ApiKeyRestrictions
API Restrictions on the allowed actions, resources, and referers for an API key resource.
Contents
- AllowActions
-
A list of allowed actions that an API key resource grants permissions to perform. You must have at least one action for each type of resource. For example, if you have a place resource, you must include at least one place action.
The following are valid values for the actions.
-
Map actions
-
geo:GetMap*
- Allows all actions needed for map rendering.
-
-
Place actions
-
geo:SearchPlaceIndexForText
- Allows geocoding. -
geo:SearchPlaceIndexForPosition
- Allows reverse geocoding. -
geo:SearchPlaceIndexForSuggestions
- Allows generating suggestions from text. -
GetPlace
- Allows finding a place by place ID.
-
-
Route actions
-
geo:CalculateRoute
- Allows point to point routing. -
geo:CalculateRouteMatrix
- Allows calculating a matrix of routes.
-
Note
You must use these strings exactly. For example, to provide access to map rendering, the only valid action is
geo:GetMap*
as an input to the list.["geo:GetMap*"]
is valid but["geo:GetMapTile"]
is not. Similarly, you cannot use["geo:SearchPlaceIndexFor*"]
- you must list each of the Place actions separately.Type: Array of strings
Array Members: Minimum number of 1 item. Maximum number of 24 items.
Length Constraints: Minimum length of 5. Maximum length of 200.
Pattern:
geo:\w*\*?
Required: Yes
-
- AllowResources
-
A list of allowed resource ARNs that a API key bearer can perform actions on.
-
The ARN must be the correct ARN for a map, place, or route ARN. You may include wildcards in the resource-id to match multiple resources of the same type.
-
The resources must be in the same
partition
,region
, andaccount-id
as the key that is being created. -
Other than wildcards, you must include the full ARN, including the
arn
,partition
,service
,region
,account-id
andresource-id
delimited by colons (:). -
No spaces allowed, even with wildcards. For example,
arn:aws:geo:region:account-id:map/ExampleMap*
.
For more information about ARN format, see Amazon Resource Names (ARNs).
Type: Array of strings
Array Members: Minimum number of 1 item. Maximum number of 8 items.
Length Constraints: Minimum length of 0. Maximum length of 1600.
Pattern:
arn(:[a-z0-9]+([.-][a-z0-9]+)*):geo(:([a-z0-9]+([.-][a-z0-9]+)*))(:[0-9]+):((\*)|([-a-z]+[/][*-._\w]+))
Required: Yes
-
- AllowReferers
-
An optional list of allowed HTTP referers for which requests must originate from. Requests using this API key from other domains will not be allowed.
Requirements:
-
Contain only alphanumeric characters (A–Z, a–z, 0–9) or any symbols in this list
$\-._+!*`(),;/?:@=&
-
May contain a percent (%) if followed by 2 hexadecimal digits (A-F, a-f, 0-9); this is used for URL encoding purposes.
-
May contain wildcard characters question mark (?) and asterisk (*).
Question mark (?) will replace any single character (including hexadecimal digits).
Asterisk (*) will replace any multiple characters (including multiple hexadecimal digits).
-
No spaces allowed. For example,
https://example.com
.
Type: Array of strings
Array Members: Minimum number of 1 item. Maximum number of 5 items.
Length Constraints: Minimum length of 0. Maximum length of 253.
Pattern:
([$\-._+!*\x{60}(),;/?:@=&\w]|%([0-9a-fA-F?]{2}|[0-9a-fA-F?]?[*]))+
Required: No
-
See Also
For more information about using this API in one of the language-specific AWS SDKs, see the following: