Operations Actions Permission-only actions Resource types Condition keys

Actions, resources, and condition keys for Amazon WorkSpaces

Amazon WorkSpaces (service prefix: workspaces) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon WorkSpaces
Actions defined by Amazon WorkSpaces
Permission-only actions for Amazon WorkSpaces
Resource types defined by Amazon WorkSpaces
Condition keys for Amazon WorkSpaces

API operations defined by Amazon WorkSpaces

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
AcceptAccountLinkInvitation	workspaces:AcceptAccountLinkInvitation			Write
AssociateConnectionAlias	workspaces:AssociateConnectionAlias			Write
AssociateIpGroups	workspaces:AssociateIpGroups			Write
AssociateWorkspaceApplication	workspaces:AssociateWorkspaceApplication			Write
AuthorizeIpRules	workspaces:AuthorizeIpRules			Write
AuthorizeIpRules	workspaces:UpdateRulesOfIpGroup			Write
CopyWorkspaceImage	workspaces:CopyWorkspaceImage			Write
	workspaces:CreateTags			Tagging, Write
	workspaces:DescribeWorkspaceImages			List
CreateAccountLinkInvitation	workspaces:CreateAccountLinkInvitation			Write
CreateConnectClientAddIn	workspaces:CreateConnectClientAddIn			Write
CreateConnectionAlias	workspaces:CreateConnectionAlias			Write
CreateConnectionAlias	workspaces:CreateTags			Tagging, Write
CreateIpGroup	workspaces:CreateIpGroup			Write
CreateIpGroup	workspaces:CreateTags			Tagging, Write
CreateStandbyWorkspaces	workspaces:CreateStandbyWorkspaces			Write
	workspaces:CreateTags			Tagging, Write
	workspaces:DescribeWorkspaces			List
CreateTags	workspaces:CreateTags			Tagging, Write
CreateUpdatedWorkspaceImage	workspaces:CreateTags			Tagging, Write
CreateUpdatedWorkspaceImage	workspaces:CreateUpdatedWorkspaceImage			Write
CreateWorkspaceBundle	workspaces:CreateTags			Tagging, Write
CreateWorkspaceBundle	workspaces:CreateWorkspaceBundle			Write
CreateWorkspaceImage	workspaces:CreateTags			Tagging, Write
CreateWorkspaceImage	workspaces:CreateWorkspaceImage			Write
CreateWorkspaces	workspaces:CreateTags			Tagging, Write
CreateWorkspaces	workspaces:CreateWorkspaces			Write
CreateWorkspacesPool	workspaces:CreateTags			Tagging, Write
CreateWorkspacesPool	workspaces:CreateWorkspacesPool			Write
DeleteAccountLinkInvitation	workspaces:DeleteAccountLinkInvitation			Write
DeleteClientBranding	workspaces:DeleteClientBranding			Write
DeleteConnectClientAddIn	workspaces:DeleteConnectClientAddIn			Write
DeleteConnectionAlias	workspaces:DeleteConnectionAlias			Write
DeleteIpGroup	workspaces:DeleteIpGroup			Write
DeleteTags	workspaces:DeleteTags			Tagging, Write
DeleteWorkspaceBundle	workspaces:DeleteWorkspaceBundle			Write
DeleteWorkspaceImage	workspaces:DeleteWorkspaceImage			Write
DeployWorkspaceApplications	workspaces:DeployWorkspaceApplications			Write
DeregisterWorkspaceDirectory	workspaces:DeregisterWorkspaceDirectory			Write
DescribeAccount	workspaces:DescribeAccount			Read
DescribeAccountModifications	workspaces:DescribeAccountModifications			Read
DescribeApplicationAssociations	workspaces:DescribeApplicationAssociations			List
DescribeApplications	workspaces:DescribeApplications			List
DescribeBundleAssociations	workspaces:DescribeBundleAssociations			List
DescribeClientBranding	workspaces:DescribeClientBranding			Read
DescribeClientProperties	workspaces:DescribeClientProperties			List
DescribeConnectClientAddIns	workspaces:DescribeConnectClientAddIns			List
DescribeConnectionAliasPermissions	workspaces:DescribeConnectionAliasPermissions			Read
DescribeConnectionAliases	workspaces:DescribeConnectionAliases			Read
DescribeCustomWorkspaceImageImport	workspaces:DescribeCustomWorkspaceImageImport			Read
DescribeImageAssociations	workspaces:DescribeImageAssociations			List
DescribeIpGroups	workspaces:DescribeIpGroups			Read
DescribeTags	workspaces:DescribeTags			Read
DescribeWorkspaceAssociations	workspaces:DescribeWorkspaceAssociations			List
DescribeWorkspaceBundles	workspaces:DescribeWorkspaceBundles			List
DescribeWorkspaceDirectories	workspaces:DescribeWorkspaceDirectories			Read
DescribeWorkspaceImagePermissions	workspaces:DescribeWorkspaceImagePermissions			Read
DescribeWorkspaceImages	workspaces:DescribeWorkspaceImages			List
DescribeWorkspaceSnapshots	workspaces:DescribeWorkspaceSnapshots			List
DescribeWorkspaces	workspaces:DescribeWorkspaces			List
DescribeWorkspacesConnectionStatus	workspaces:DescribeWorkspacesConnectionStatus			Read
DescribeWorkspacesPoolSessions	workspaces:DescribeWorkspacesPoolSessions			List
DescribeWorkspacesPools	workspaces:DescribeWorkspacesPools			List
DisassociateConnectionAlias	workspaces:DisassociateConnectionAlias			Write
DisassociateIpGroups	workspaces:DisassociateIpGroups			Write
DisassociateWorkspaceApplication	workspaces:DisassociateWorkspaceApplication			Write
GetAccountLink	workspaces:GetAccountLink			Read
ImportClientBranding	workspaces:ImportClientBranding			Write
ImportCustomWorkspaceImage	workspaces:CreateTags			Tagging, Write
ImportCustomWorkspaceImage	workspaces:ImportCustomWorkspaceImage			Write
ImportWorkspaceImage	workspaces:CreateTags			Tagging, Write
ImportWorkspaceImage	workspaces:ImportWorkspaceImage			Write
ListAccountLinks	workspaces:ListAccountLinks			List
ListAvailableManagementCidrRanges	workspaces:ListAvailableManagementCidrRanges			List
MigrateWorkspace	workspaces:MigrateWorkspace			Write
ModifyAccount	workspaces:ModifyAccount			Write
ModifyCertificateBasedAuthProperties	workspaces:ModifyCertificateBasedAuthProperties			Write
ModifyClientProperties	workspaces:ModifyClientProperties			Write
ModifyEndpointEncryptionMode	workspaces:ModifyEndpointEncryptionMode			Write
ModifySamlProperties	workspaces:ModifySamlProperties			Write
ModifySelfservicePermissions	workspaces:ModifySelfservicePermissions			Permissions management, Write
ModifyStreamingProperties	workspaces:ModifyStreamingProperties			Write
ModifyWorkspaceAccessProperties	workspaces:ModifyWorkspaceAccessProperties			Write
ModifyWorkspaceCreationProperties	workspaces:ModifyWorkspaceCreationProperties			Write
ModifyWorkspaceCreationProperties	iam:PassRole	iam:PassedToService	workspaces.amazonaws.com	Write
ModifyWorkspaceProperties	workspaces:ModifyWorkspaceProperties			Write
ModifyWorkspaceState	workspaces:ModifyWorkspaceState			Write
RebootWorkspaces	workspaces:RebootWorkspaces			Write
RebuildWorkspaces	workspaces:RebuildWorkspaces			Write
RegisterWorkspaceDirectory	workspaces:CreateTags			Tagging, Write
RegisterWorkspaceDirectory	workspaces:RegisterWorkspaceDirectory			Write
RejectAccountLinkInvitation	workspaces:RejectAccountLinkInvitation			Write
RestoreWorkspace	workspaces:RestoreWorkspace			Write
RevokeIpRules	workspaces:RevokeIpRules			Write
RevokeIpRules	workspaces:UpdateRulesOfIpGroup			Write
StartWorkspaces	workspaces:StartWorkspaces			Write
StartWorkspacesPool	workspaces:StartWorkspacesPool			Write
StopWorkspaces	workspaces:StopWorkspaces			Write
StopWorkspacesPool	workspaces:StopWorkspacesPool			Write
TerminateWorkspaces	workspaces:TerminateWorkspaces			Write
TerminateWorkspacesPool	workspaces:TerminateWorkspacesPool			Write
TerminateWorkspacesPoolSession	workspaces:TerminateWorkspacesPoolSession			Write
UpdateConnectClientAddIn	workspaces:UpdateConnectClientAddIn			Write
UpdateConnectionAliasPermission	workspaces:UpdateConnectionAliasPermission			Permissions management, Write
UpdateRulesOfIpGroup	workspaces:AuthorizeIpRules			Write
	workspaces:RevokeIpRules			Write
	workspaces:UpdateRulesOfIpGroup			Write
UpdateWorkspaceBundle	workspaces:UpdateWorkspaceBundle			Write
UpdateWorkspaceImagePermission	workspaces:UpdateWorkspaceImagePermission			Permissions management, Write
UpdateWorkspacesPool	workspaces:UpdateWorkspacesPool			Write

Actions defined by Amazon WorkSpaces

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in Amazon. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
AcceptAccountLinkInvitation	Grants permission to accept invitations from other Amazon accounts to share the same configuration for WorkSpaces BYOL			Write
AssociateConnectionAlias	Grants permission to associate connection aliases with directories	connectionalias*	aws:ResourceTag/${TagKey}	Write
AssociateConnectionAlias		directoryid*	aws:ResourceTag/${TagKey}	Write
AssociateIpGroups	Grants permission to associate IP access control groups with directories	directoryid*	aws:ResourceTag/${TagKey}	Write
AssociateIpGroups		workspaceipgroup*	aws:ResourceTag/${TagKey}	Write
AssociateWorkspaceApplication	Grants permission to associate a workspace application with a WorkSpace	workspaceapplication*	aws:ResourceTag/${TagKey}	Write
AssociateWorkspaceApplication		workspaceid*	aws:ResourceTag/${TagKey}	Write
AuthorizeIpRules	Grants permission to add rules to IP access control groups	workspaceipgroup*	aws:ResourceTag/${TagKey}	Write
CopyWorkspaceImage	Grants permission to copy a WorkSpace image	workspaceimage*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateAccountLinkInvitation	Grants permission to invite other Amazon accounts to share the same configuration for WorkSpaces BYOL			Write
CreateConnectClientAddIn	Grants permission to create an Amazon Connect client add-in within a directory	directoryid*	aws:ResourceTag/${TagKey}	Write
CreateConnectionAlias	Grants permission to create connection aliases for use with cross-Region redirection		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateIpGroup	Grants permission to create IP access control groups		aws:RequestTag/${TagKey} aws:TagKeys	Write
CreateStandbyWorkspaces	Grants permission to create one or more Standby WorkSpaces	directoryid*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateStandbyWorkspaces	Grants permission to create one or more Standby WorkSpaces	workspaceid*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateTags	Grants permission to create tags for WorkSpaces resources		aws:RequestTag/${TagKey} aws:TagKeys	Tagging, Write
CreateUpdatedWorkspaceImage	Grants permission to create an updated WorkSpace image	workspaceimage*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateWorkspaceBundle	Grants permission to create a WorkSpace bundle	workspacebundle*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateWorkspaceBundle	Grants permission to create a WorkSpace bundle	workspaceimage*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateWorkspaceImage	Grants permission to create a new WorkSpace image	workspaceid*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
CreateWorkspaces	Grants permission to create one or more WorkSpaces	directoryid*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		workspacebundle*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workspaceid*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
CreateWorkspacesPool	Grants permission to create a WorkSpaces Pool	directoryid*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
		workspacebundle*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		workspacespoolid*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
DeleteAccountLinkInvitation	Grants permission to delete invitations to other Amazon accounts to share the same configuration for WorkSpaces BYOL			Write
DeleteClientBranding	Grants permission to delete Amazon WorkSpaces Client branding data within a directory	directoryid*	aws:ResourceTag/${TagKey}	Write
DeleteConnectClientAddIn	Grants permission to delete an Amazon Connect client add-in that is configured within a directory	directoryid*	aws:ResourceTag/${TagKey}	Write
DeleteConnectionAlias	Grants permission to delete connection aliases	connectionalias*	aws:ResourceTag/${TagKey}	Write
DeleteIpGroup	Grants permission to delete IP access control groups	workspaceipgroup*	aws:ResourceTag/${TagKey}	Write
DeleteTags	Grants permission to delete tags from WorkSpaces resources		aws:RequestTag/${TagKey} aws:TagKeys	Tagging, Write
DeleteWorkspaceBundle	Grants permission to delete WorkSpace bundles	workspacebundle*	aws:ResourceTag/${TagKey}	Write
DeleteWorkspaceImage	Grants permission to delete WorkSpace images	workspaceimage*	aws:ResourceTag/${TagKey}	Write
DeployWorkspaceApplications	Grants permission to deploy all pending workspace applications on a WorkSpace	workspaceid*	aws:ResourceTag/${TagKey}	Write
DeregisterWorkspaceDirectory	Grants permission to deregister directories from use with Amazon WorkSpaces	directoryid*	aws:ResourceTag/${TagKey}	Write
DescribeAccount	Grants permission to retrieve the configuration of Bring Your Own License (BYOL) for WorkSpaces accounts			Read
DescribeAccountModifications	Grants permission to retrieve modifications to the configuration of Bring Your Own License (BYOL) for WorkSpaces accounts			Read
DescribeApplicationAssociations	Grants permission to retrieve information about resources associated with a WorkSpace application	workspaceapplication*	aws:ResourceTag/${TagKey}	List
DescribeApplications	Grants permission to obtain information about WorkSpace applications			List
DescribeBundleAssociations	Grants permission to retrieve information about resources associated with a WorkSpace bundle	workspacebundle*	aws:ResourceTag/${TagKey}	List
DescribeClientBranding	Grants permission to retrieve Amazon WorkSpaces Client branding data within a directory	directoryid*	aws:ResourceTag/${TagKey}	Read
DescribeClientProperties	Grants permission to retrieve information about WorkSpaces clients	directoryid*	aws:ResourceTag/${TagKey}	List
DescribeConnectClientAddIns	Grants permission to retrieve a list of Amazon Connect client add-ins that have been created	directoryid*	aws:ResourceTag/${TagKey}	List
DescribeConnectionAliasPermissions	Grants permission to retrieve the permissions that the owners of connection aliases have granted to other Amazon accounts for connection aliases	connectionalias*	aws:ResourceTag/${TagKey}	Read
DescribeConnectionAliases	Grants permission to retrieve a list that describes the connection aliases used for cross-Region redirection			Read
DescribeCustomWorkspaceImageImport	Grants permission to retrieve information about WorkSpace BYOL image import task			Read
DescribeImageAssociations	Grants permission to retrieve information about resources associated with a WorkSpace image	workspaceimage*	aws:ResourceTag/${TagKey}	List
DescribeIpGroups	Grants permission to retrieve information about IP access control groups	workspaceipgroup*	aws:ResourceTag/${TagKey}	Read
DescribeTags	Grants permission to describe the tags for WorkSpaces resources			Read
DescribeWorkspaceAssociations	Grants permission to retrieve information about resources associated with a WorkSpace	workspaceid*	aws:ResourceTag/${TagKey}	List
DescribeWorkspaceBundles	Grants permission to obtain information about WorkSpace bundles			List
DescribeWorkspaceDirectories	Grants permission to retrieve information about directories that are registered with WorkSpaces			Read
DescribeWorkspaceImagePermissions	Grants permission to retrieve information about WorkSpace image permissions	workspaceimage*	aws:ResourceTag/${TagKey}	Read
DescribeWorkspaceImages	Grants permission to retrieve information about WorkSpace images			List
DescribeWorkspaceSnapshots	Grants permission to retrieve information about WorkSpace snapshots	workspaceid*	aws:ResourceTag/${TagKey}	List
DescribeWorkspaces	Grants permission to obtain information about WorkSpaces			List
DescribeWorkspacesConnectionStatus	Grants permission to obtain the connection status of WorkSpaces			Read
DescribeWorkspacesPoolSessions	Grants permission to retrieve information about the sessions of a WorkSpaces Pool	workspacespoolid*	aws:ResourceTag/${TagKey}	List
DescribeWorkspacesPools	Grants permission to retrieve information about WorkSpaces Pools			List
DisassociateConnectionAlias	Grants permission to disassociate connection aliases from directories	connectionalias*	aws:ResourceTag/${TagKey}	Write
DisassociateIpGroups	Grants permission to disassociate IP access control groups from directories	directoryid*	aws:ResourceTag/${TagKey}	Write
DisassociateIpGroups		workspaceipgroup*	aws:ResourceTag/${TagKey}	Write
DisassociateWorkspaceApplication	Grants permission to disassociate a workspace application from a WorkSpace	workspaceapplication*	aws:ResourceTag/${TagKey}	Write
DisassociateWorkspaceApplication		workspaceid*	aws:ResourceTag/${TagKey}	Write
GetAccountLink	Grants permission to retrieve a link with another Amazon Account for sharing configuration for WorkSpaces BYOL			Read
ImportClientBranding	Grants permission to import Amazon WorkSpaces Client branding data within a directory	directoryid*	aws:ResourceTag/${TagKey}	Write
ImportCustomWorkspaceImage	Grants permission to import Bring Your Own License (BYOL) images into Amazon WorkSpaces			Write
ImportWorkspaceImage	Grants permission to import Bring Your Own License (BYOL) images into Amazon WorkSpaces			Write
ListAccountLinks	Grants permission to retrieve links with the Amazon Account(s) that share your configuration for WorkSpaces BYOL			List
ListAvailableManagementCidrRanges	Grants permission to list the available CIDR ranges for enabling Bring Your Own License (BYOL) for WorkSpaces accounts			List
MigrateWorkspace	Grants permission to migrate WorkSpaces	workspacebundle*	aws:ResourceTag/${TagKey}	Write
MigrateWorkspace	Grants permission to migrate WorkSpaces	workspaceid*	aws:ResourceTag/${TagKey}	Write
ModifyAccount	Grants permission to modify the configuration of Bring Your Own License (BYOL) for WorkSpaces accounts			Write
ModifyCertificateBasedAuthProperties	Grants permission to modify the certificate-based authorization properties of a directory	directoryid*	aws:ResourceTag/${TagKey}	Write
ModifyClientProperties	Grants permission to modify the properties of WorkSpaces clients	directoryid*	aws:ResourceTag/${TagKey}	Write
ModifyEndpointEncryptionMode	Grants permission to configure the specified directory between Standard TLS and FIPS 140-2 validated mode	directoryid*	aws:ResourceTag/${TagKey}	Write
ModifySamlProperties	Grants permission to modify the SAML properties of a directory	directoryid*	aws:ResourceTag/${TagKey}	Write
ModifySelfservicePermissions	Grants permission to modify the self-service WorkSpace management capabilities for your users	directoryid*	aws:ResourceTag/${TagKey}	Permissions management, Write
ModifyStreamingProperties	Grants permission to modify the streaming properties	directoryid*	aws:ResourceTag/${TagKey}	Write
ModifyWorkspaceAccessProperties	Grants permission to specify which devices and operating systems users can use to access their WorkSpaces	directoryid*	aws:ResourceTag/${TagKey}	Write
ModifyWorkspaceCreationProperties	Grants permission to modify the default properties used to create WorkSpaces	directoryid*	aws:ResourceTag/${TagKey}	Write
ModifyWorkspaceProperties	Grants permission to modify WorkSpace properties, including the running mode and the AutoStop period	workspaceid*	aws:ResourceTag/${TagKey}	Write
ModifyWorkspaceState	Grants permission to modify the state of WorkSpaces	workspaceid*	aws:ResourceTag/${TagKey}	Write
RebootWorkspaces	Grants permission to reboot WorkSpaces	workspaceid*	aws:ResourceTag/${TagKey}	Write
RebuildWorkspaces	Grants permission to rebuild WorkSpaces	workspaceid*	aws:ResourceTag/${TagKey}	Write
RegisterWorkspaceDirectory	Grants permission to register directories for use with Amazon WorkSpaces	directoryid*	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Write
RejectAccountLinkInvitation	Grants permission to reject invitations from other Amazon accounts to share the same configuration for WorkSpaces BYOL			Write
RestoreWorkspace	Grants permission to restore WorkSpaces	workspaceid*	aws:ResourceTag/${TagKey}	Write
RevokeIpRules	Grants permission to remove rules from IP access control groups	workspaceipgroup*	aws:ResourceTag/${TagKey}	Write
StartWorkspaces	Grants permission to start AutoStop WorkSpaces	workspaceid*	aws:ResourceTag/${TagKey}	Write
StartWorkspacesPool	Grants permission to start a WorkSpaces Pool	workspacespoolid*	aws:ResourceTag/${TagKey}	Write
StopWorkspaces	Grants permission to stop AutoStop WorkSpaces	workspaceid*	aws:ResourceTag/${TagKey}	Write
StopWorkspacesPool	Grants permission to stop a WorkSpaces Pool	workspacespoolid*	aws:ResourceTag/${TagKey}	Write
Stream	Grants permission to federated users to sign in by using their existing credentials and stream their workspace	directoryid*	aws:ResourceTag/${TagKey} workspaces:userId	Write
TerminateWorkspaces	Grants permission to terminate WorkSpaces	workspaceid*	aws:ResourceTag/${TagKey}	Write
TerminateWorkspacesPool	Grants permission to terminate a WorkSpaces Pool	workspacespoolid*	aws:ResourceTag/${TagKey}	Write
TerminateWorkspacesPoolSession	Grants permission to terminate a WorkSpaces Pool session			Write
UpdateConnectClientAddIn	Grants permission to update an Amazon Connect client add-in. Use this action to update the name and endpoint URL of an Amazon Connect client add-in	directoryid*	aws:ResourceTag/${TagKey}	Write
UpdateConnectionAliasPermission	Grants permission to share or unshare connection aliases with other accounts	connectionalias*	aws:ResourceTag/${TagKey}	Permissions management, Write
UpdateRulesOfIpGroup	Grants permission to replace rules for IP access control groups	workspaceipgroup*	aws:ResourceTag/${TagKey}	Write
UpdateWorkspaceBundle	Grants permission to update the WorkSpace images used in WorkSpace bundles	workspacebundle*	aws:ResourceTag/${TagKey}	Write
UpdateWorkspaceBundle		workspaceimage*	aws:ResourceTag/${TagKey}	Write
UpdateWorkspaceImagePermission	Grants permission to share or unshare WorkSpace images with other accounts by specifying whether other accounts have permission to copy the image	workspaceimage*	aws:ResourceTag/${TagKey}	Permissions management, Write
UpdateWorkspacesPool	Grants permission to update the WorkSpaces pool	workspacespoolid*	aws:ResourceTag/${TagKey}	Write

Permission-only actions for Amazon WorkSpaces

The following actions are defined by Amazon WorkSpaces but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateRootClientCertificate	Grants permission to create a root client certificate	certificateid*		Write
DeleteRootClientCertificate	Grants permission to delete root client certificate	certificateid*		Write
DescribeConsent	Grants permission to retrieve information about consent agreement to BYOL minimum requirements			Read
DirectoryAccessManagement	Grants permission to directory management actions while managing and provisioning workspaces	directoryid*	aws:ResourceTag/${TagKey}	List
GetTroubleshootingRecommendation	Grants permission to get troubleshooting recommendations	workspaceid*	aws:ResourceTag/${TagKey}	Read
InvokeTroubleshootingInvestigation	Grants permission to invoke troubleshooting investigation	workspaceid*	aws:ResourceTag/${TagKey}	Read
ListTroubleshootingRecommendations	Grants permission to list troubleshooting recommendations	workspaceid*	aws:ResourceTag/${TagKey}	Read
UpdateConsent	Grants permission to update the consent agreement to BYOL minimum requirements			Write
UpdateRootClientCertificate	Grants permission to update a root client certificate	certificateid*		Write

Resource types defined by Amazon WorkSpaces

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
certificateid	arn:${Partition}:workspaces:${Region}:${Account}:workspacecertificate/${CertificateId}
connectionalias	arn:${Partition}:workspaces:${Region}:${Account}:connectionalias/${ConnectionAliasId}	aws:ResourceTag/${TagKey}
directoryid	arn:${Partition}:workspaces:${Region}:${Account}:directory/${DirectoryId}	aws:ResourceTag/${TagKey}
workspaceapplication	arn:${Partition}:workspaces:${Region}:${Account}:workspaceapplication/${WorkSpaceApplicationId}	aws:ResourceTag/${TagKey}
workspacebundle	arn:${Partition}:workspaces:${Region}:${Account}:workspacebundle/${BundleId}	aws:ResourceTag/${TagKey}
workspaceid	arn:${Partition}:workspaces:${Region}:${Account}:workspace/${WorkspaceId}	aws:ResourceTag/${TagKey}
workspaceimage	arn:${Partition}:workspaces:${Region}:${Account}:workspaceimage/${ImageId}	aws:ResourceTag/${TagKey}
workspaceipgroup	arn:${Partition}:workspaces:${Region}:${Account}:workspaceipgroup/${GroupId}	aws:ResourceTag/${TagKey}
workspacespoolid	arn:${Partition}:workspaces:${Region}:${Account}:workspacespool/${PoolId}	aws:ResourceTag/${TagKey}

Condition keys for Amazon WorkSpaces

Amazon WorkSpaces defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access based on the tags that are passed in the request	String
aws:ResourceTag/${TagKey}	Filters access based on the tags associated with the resource	String
aws:TagKeys	Filters access based on the tag keys that are passed in the request	ArrayOfString
workspaces:userId	Filters access by the ID of the Workspaces user	String

Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Amazon Verified Permissions (verifiedpermissions)

Apache Kafka APIs for Amazon MSK clusters (kafka-cluster)