Resource-level permissions in AWS User Notifications - AWS User Notifications
Supported resource-level permissions for User Notifications API actions Example 1: Administrator access Example 2: ReadOnly access Example 3: Deny a user the ability to update a notification configuration

Resource-level permissions in AWS User Notifications

Resource-level permissions define the AWS resources that you allow assigned entities (users, groups, and roles) to perform actions on. You specifiy the Amazon Resource Name (ARN) of one or more resources as part of an IAM policy. You can then attach this policy to IAM entities. When the action doesn't act on a named resource, or when you grant permission to perform the action on all resources, the value of the resource in the policy is a wildcard (*).

Note

AWS User Notifications doesn't support resource-based policies, which are directly attached to AWS resources. For more information about the differences between policies and permissions, see Identity-based policies and resource-based policies in the IAM User Guide.

For more information about defining resource-level permissions, see Creating IAM policies in the IAM User Guide.

Supported resource-level permissions for User Notifications API actions

This table describes the User Notifications API actions that currently support resource-level permissions, as well as the supported resources for each action, including their ARNs and ARN format.

Resource API action Resource ARN format Example

Notification Configuration

CreateNotificationConfiguration

arn:aws:notifications:*:accountId:configuration/*

arn:aws:notifications:*:123456789012:configuration/*

UpdateNotificationConfiguration

arn:aws:notifications::accountId:configuration/configurationId

arn:aws:notifications::123456789012:configuration/a01gkn2k10c7spt0a8x8nj55555

DeleteNotificationConfiguration

arn:aws:notifications::accountId:configuration/configurationId

arn:aws:notifications::123456789012:configuration/a01gkn2k10c7spt0a8x8nj55555

GetNotificationConfiguration

arn:aws:notifications::accountId:configuration/configurationId

arn:aws:notifications::123456789012:configuration/a01gkn2k10c7spt0a8x8nj55555

ListNotificationConfiguration

*

*

Event Rule

CreateEventRule

arn:aws:notifications::accountId:configuration/configurationId/rule/*

arn:aws:notifications::123456789012:configuration/a01gkn2k10c7spt0a8x8nj55555/rule/*

UpdateEventRule

arn:aws:notifications::accountId:configuration/configurationId/rule/eventRuleId

arn:aws:notifications::123456789012:configuration/a01gkn2k10c7spt0a8x8nj55555/rule/a01gkn362610da5e7dckrt66666

DeleteEventRule

arn:aws:notifications::accountId:configuration/configurationId/rule/eventRuleId

arn:aws:notifications::123456789012:configuration/a01gkn2k10c7spt0a8x8nj55555/rule/a01gkn362610da5e7dckrt66666

GetEventRule

arn:aws:notifications::accountId:configuration/configurationId/rule/eventRuleId

arn:aws:notifications::123456789012:configuration/a01gkn2k10c7spt0a8x8nj55555/rule/a01gkn362610da5e7dckrt66666

ListEventRules

*

*

Channel

AssociateChannel

arn:aws:notifications::accountId:configuration/configurationId

arn:aws:notifications::123456789012:configuration/a01gkn2k10c7spt0a8x8nj55555

DisassociateChannel

arn:aws:notifications::accountId:configuration/configurationId

arn:aws:notifications::123456789012:configuration/a01gkn2k10c7spt0a8x8nj55555

ListChannels

*

*

Notification Event

GetNotificationEvent

arn:aws:notifications::accountId:configuration/configurationId/event/notificationEventId

arn:aws:notifications::123456789012:configuration/a01gkn2k10c7spt0a8x8nj55555/event/b01gaja54v1t6rr10dyshk77777

ListNotificationEvents

*

*

Notification Hub

RegisterNotificationHub

*

*

DeregisterNotificationHub

*

*

ListNotificationHubs

*

*

Email Contacts

ActivateEmailContact

arn:aws:notifications-contacts::accountId:emailcontact/emailContactId

arn:aws:notifications-contacts::123456789012:emailcontact/02k1g09g

CreateEmailContact

arn:aws:notifications-contacts::accountId:emailcontact/emailContactId

arn:aws:notifications-contacts::123456789012:emailcontact/02k1g09g

DeleteEmailContact

arn:aws:notifications-contacts::accountId:emailcontact/emailContactId

arn:aws:notifications-contacts::123456789012:emailcontact/02k1g09g

GetEmailContact

arn:aws:notifications-contacts::accountId:emailcontact/emailContactId

arn:aws:notifications-contacts::123456789012:emailcontact/02k1g09g

ListEmailContacts

arn:aws:notifications-contacts::accountId:emailcontact/emailContactId

arn:aws:notifications-contacts::123456789012:emailcontact/02k1g09g

ListTagsForResource

arn:aws:notifications-contacts::accountId:emailcontact/emailContactId

arn:aws:notifications-contacts::123456789012:emailcontact/02k1g09g

SendActivationCode

arn:aws:notifications-contacts::accountId:emailcontact/emailContactId

arn:aws:notifications-contacts::123456789012:emailcontact/02k1g09g

TagResource

arn:aws:notifications-contacts::accountId:emailcontact/emailContactId

arn:aws:notifications-contacts::123456789012:emailcontact/02k1g09g

UntagResource

arn:aws:notifications-contacts::accountId:emailcontact/emailContactId

arn:aws:notifications-contacts::123456789012:emailcontact/02k1g09g

Example 1: Administrator access

This policy allows a user to call all available APIs.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "notifications:*",
        "notifications-contacts:*"
      ],
      "Resource": "*"
    }
  ]
}

Example 2: ReadOnly access

This policy allows a user to use get and list API actions.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "notifications:Get*",
        "notifications:List*",
        "notifications-contacts:Get*",
        "notifications-contacts:List*"
        
      ],
      "Resource": "*"
    }
  ]
}

Example 3: Deny a user the ability to update a notification configuration

This policy denies a user the ability to update a notification configuration.

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Deny",
      "Action": [
        "notifications:UpdateNotificationConfiguration"
      ],
      "Resource": "arn:aws:notifications::123456789012:configuration/a01gkn2k10c7spt0a8x8nj55555"
    }
  ]
}