Actions, resources, and condition keys for AWS Deadline Cloud
AWS Deadline Cloud (service prefix: deadline) provides the following
service-specific operations, resources, actions, and condition keys for use in IAM permission
policies.
References:
-
Learn how to configure this service.
-
View a list of the API operations available for this service.
-
Learn how to secure this service and its resources by using IAM permission policies.
-
View the programmatic service authorization reference
for this service.
Topics
API operations defined by AWS Deadline Cloud
The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.
| Operation | IAM action | Condition key | Possible value(s) | Access level |
|---|---|---|---|---|
|
AssociateMemberToFarm |
Permissions management, Write |
|||
|
AssociateMemberToFleet |
Permissions management, Write |
|||
|
AssociateMemberToJob |
Permissions management, Write |
|||
|
AssociateMemberToQueue |
Permissions management, Write |
|||
|
AssumeFleetRoleForRead |
Write |
|||
|
AssumeFleetRoleForWorker |
Write |
|||
|
AssumeQueueRoleForRead |
Write |
|||
|
AssumeQueueRoleForUser |
Write |
|||
|
AssumeQueueRoleForWorker |
Write |
|||
|
BatchGetJob |
Read |
|||
|
BatchGetJobEntity |
Read |
|||
|
BatchGetSession |
Read |
|||
|
BatchGetSessionAction |
Read |
|||
|
BatchGetStep |
Read |
|||
|
BatchGetTask |
Read |
|||
|
BatchGetWorker |
Read |
|||
|
BatchUpdateJob |
Write |
|||
|
BatchUpdateTask |
Write |
|||
|
CopyJobTemplate |
Write |
|||
Read |
||||
|
CreateBudget |
Write |
|||
Tagging, Write |
||||
|
CreateFarm |
Write |
|||
Tagging, Write |
||||
|
CreateFleet |
Write |
|||
Tagging, Write |
||||
iam:PassedToService |
deadline.amazonaws.com |
Write |
||
|
CreateJob |
Write |
|||
Read |
||||
Tagging, Write |
||||
|
CreateLicenseEndpoint |
Write |
|||
Tagging, Write |
||||
|
CreateLimit |
Write |
|||
|
CreateMonitor |
Write |
|||
Tagging, Write |
||||
iam:PassedToService |
deadline.amazonaws.com |
Write |
||
|
CreateQueue |
Write |
|||
Tagging, Write |
||||
iam:PassedToService |
deadline.amazonaws.com |
Write |
||
|
CreateQueueEnvironment |
Write |
|||
|
CreateQueueFleetAssociation |
Write |
|||
|
CreateQueueLimitAssociation |
Write |
|||
|
CreateStorageProfile |
Write |
|||
|
CreateWorker |
Write |
|||
Read |
||||
Tagging, Write |
||||
|
DeleteBudget |
Write |
|||
|
DeleteFarm |
Write |
|||
|
DeleteFleet |
Write |
|||
|
DeleteLicenseEndpoint |
Write |
|||
|
DeleteLimit |
Write |
|||
|
DeleteMeteredProduct |
Write |
|||
|
DeleteMonitor |
Write |
|||
|
DeleteQueue |
Write |
|||
|
DeleteQueueEnvironment |
Write |
|||
|
DeleteQueueFleetAssociation |
Write |
|||
|
DeleteQueueLimitAssociation |
Write |
|||
|
DeleteStorageProfile |
Write |
|||
|
DeleteVolume |
Write |
|||
|
DeleteWorker |
Write |
|||
|
DisassociateMemberFromFarm |
Permissions management, Write |
|||
|
DisassociateMemberFromFleet |
Permissions management, Write |
|||
|
DisassociateMemberFromJob |
Permissions management, Write |
|||
|
DisassociateMemberFromQueue |
Permissions management, Write |
|||
|
GetBudget |
Read |
|||
|
GetFarm |
Read |
|||
|
GetFleet |
Read |
|||
|
GetJob |
Read |
|||
|
GetLicenseEndpoint |
Read |
|||
|
GetLimit |
Read |
|||
|
GetMonitor |
Read |
|||
|
GetMonitorSettings |
Read |
|||
|
GetQueue |
Read |
|||
|
GetQueueEnvironment |
Read |
|||
|
GetQueueFleetAssociation |
Read |
|||
|
GetQueueLimitAssociation |
Read |
|||
|
GetSession |
Read |
|||
|
GetSessionAction |
Read |
|||
|
GetSessionsStatisticsAggregation |
Read |
|||
|
GetStep |
Read |
|||
|
GetStorageProfile |
Read |
|||
|
GetStorageProfileForQueue |
Read |
|||
|
GetTask |
Read |
|||
|
GetVolume |
Read |
|||
|
GetWorker |
Read |
|||
|
ListAvailableMeteredProducts |
List |
|||
|
ListBudgets |
List |
|||
|
ListFarmMembers |
List |
|||
|
ListFarms |
List |
|||
|
ListFleetMembers |
List |
|||
|
ListFleets |
List |
|||
|
ListJobMembers |
List |
|||
|
ListJobParameterDefinitions |
List |
|||
|
ListJobs |
List |
|||
|
ListLicenseEndpoints |
List |
|||
|
ListLimits |
List |
|||
|
ListMeteredProducts |
List |
|||
|
ListMonitors |
List |
|||
|
ListQueueEnvironments |
List |
|||
|
ListQueueFleetAssociations |
List |
|||
|
ListQueueLimitAssociations |
List |
|||
|
ListQueueMembers |
List |
|||
|
ListQueues |
List |
|||
|
ListSessionActions |
List |
|||
|
ListSessions |
List |
|||
|
ListSessionsForWorker |
List |
|||
|
ListStepConsumers |
List |
|||
|
ListStepDependencies |
List |
|||
|
ListSteps |
List |
|||
|
ListStorageProfiles |
List |
|||
|
ListStorageProfilesForQueue |
List |
|||
|
ListTagsForResource |
Read |
|||
|
ListTasks |
List |
|||
|
ListVolumes |
List |
|||
|
ListWorkers |
List |
|||
|
PutMeteredProduct |
Write |
|||
|
SearchJobs |
Read |
|||
|
SearchSteps |
Read |
|||
|
SearchTasks |
Read |
|||
|
SearchWorkers |
Read |
|||
|
StartSessionsStatisticsAggregation |
Read |
|||
|
TagResource |
Tagging, Write |
|||
|
UntagResource |
Tagging, Write |
|||
|
UpdateBudget |
Write |
|||
|
UpdateFarm |
Write |
|||
|
UpdateFleet |
Write |
|||
iam:PassedToService |
deadline.amazonaws.com |
Write |
||
|
UpdateJob |
Write |
|||
|
UpdateLimit |
Write |
|||
|
UpdateMonitor |
Write |
|||
iam:PassedToService |
deadline.amazonaws.com |
Write |
||
|
UpdateMonitorSettings |
Write |
|||
|
UpdateQueue |
Write |
|||
iam:PassedToService |
deadline.amazonaws.com |
Write |
||
|
UpdateQueueEnvironment |
Write |
|||
|
UpdateQueueFleetAssociation |
Write |
|||
|
UpdateQueueLimitAssociation |
Write |
|||
|
UpdateSession |
Write |
|||
|
UpdateStep |
Write |
|||
|
UpdateStorageProfile |
Write |
|||
|
UpdateTask |
Write |
|||
|
UpdateWorker |
Write |
|||
|
UpdateWorkerSchedule |
Write |
Actions defined by AWS Deadline Cloud
You can specify the following actions in the Action element of an IAM
policy statement. Use policies to grant permissions to perform an operation in AWS. When
you use an action in a policy, you usually allow or deny access to the API operation or CLI
command with the same name. However, in some cases, a single action controls access to more
than one operation. Alternatively, some operations require several different actions.
| Actions | Description | Resource types (*required) | Condition keys | Access level |
|---|---|---|---|---|
Grants permission to associate a member to a farm |
Permissions management, Write |
|||
Grants permission to associate a member to a fleet |
deadline:AssociatedMembershipLevel |
Permissions management, Write |
||
Grants permission to associate a member to a job |
Permissions management, Write |
|||
Grants permission to associate a member to a queue |
Permissions management, Write |
|||
Grants permission to assume a fleet role for read-only access |
Write |
|||
Grants permission to assume a fleet role for a worker |
Write |
|||
Grants permission to assume a queue role for read-only access |
Write |
|||
Grants permission to assume a queue role for a user |
Write |
|||
Grants permission to assume a queue role for a worker |
Write |
|||
Grants permission to get a job entity for a worker |
Read |
|||
Grants permission to copy a job template to an Amazon S3 bucket |
Write |
|||
Grants permission to create a budget |
Write |
|||
Grants permission to create a farm |
Write |
|||
Grants permission to create a fleet |
Write |
|||
Grants permission to create a job |
Write |
|||
Grants permission to create a license endpoint for licensed software or products |
Write |
|||
Grants permission to create a limit for a farm |
Write |
|||
Grants permission to create a monitor |
Write |
|||
Grants permission to create a queue |
Write |
|||
Grants permission to create a queue environment |
Write |
|||
Grants permission to create a queue-fleet association |
Write |
|||
Grants permission to create a queue-limit association |
Write |
|||
Grants permission to create a storage profile for a farm |
Write |
|||
Grants permission to create a worker |
Write |
|||
Grants permission to delete a budget |
Write |
|||
Grants permission to delete a farm |
Write |
|||
Grants permission to delete a fleet |
Write |
|||
Grants permission to delete a license endpoint |
Write |
|||
Grants permission to delete a limit |
Write |
|||
Grants permission to delete a metered product |
Write |
|||
Grants permission to delete a monitor |
Write |
|||
Grants permission to delete a queue |
Write |
|||
Grants permission to delete a queue environment |
Write |
|||
Grants permission to delete a queue-fleet association |
Write |
|||
Grants permission to delete a queue-limit association |
Write |
|||
Grants permission to delete a storage profile |
Write |
|||
Grants permission to delete a volume |
Write |
|||
Grants permission to delete a worker |
Write |
|||
Grants permission to disassociate a member from a farm |
Permissions management, Write |
|||
Grants permission to disassociate a member from a fleet |
Permissions management, Write |
|||
Grants permission to disassociate a member from a job |
Permissions management, Write |
|||
Grants permission to disassociate a member from a queue |
Permissions management, Write |
|||
Grants permission to get a budget |
Read |
|||
Grants permission to get a farm |
Read |
|||
Grants permission to get a fleet |
Read |
|||
Grants permission to get a job |
Read |
|||
Grants permission to get a license endpoint |
Read |
|||
Grants permission to get a limit |
Read |
|||
Grants permission to get a monitor |
Read |
|||
Grants permission to get settings for a monitor |
Read |
|||
Grants permission to get a queue |
Read |
|||
Grants permission to get a queue environment |
Read |
|||
Grants permission to get a queue-fleet association |
Read |
|||
Grants permission to get a queue-limit association |
Read |
|||
Grants permission to get a session for a job |
Read |
|||
Grants permission to get a session action for a job |
Read |
|||
Grants permission to get all collected statistics for sessions |
Read |
|||
Grants permission to get a step in a job |
Read |
|||
Grants permission to get a storage profile |
Read |
|||
Grants permission to get a storage profile for a queue |
Read |
|||
Grants permission to get a job task |
Read |
|||
Grants permission to get a volume |
Read |
|||
Grants permission to get a worker |
Read |
|||
Grants permission to list all available metered products within a license endpoint |
List |
|||
Grants permission to list all budgets for a farm |
List |
|||
Grants permission to list all members of a farm |
List |
|||
Grants permission to list all farms |
List |
|||
Grants permission to list all members of a fleet |
List |
|||
Grants permission to list all fleets |
List |
|||
Grants permission to list all members of a job |
List |
|||
Grants permission to get a job's parameter definitions in the job template |
List |
|||
Grants permission to list all jobs in a queue |
List |
|||
Grants permission to list all license endpoints |
List |
|||
Grants permission to list all limits in a farm |
List |
|||
Grants permission to list all metered products in a license endpoint |
List |
|||
Grants permission to list all monitors |
List |
|||
Grants permission to list all queue environments to which a queue is associated |
List |
|||
Grants permission to list all queue-fleet associations |
List |
|||
Grants permission to list all queue-limit associations |
List |
|||
Grants permission to list all members in a queue |
List |
|||
Grants permission to list all queues on a farm |
List |
|||
Grants permission to list all session actions for a job |
List |
|||
Grants permission to list all sessions for a job |
List |
|||
Grants permission to list all sessions for a worker |
List |
|||
Grants permission to list the step consumers for a job step |
List |
|||
Grants permission to list dependencies for a job step |
List |
|||
Grants permission to list all steps for a job |
List |
|||
Grants permission to list all storage profiles in a farm |
List |
|||
Grants permission to list all storage profiles in a queue |
List |
|||
Grants permission to list all tags on specified Deadline Cloud resources |
Read |
|||
Grants permission to list all tasks for a job |
List |
|||
Grants permission to list volumes |
List |
|||
Grants permission to list all workers in a fleet |
List |
|||
Grants permission to add a metered product to a license endpoint |
Write |
|||
Grants permission to search for jobs in multiple queues |
Read |
|||
Grants permission to search the steps within a single job or to search the steps for multiple queues |
Read |
|||
Grants permission to search the tasks within a single job or to search the tasks for multiple queues |
Read |
|||
Grants permission to search for workers in multiple fleets |
Read |
|||
Grants permission to get all collected statistics for sessions |
Read |
|||
Grants permission to add or overwrite one or more tags for the specified Deadline Cloud resource |
Tagging, Write |
|||
Grants permission to disassociate one or more tags from the specified Deadline Cloud resource |
Tagging, Write |
|||
Grants permission to update a budget |
Write |
|||
Grants permission to update a farm |
Write |
|||
Grants permission to update a fleet |
Write |
|||
Grants permission to update a job |
Write |
|||
Grants permission to update a limit for a farm |
Write |
|||
Grants permission to update a monitor |
Write |
|||
Grants permission to update settings for a monitor |
Write |
|||
Grants permission to update a queue |
Write |
|||
Grants permission to update a queue environment |
Write |
|||
Grants permission to update a queue-fleet association |
Write |
|||
Grants permission to update a queue-limit association |
Write |
|||
Grants permission to update a session for a job |
Write |
|||
Grants permission to update a step for a job |
Write |
|||
Grants permission to update a storage profile for a farm |
Write |
|||
Grants permission to update a task |
Write |
|||
Grants permission to update a worker |
Write |
|||
Grants permission to update the schedule for a worker |
Write |
Permission-only actions for AWS Deadline Cloud
The following actions are defined by AWS Deadline Cloud but are not directly invocable through any API operation. They can only be used in IAM policy statements to grant or deny permissions.
| Actions | Description | Resource types (*required) | Condition keys | Access level |
|---|---|---|---|---|
Grants permission to get the latest version of an application |
Read |
|||
Grants permission to read job template |
Read |
Resource types defined by AWS Deadline Cloud
The following resource types are defined by this service and can be used in the
Resource element of IAM permission policy statements.
| Resource types | ARN | Condition keys |
|---|---|---|
arn:${Partition}:deadline:${Region}:${Account}:farm/${FarmId}/budget/${BudgetId} |
||
arn:${Partition}:deadline:${Region}:${Account}:farm/${FarmId} |
||
arn:${Partition}:deadline:${Region}:${Account}:farm/${FarmId}/fleet/${FleetId} |
||
arn:${Partition}:deadline:${Region}:${Account}:farm/${FarmId}/queue/${QueueId}/job/${JobId} |
||
arn:${Partition}:deadline:${Region}:${Account}:license-endpoint/${LicenseEndpointId} |
||
arn:${Partition}:deadline:${Region}:${Account}:monitor/${MonitorId} |
||
arn:${Partition}:deadline:${Region}:${Account}:farm/${FarmId}/queue/${QueueId} |
||
arn:${Partition}:deadline:${Region}:${Account}:farm/${FarmId}/fleet/${FleetId}/volume/${VolumeId} |
||
arn:${Partition}:deadline:${Region}:${Account}:farm/${FarmId}/fleet/${FleetId}/worker/${WorkerId} |
Condition keys for AWS Deadline Cloud
AWS Deadline Cloud defines the following condition keys that can be used in the
Condition element of an IAM policy.
| Condition keys | Description | Type |
|---|---|---|
Filters access by the tags that are passed in the request |
String |
|
Filters access by the tags associated with the resource |
String |
|
Filters access by the tag keys that are passed in the request |
ArrayOfString |
|
Filters access by the associated membership level of the principal provided in the request |
String |
|
Filters access by the allowed action in the request |
String |
|
Filters access by membership levels on the farm |
ArrayOfString |
|
Filters access by membership levels on the fleet |
ArrayOfString |
|
Filters access by membership levels on the job |
ArrayOfString |
|
Filters access by the membership level passed in the request |
String |
|
Filters access by the principle ID provided in the request |
String |
|
Filters access by membership levels on the queue |
ArrayOfString |
|
Filters access by the user calling the Deadline Cloud API |
String |
