Operations Actions Resource types Condition keys

Actions, resources, and condition keys for Amazon Managed Streaming for Kafka Connect

Amazon Managed Streaming for Kafka Connect (service prefix: kafkaconnect) provides the following service-specific operations, resources, actions, and condition keys for use in IAM permission policies.

References:

Learn how to configure this service.
View a list of the API operations available for this service.
Learn how to secure this service and its resources by using IAM permission policies.
View the programmatic service authorization reference for this service.

Topics

API operations defined by Amazon Managed Streaming for Kafka Connect
Actions defined by Amazon Managed Streaming for Kafka Connect
Resource types defined by Amazon Managed Streaming for Kafka Connect
Condition keys for Amazon Managed Streaming for Kafka Connect

API operations defined by Amazon Managed Streaming for Kafka Connect

The following table maps API operations to the IAM actions they authorize. Only condition keys that have static values for the given API and action are listed; for the full set of condition keys supported by each action, see the Actions table.

Operation	IAM action	Condition key	Possible value(s)	Access level
CreateConnector	kafkaconnect:CreateConnector			Write
	kafkaconnect:TagResource			Tagging, Write
	iam:PassRole	iam:PassedToService	kafkaconnect.amazonaws.com	Write
CreateCustomPlugin	kafkaconnect:CreateCustomPlugin			Write
CreateCustomPlugin	kafkaconnect:TagResource			Tagging, Write
CreateWorkerConfiguration	kafkaconnect:CreateWorkerConfiguration			Write
CreateWorkerConfiguration	kafkaconnect:TagResource			Tagging, Write
DeleteConnector	kafkaconnect:DeleteConnector			Write
DeleteCustomPlugin	kafkaconnect:DeleteCustomPlugin			Write
DeleteWorkerConfiguration	kafkaconnect:DeleteWorkerConfiguration			Write
DescribeConnector	kafkaconnect:DescribeConnector			Read
DescribeConnectorOperation	kafkaconnect:DescribeConnector			Read
DescribeConnectorOperation	kafkaconnect:DescribeConnectorOperation			Read
DescribeCustomPlugin	kafkaconnect:DescribeCustomPlugin			Read
DescribeWorkerConfiguration	kafkaconnect:DescribeWorkerConfiguration			Read
ListConnectorOperations	kafkaconnect:ListConnectorOperations			Read
ListConnectors	kafkaconnect:ListConnectors			Read
ListCustomPlugins	kafkaconnect:ListCustomPlugins			Read
ListTagsForResource	kafkaconnect:ListTagsForResource			Read
ListWorkerConfigurations	kafkaconnect:ListWorkerConfigurations			Read
TagResource	kafkaconnect:TagResource			Tagging, Write
UntagResource	kafkaconnect:UntagResource			Tagging, Write
UpdateConnector	kafkaconnect:UpdateConnector			Write

Actions defined by Amazon Managed Streaming for Kafka Connect

You can specify the following actions in the Action element of an IAM policy statement. Use policies to grant permissions to perform an operation in AWS. When you use an action in a policy, you usually allow or deny access to the API operation or CLI command with the same name. However, in some cases, a single action controls access to more than one operation. Alternatively, some operations require several different actions.

Actions	Description	Resource types (*required)	Condition keys	Access level
CreateConnector	Grants permission to create an MSK Connect connector			Write
CreateCustomPlugin	Grants permission to create an MSK Connect custom plugin			Write
CreateWorkerConfiguration	Grants permission to create an MSK Connect worker configuration			Write
DeleteConnector	Grants permission to delete an MSK Connect connector	connector*	aws:ResourceTag/${TagKey}	Write
DeleteCustomPlugin	Grants permission to delete an MSK Connect custom plugin	custom plugin*	aws:ResourceTag/${TagKey}	Write
DeleteWorkerConfiguration	Grants permission to delete an MSK Connect worker configuration	worker configuration*	aws:ResourceTag/${TagKey}	Write
DescribeConnector	Grants permission to describe an MSK Connect connector	connector*	aws:ResourceTag/${TagKey}	Read
DescribeConnectorOperation	Grants permission to describe a MSK Connect connector operation	connector operation*	aws:ResourceTag/${TagKey}	Read
DescribeCustomPlugin	Grants permission to describe an MSK Connect custom plugin	custom plugin*	aws:ResourceTag/${TagKey}	Read
DescribeWorkerConfiguration	Grants permission to describe an MSK Connect worker configuration	worker configuration*	aws:ResourceTag/${TagKey}	Read
ListConnectorOperations	Grants permission to list all operations of a given MSK Connect connector	connector*	aws:ResourceTag/${TagKey}	Read
ListConnectors	Grants permission to list all MSK Connect connectors in this account			Read
ListCustomPlugins	Grants permission to list all MSK Connect custom plugins in this account			Read
ListTagsForResource	Grants permission to list tags of an MSK Connect resource	connector	aws:ResourceTag/${TagKey}	Read
		custom plugin	aws:ResourceTag/${TagKey}
		worker configuration	aws:ResourceTag/${TagKey}
ListWorkerConfigurations	Grants permission to list all MSK Connect worker configurations in this account			Read
TagResource	Grants permission to tag an MSK Connect resource	connector	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		custom plugin	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
		worker configuration	aws:RequestTag/${TagKey} aws:ResourceTag/${TagKey} aws:TagKeys
UntagResource	Grants permission to remove tags from an MSK Connect resource	connector	aws:ResourceTag/${TagKey} aws:TagKeys	Tagging, Write
		custom plugin	aws:ResourceTag/${TagKey} aws:TagKeys
		worker configuration	aws:ResourceTag/${TagKey} aws:TagKeys
UpdateConnector	Grants permission to update an MSK Connect connector	connector*	aws:ResourceTag/${TagKey}	Write

Resource types defined by Amazon Managed Streaming for Kafka Connect

The following resource types are defined by this service and can be used in the Resource element of IAM permission policy statements.

Resource types	ARN	Condition keys
connector	arn:${Partition}:kafkaconnect:${Region}:${Account}:connector/${ConnectorName}/${UUID}	aws:ResourceTag/${TagKey}
connector operation	arn:${Partition}:kafkaconnect:${Region}:${Account}:connector-operation/${ConnectorName}/${ConnectorUUID}/${UUID}	aws:ResourceTag/${TagKey}
custom plugin	arn:${Partition}:kafkaconnect:${Region}:${Account}:custom-plugin/${CustomPluginName}/${UUID}	aws:ResourceTag/${TagKey}
worker configuration	arn:${Partition}:kafkaconnect:${Region}:${Account}:worker-configuration/${WorkerConfigurationName}/${UUID}	aws:ResourceTag/${TagKey}

Condition keys for Amazon Managed Streaming for Kafka Connect

Amazon Managed Streaming for Kafka Connect defines the following condition keys that can be used in the Condition element of an IAM policy.

Condition keys	Description	Type
aws:RequestTag/${TagKey}	Filters access by the presence of tag key-value pairs in the request	String
aws:ResourceTag/${TagKey}	Filters access by tag key-value pairs attached to the resource	String
aws:TagKeys	Filters access by the presence of tag keys in the request	ArrayOfString

Warning Javascript is disabled or is unavailable in your browser.

To use the Amazon Web Services Documentation, Javascript must be enabled. Please refer to your browser's Help pages for instructions.

Document Conventions

Amazon Managed Streaming for Apache Kafka (kafka)

Amazon Managed Workflows for Apache Airflow (airflow)