transfer:RequestServerEndpointType transfer:RequestServerProtocols	Write
UpdateUser	Grants permission to update the configuration of a user	user*	aws:ResourceTag/${TagKey}	Write
UpdateWebApp	Grants permission to update the configuration of a webapp	webapp*	aws:ResourceTag/${TagKey}	Write
UpdateWebAppCustomization	Grants permission to update the configuration of a webapp cutomization	webapp*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Transfer Family

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
agreement	arn:${Partition}:transfer:${Region}:${Account}:agreement/${ServerId}/${AgreementId}	aws:ResourceTag/${TagKey}
certificate	arn:${Partition}:transfer:${Region}:${Account}:certificate/${CertificateId}	aws:ResourceTag/${TagKey}
connector	arn:${Partition}:transfer:${Region}:${Account}:connector/${ConnectorId}	aws:ResourceTag/${TagKey}
host-key	arn:${Partition}:transfer:${Region}:${Account}:host-key/${ServerId}/${HostKeyId}	aws:ResourceTag/${TagKey}
profile	arn:${Partition}:transfer:${Region}:${Account}:profile/${ProfileId}	aws:ResourceTag/${TagKey}
server	arn:${Partition}:transfer:${Region}:${Account}:server/${ServerId}	aws:ResourceTag/${TagKey}
user	arn:${Partition}:transfer:${Region}:${Account}:user/${ServerId}/${UserName}	aws:ResourceTag/${TagKey}
webapp	arn:${Partition}:transfer:${Region}:${Account}:webapp/${WebAppId}	aws:ResourceTag/${TagKey}
workflow	arn:${Partition}:transfer:${Region}:${Account}:workflow/${WorkflowId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Transfer Family

Amazon Transfer Family defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags associated with the resource	String
aws:TagKeys	Filters access by the tag keys that are passed in the request	ArrayOfString
transfer:RequestConnectorProtocol	Filters access by the connector protocol that is passed in the request	String
transfer:RequestSecurityPolicyName	Filters access by the security policy name that is passed in the request	String
transfer:RequestServerDomain	Filters access by the storage domain that is passed in the request	String
transfer:RequestServerEndpointType	Filters access by the endpoint type that is passed in the request	String
transfer:RequestServerProtocols	Filters access by the server protocols that are passed in the request	ArrayOfString

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Systems Manager GUI Connect (ssm-guiconnect)

Amazon Trusted Advisor (trustedadvisor)