Access management for AWS DataSync - AWS DataSync
DataSync resources and operationsUnderstanding resource ownershipManaging access to resourcesSpecifying policy elements: Actions, effects, resources, and principalsSpecifying conditions in a policy

Access management for AWS DataSync

Every AWS resource is owned by an AWS account. Permissions to create or access a resource are governed by permissions policies. An account administrator can attach permissions policies to AWS Identity and Access Management (IAM) identities. Some services (such as AWS Lambda) also support attaching permissions policies to resources.

Note

An account administrator is a user with administrator privileges in an AWS account. For more information, see IAM best practices in the IAM User Guide.

DataSync resources and operations

In DataSync, the primary resources are agent, location, task, and task execution.

These resources have unique Amazon Resource Names (ARNs) associated with them, as shown in the following table.

Resource type ARN format

Agent ARN

arn:aws:datasync:region:account-id:agent/agent-id
Location ARN

arn:aws:datasync:region:account-id:location/location-id
Task ARN

arn:aws:datasync:region:account-id:task/task-id

Task execution ARN

arn:aws:datasync:region:account-id:task/task-id/execution/exec-id

To grant permissions for specific API operations, such as creating a task, DataSync defines a set of actions that you can specify in a permissions policy. An API operation can require permissions for more than one action. For a list of all the DataSync API actions and the resources that they apply to, see DataSync API permissions: Actions and resources.

Understanding resource ownership

A resource owner is the AWS account that created the resource. That is, the resource owner is the AWS account of the principal entity (for example, an IAM role) which authenticates the request that creates the resource. The following examples illustrate how this behavior works:

  • If you use the root account credentials of your AWS account to create a task, your AWS account is the owner of the resource (in DataSync, the resource is the task).

  • If you create an IAM roles in your AWS account and grant permissions to the CreateTask action to that user, the user can create a task. However, your AWS account, to which the user belongs, owns the task resource.

  • If you create an IAM role in your AWS account with permissions to create a task, anyone who can assume the role can create a task. Your AWS account, to which the role belongs, owns the task resource.

Managing access to resources

A permissions policy describes who has access to what. The following section explains the available options for creating permissions policies.

Note

This section discusses using IAM in the context of DataSync. It doesn't provide detailed information about the IAM service. For complete IAM documentation, see What is IAM? in the IAM User Guide. For information about IAM policy syntax and descriptions, see AWS Identity and Access Management policy reference in the IAM User Guide.

Policies attached to an IAM identity are referred to as identity-based policies (IAM policies) and policies attached to a resource are referred to as resource-based policies. DataSync supports only identity-based policies (IAM policies).

Identity-based policies

You can manage DataSync resource access with IAM policies. These policies can help an AWS account administrator do the following with DataSync:

  • Grant permissions to create and manage DataSync resources – Create an IAM policy that allows an IAM role in your AWS account to create and manage DataSync resources, such as agents, locations, and tasks.

  • Grant permissions to a role in another AWS account or an AWS service – Create an IAM policy that grants permissions to an IAM role in a different AWS account or an AWS service. For example:

    1. The Account A administrator creates an IAM role and attaches a permissions policy to the role that grants permissions on resources in Account A.

    2. The Account A administrator attaches a trust policy to the role that identifies Account B as the principal who can assume the role.

      To grant an AWS service permissions to assume the role, the Account A administrator can specify an AWS service as the principal in the trust policy.

    3. The Account B administrator can then delegate permissions to assume the role to any users in Account B. This allows anyone using the role in Account B to create or access resources in Account A.

    For more information about using IAM to delegate permissions, see Access management in the IAM User Guide.

The following example policy grants permissions to all List* actions on all resources. This action is a read-only action and doesn't allow resource modification.

{
    "Version": "2012-10-17",
    "Statement": [
        {
            "Sid": "AllowAllListActionsOnAllResources",
            "Effect": "Allow",
            "Action": [
                "datasync:List*"
            ],
            "Resource": "*"
        }
    ]
}

For more information about using identity-based policies with DataSync, see AWS managed policies and customer managed policies. For more information about IAM identities, see the IAM User Guide .

Resource-based policies

Other services, such as Amazon S3, support resource-based permissions policies. For example, you can attach a policy to an Amazon S3 bucket to manage access permissions to that bucket. However, DataSync doesn't support resource-based policies.

Specifying policy elements: Actions, effects, resources, and principals

For each DataSync resource (see DataSync API permissions: Actions and resources), the service defines a set of API operations (see Actions). To grant permissions for these API operations, DataSync defines a set of actions that you can specify in a policy. For example, for the DataSync resource, the following actions are defined: CreateTask, DeleteTask, and DescribeTask. Performing an API operation can require permissions for more than one action.

The following are the most basic policy elements:

  • Resource – In a policy, you use an Amazon Resource Name (ARN) to identify the resource to which the policy applies. For DataSync resources, you can use the wildcard character (*) in IAM policies. For more information, see DataSync resources and operations.

  • Action – You use action keywords to identify resource operations that you want to allow or deny. For example, depending on the specified Effect element, the datasync:CreateTask permission allows or denies the user permissions to perform the DataSync CreateTask operation.

  • Effect – You specify the effect when the user requests the specific action—this effect can be either Allow or Deny. If you don't explicitly grant access to (Allow) a resource, access is implicitly denied. You can also explicitly deny access to a resource, which you might do to make sure that a user cannot access it, even if a different policy grants that user access. For more information, see Authorization in the IAM User Guide.

  • Principal – In identity-based policies (IAM policies), the user that the policy is attached to is the implicit principal. For resource-based policies, you specify the user, account, service, or other entity that you want to receive permissions (applies to resource-based policies only). DataSync doesn't support resource-based policies.

To learn more about IAM policy syntax and descriptions, see AWS Identity and Access Management policy reference in the IAM User Guide.

For a table showing all of the DataSync API actions, see DataSync API permissions: Actions and resources.

Specifying conditions in a policy

When you grant permissions, you can use the IAM policy language to specify the conditions when a policy should take effect when granting permissions. For example, you might want a policy to be applied only after a specific date. For more information about specifying conditions in policy language, see Condition in the IAM User Guide.

To express conditions, you use predefined condition keys. There are no condition keys specific to DataSync. However, there are AWS wide condition keys that you can use as appropriate. For a complete list of AWS wide keys, see Available keys in the IAM User Guide.