Actions, resources, and condition keys for AWS IoT SiteWise

AWS IoT SiteWise (service prefix: iotsitewise) provides the following service-specific resources, actions, and condition context keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.

Topics

Actions defined by AWS IoT SiteWise
Resource types defined by AWS IoT SiteWise
Condition keys for AWS IoT SiteWise

Actions defined by AWS IoT SiteWise

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

The Resource types column of the Actions table indicates whether each action supports resource-level permissions. If there is no value for this column, you must specify all resources ("*") to which the policy applies in the Resource element of your policy statement. If the column includes a resource type, then you can specify an ARN of that type in a statement with that action. If the action has one or more required resources, the caller must have permission to use the action with those resources. Required resources are indicated in the table with an asterisk (*). If you limit resource access with the Resource element in an IAM policy, you must include an ARN or pattern for each required resource type. Some actions support multiple resource types. If the resource type is optional (not indicated as required), then you can choose to use one of the optional resource types.

The Condition keys column of the Actions table includes keys that you can specify in a policy statement's Condition element. For more information on the condition keys that are associated with resources for the service, see the Condition keys column of the Resource types table.

Note

Resource condition keys are listed in the Resource types table. You can find a link to the resource type that applies to an action in the Resource types (*required) column of the Actions table. The resource type in the Resource types table includes the Condition keys column, which are the resource condition keys that apply to an action in the Actions table.

For details about the columns in the following table, see Actions table.


Actions	Description	Access level	Resource types (*required)	Condition keys	Dependent actions
AssociateAssets	Grants permission to associate a child asset with a parent asset through a hierarchy	Write	asset*
AssociateTimeSeriesToAssetProperty	Grants permission to associate a time series with an asset property	Write	asset*
AssociateTimeSeriesToAssetProperty		Write	time-series*
BatchAssociateProjectAssets	Grants permission to associate assets to a project	Write	project*
BatchDisassociateProjectAssets	Grants permission to disassociate assets from a project	Write	project*
BatchGetAssetPropertyAggregates	Grants permission to retrieve computed aggregates for multiple asset properties	Read	asset
BatchGetAssetPropertyAggregates		Read	time-series
BatchGetAssetPropertyValue	Grants permission to retrieve the latest value for multiple asset properties	Read	asset
BatchGetAssetPropertyValue		Read	time-series
BatchGetAssetPropertyValueHistory	Grants permission to retrieve the value history for multiple asset properties	Read	asset
BatchGetAssetPropertyValueHistory		Read	time-series
BatchPutAssetPropertyValue	Grants permission to put property values for asset properties	Write	asset
BatchPutAssetPropertyValue		Write	time-series
CreateAccessPolicy	Grants permission to create an access policy for a portal or a project	Write	portal
			project
				aws:RequestTag/${TagKey} aws:TagKeys
CreateAsset	Grants permission to create an asset from an asset model	Write	asset-model*
CreateAsset	Grants permission to create an asset from an asset model	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateAssetModel	Grants permission to create an asset model	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateAssetModelCompositeModel	Grants permission to create an asset model composite model inside an asset model	Write	asset-model*
CreateBulkImportJob	Grants permission to create bulk import job	Write
CreateDashboard	Grants permission to create a dashboard in a project	Write	project*
CreateDashboard	Grants permission to create a dashboard in a project	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreateGateway	Grants permission to create a gateway	Write		aws:RequestTag/${TagKey} aws:TagKeys
CreatePortal	Grants permission to create a portal	Write		aws:RequestTag/${TagKey} aws:TagKeys	sso:CreateManagedApplicationInstance sso:DescribeRegisteredRegions
CreateProject	Grants permission to create a project in a portal	Write	portal*
CreateProject	Grants permission to create a project in a portal	Write		aws:RequestTag/${TagKey} aws:TagKeys
DeleteAccessPolicy	Grants permission to delete an access policy	Write	access-policy*
DeleteAsset	Grants permission to delete an asset	Write	asset*
DeleteAssetModel	Grants permission to delete an asset model	Write	asset-model*
DeleteAssetModelCompositeModel	Grants permission to delete an asset model composite model	Write	asset-model*
DeleteDashboard	Grants permission to delete a dashboard	Write	dashboard*
DeleteGateway	Grants permission to delete a gateway	Write	gateway*
DeletePortal	Grants permission to delete a portal	Write	portal*		sso:DeleteManagedApplicationInstance
DeleteProject	Grants permission to delete a project	Write	project*
DeleteTimeSeries	Grants permission to delete a time series	Write	asset
DeleteTimeSeries	Grants permission to delete a time series	Write	time-series
DescribeAccessPolicy	Grants permission to describe an access policy	Read	access-policy*
DescribeAction	Grants permission to describe actions	Read	asset
DescribeAsset	Grants permission to describe an asset	Read	asset*
DescribeAssetCompositeModel	Grants permission to describe an asset composite model	Read	asset*
DescribeAssetModel	Grants permission to describe an asset model	Read	asset-model*
DescribeAssetModelCompositeModel	Grants permission to describe an asset model composite model	Read	asset-model*
DescribeAssetProperty	Grants permission to describe an asset property	Read	asset*
DescribeBulkImportJob	Grants permission to describe bulk import job	Read
DescribeDashboard	Grants permission to describe a dashboard	Read	dashboard*
DescribeDefaultEncryptionConfiguration	Grants permission to describe the default encryption configuration for the AWS account	Read
DescribeGateway	Grants permission to describe a gateway	Read	gateway*
DescribeGatewayCapabilityConfiguration	Grants permission to describe a capability configuration for a gateway	Read	gateway*
DescribeLoggingOptions	Grants permission to describe logging options for the AWS account	Read
DescribePortal	Grants permission to describe a portal	Read	portal*
DescribeProject	Grants permission to describe a project	Read	project*
DescribeStorageConfiguration	Grants permission to describe the storage configuration for the AWS account	Read
DescribeTimeSeries	Grants permission to describe a time series	Read	asset
			time-series
				aws:RequestTag/${TagKey} aws:TagKeys
DisassociateAssets	Grants permission to disassociate a child asset from a parent asset by a hierarchy	Write	asset*
DisassociateTimeSeriesFromAssetProperty	Grants permission to disassociate a time series from an asset property	Write	asset*
DisassociateTimeSeriesFromAssetProperty		Write	time-series*
EnableSiteWiseIntegration [permission only]	Grants permission to allow IoT SiteWise integrate with other services	Write
ExecuteAction	Grants permission to execute actions	Write	asset
ExecuteQuery	Grants permission to execute query	Read
GetAssetPropertyAggregates	Grants permission to retrieve computed aggregates for an asset property	Read	asset
GetAssetPropertyAggregates		Read	time-series
GetAssetPropertyValue	Grants permission to retrieve the latest value for an asset property	Read	asset
GetAssetPropertyValue		Read	time-series
GetAssetPropertyValueHistory	Grants permission to retrieve the value history for an asset property	Read	asset
GetAssetPropertyValueHistory		Read	time-series
GetInterpolatedAssetPropertyValues	Grants permission to retrieve interpolated values for an asset property	Read	asset
GetInterpolatedAssetPropertyValues		Read	time-series
ListAccessPolicies	Grants permission to list all access policies for an identity or a resource	List	portal
ListAccessPolicies		List	project
ListActions	Grants permission to list all actions	List	asset
ListAssetModelCompositeModels	Grants permission to list all asset model composite models	List	asset-model*
ListAssetModelProperties	Grants permission to list asset model properties	List	asset-model*
ListAssetModels	Grants permission to list all asset models	List
ListAssetProperties	Grants permission to list asset properties	List	asset*
ListAssetRelationships	Grants permission to list the asset relationship graph for an asset	List	asset*
ListAssets	Grants permission to list all assets	List	asset-model
ListAssociatedAssets	Grants permission to list all assets associated with an asset through a hierarchy	List	asset*
ListBulkImportJobs	Grants permission to list bulk import jobs	List
ListCompositionRelationships	Grants permission to list all asset model composition relationships	List	asset-model*
ListDashboards	Grants permission to list all dashboards in a project	List	project*
ListGateways	Grants permission to list all gateways	List
ListPortals	Grants permission to list all portals	List
ListProjectAssets	Grants permission to list all assets associated with a project	List	project*
ListProjects	Grants permission to list all projects in a portal	List	portal*
ListTagsForResource	Grants permission to list all tags for a resource	Read	access-policy
			asset
			asset-model
			dashboard
			gateway
			portal
			project
			time-series
				aws:ResourceTag/${TagKey}
ListTimeSeries	Grants permission to list time series	List	asset
PutDefaultEncryptionConfiguration	Grants permission to set the default encryption configuration for the AWS account	Write
PutLoggingOptions	Grants permission to set logging options for the AWS account	Write
PutStorageConfiguration	Grants permission to configure storage settings for the AWS account	Write
TagResource	Grants permission to tag a resource	Tagging	access-policy
			asset
			asset-model
			dashboard
			gateway
			portal
			project
			time-series
				aws:TagKeys aws:RequestTag/${TagKey}
UntagResource	Grants permission to untag a resource	Tagging	access-policy
			asset
			asset-model
			dashboard
			gateway
			portal
			project
			time-series
				aws:TagKeys
UpdateAccessPolicy	Grants permission to update an access policy	Write	access-policy*
UpdateAsset	Grants permission to update an asset	Write	asset*
UpdateAssetModel	Grants permission to update an asset model	Write	asset-model*
UpdateAssetModelCompositeModel	Grants permission to update asset model composite model	Write	asset-model*
UpdateAssetModelPropertyRouting [permission only]	Grants permission to update an AssetModel property routing	Write	asset-model*
UpdateAssetProperty	Grants permission to update an asset property	Write	asset*
UpdateDashboard	Grants permission to update a dashboard	Write	dashboard*
UpdateGateway	Grants permission to update a gateway	Write	gateway*
UpdateGatewayCapabilityConfiguration	Grants permission to update a capability configuration for a gateway	Write	gateway*
UpdatePortal	Grants permission to update a portal	Write	portal*
UpdateProject	Grants permission to update a project	Write	project*

Resource types defined by AWS IoT SiteWise

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements. Each action in the Actions table identifies the resource types that can be specified with that action. A resource type can also define which condition keys you can include in a policy. These keys are displayed in the last column of the Resource types table. For details about the columns in the following table, see Resource types table.


Resource types	ARN	Condition keys
asset	`arn:${Partition}:iotsitewise:${Region}:${Account}:asset/${AssetId}`	aws:ResourceTag/${TagKey}
asset-model	`arn:${Partition}:iotsitewise:${Region}:${Account}:asset-model/${AssetModelId}`	aws:ResourceTag/${TagKey}
time-series	`arn:${Partition}:iotsitewise:${Region}:${Account}:time-series/${TimeSeriesId}`	aws:ResourceTag/${TagKey}
gateway	`arn:${Partition}:iotsitewise:${Region}:${Account}:gateway/${GatewayId}`	aws:ResourceTag/${TagKey}
portal	`arn:${Partition}:iotsitewise:${Region}:${Account}:portal/${PortalId}`	aws:ResourceTag/${TagKey}
project	`arn:${Partition}:iotsitewise:${Region}:${Account}:project/${ProjectId}`	aws:ResourceTag/${TagKey}
dashboard	`arn:${Partition}:iotsitewise:${Region}:${Account}:dashboard/${DashboardId}`	aws:ResourceTag/${TagKey}
access-policy	`arn:${Partition}:iotsitewise:${Region}:${Account}:access-policy/${AccessPolicyId}`	aws:ResourceTag/${TagKey}

Condition keys for AWS IoT SiteWise

AWS IoT SiteWise defines the following condition keys that can be used in the Condition element of an IAM policy. You can use these keys to further refine the conditions under which the policy statement applies. For details about the columns in the following table, see Condition keys table.

To view the global condition keys that are available to all services, see Available global condition keys.


Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by the tags attached to the resource	String
aws:TagKeys	Filters access by the tag keys in the request	ArrayOfString
iotsitewise:assetHierarchyPath	Filters access by an asset hierarchy path, which is the string of asset IDs in the asset's hierarchy, each separated by a forward slash	String
iotsitewise:childAssetId	Filters access by the ID of a child asset being associated whith a parent asset	String
iotsitewise:group	Filters access by the ID of an AWS Single Sign-On group	String
iotsitewise:iam	Filters access by the ID of an AWS IAM identity	String
iotsitewise:isAssociatedWithAssetProperty	Filters access by data streams associated with or not associated with asset properties	String
iotsitewise:portal	Filters access by the ID of a portal	String
iotsitewise:project	Filters access by the ID of a project	String
iotsitewise:propertyAlias	Filters access by the property alias	String
iotsitewise:propertyId	Filters access by the ID of an asset property	String
iotsitewise:user	Filters access by the ID of an AWS Single Sign-On user	String

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

AWS IoT Jobs DataPlane

AWS IoT TwinMaker