AWS SAM referência do conector - AWS Serverless Application Model
Tipos de recursos de conector compatíveisPolíticas do IAM criadas por conectores

As traduções são geradas por tradução automática. Em caso de conflito entre o conteúdo da tradução e da versão original em inglês, a versão em inglês prevalecerá.

AWS SAM referência do conector

Esta seção contém informações de referência para o tipo de recurso do conector AWS Serverless Application Model (AWS SAM). Para obter uma introdução aos conectores, consulte Gerenciando permissões de recursos com conectores AWS SAM.

Tipos de recursos de origem e destino suportados para conectores

O tipo de recurso AWS::Serverless::Connector oferece suporte a um número selecionado de conexões entre os recursos de origem e destino. Ao configurar conectores em seu AWS SAM modelo, use a tabela a seguir para referenciar as conexões suportadas e as propriedades que precisam ser definidas para cada tipo de recurso de origem e destino. Para obter mais informações sobre como configurar conectores no seu modelo, consulte AWS::Serverless::Connector.

Para recursos de origem e destino, quando definidos no mesmo modelo, use a propriedade Id. Opcionalmente, um Qualifier pode ser adicionado para restringir o escopo do seu recurso definido. Quando o recurso não estiver no mesmo modelo, use uma combinação de propriedades compatíveis.

Para solicitar novas conexões, envie um novo problema no serverless-application-model AWS GitHubrepositório.

Tipo de origem Tipo de destino Permissões Propriedades da fonte Propriedades de Destino

AWS::ApiGateway::RestApi

AWS::Lambda::Function

Write

Idou QualifierResourceId, e Type

Idou Arn e Type

AWS::ApiGateway::RestApi

AWS::Serverless::Function

Write

Idou QualifierResourceId, e Type

Idou Arn e Type

AWS::ApiGatewayV2::Api

AWS::Lambda::Function

Write

Idou QualifierResourceId, e Type

Idou Arn e Type

AWS::ApiGatewayV2::Api

AWS::Serverless::Function

Write

Idou QualifierResourceId, e Type

Idou Arn e Type

AWS::AppSync::DataSource

AWS::DynamoDB::Table

Read

Idou RoleName e Type

Idou Arn e Type

AWS::AppSync::DataSource

AWS::DynamoDB::Table

Write

Idou RoleName e Type

Idou Arn e Type

AWS::AppSync::DataSource

AWS::Events::EventBus

Write

Idou RoleName e Type

Idou Arn e Type

AWS::AppSync::DataSource

AWS::Lambda::Function

Write

Idou RoleName e Type

Idou Arn e Type

AWS::AppSync::DataSource

AWS::Serverless::Function

Write

Idou RoleName e Type

Idou Arn e Type

AWS::AppSync::DataSource

AWS::Serverless::SimpleTable

Read

Idou RoleName e Type

Idou Arn e Type

AWS::AppSync::DataSource

AWS::Serverless::SimpleTable

Write

Idou RoleName e Type

Idou Arn e Type

AWS::AppSync::GraphQLApi

AWS::Lambda::Function

Write

Idou ResourceId e Type

Idou Arn e Type

AWS::AppSync::GraphQLApi

AWS::Serverless::Function

Write

Idou ResourceId e Type

Idou Arn e Type

AWS::DynamoDB::Table

AWS::Lambda::Function

Read

Idou Arn e Type

Idou RoleName e Type

AWS::DynamoDB::Table

AWS::Serverless::Function

Read

Idou Arn e Type

Idou RoleName e Type

AWS::Events::Rule

AWS::Events::EventBus

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Events::Rule

AWS::Lambda::Function

Write

Idou Arn e Type

Idou Arn e Type

AWS::Events::Rule

AWS::Serverless::Function

Write

Idou Arn e Type

Idou Arn e Type

AWS::Events::Rule

AWS::Serverless::StateMachine

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Events::Rule

AWS::SNS::Topic

Write

Idou Arn e Type

Idou Arn e Type

AWS::Events::Rule

AWS::SQS::Queue

Write

Idou Arn e Type

Idou ArnQueueUrl, e Type

AWS::Events::Rule

AWS::StepFunctions::StateMachine

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Lambda::Function

AWS::DynamoDB::Table

Read, Write

Idou RoleName e Type

Idou Arn e Type

AWS::Lambda::Function

AWS::Events::EventBus

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Lambda::Function

AWS::Lambda::Function

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Lambda::Function

AWS::Location::PlaceIndex

Read

Idou RoleName e Type

Idou Arn e Type

AWS::Lambda::Function

AWS::S3::Bucket

Read, Write

Idou RoleName e Type

Idou Arn e Type

AWS::Lambda::Function

AWS::Serverless::Function

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Lambda::Function

AWS::Serverless::SimpleTable

Read, Write

Idou RoleName e Type

Idou Arn e Type

AWS::Lambda::Function

AWS::Serverless::StateMachine

Read, Write

Idou RoleName e Type

Idou ArnName, e Type

AWS::Lambda::Function

AWS::SNS::Topic

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Lambda::Function

AWS::SQS::Queue

Read, Write

Idou RoleName e Type

Idou Arn e Type

AWS::Lambda::Function

AWS::StepFunctions::StateMachine

Read, Write

Idou RoleName e Type

Idou ArnName, e Type

AWS::S3::Bucket

AWS::Lambda::Function

Write

Idou Arn e Type

Idou Arn e Type

AWS::S3::Bucket

AWS::Serverless::Function

Write

Idou Arn e Type

Idou Arn e Type

AWS::Serverless::Api

AWS::Lambda::Function

Write

Idou QualifierResourceId, e Type

Idou Arn e Type

AWS::Serverless::Api

AWS::Serverless::Function

Write

Idou QualifierResourceId, e Type

Idou Arn e Type

AWS::Serverless::Function

AWS::DynamoDB::Table

Read, Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::Function

AWS::Events::EventBus

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::Function

AWS::Lambda::Function

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::Function

AWS::S3::Bucket

Read, Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::Function

AWS::Serverless::Function

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::Function

AWS::Serverless::SimpleTable

Read, Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::Function

AWS::Serverless::StateMachine

Read, Write

Idou RoleName e Type

Idou ArnName, e Type

AWS::Serverless::Function

AWS::SNS::Topic

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::Function

AWS::SQS::Queue

Read, Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::Function

AWS::StepFunctions::StateMachine

Read, Write

Idou RoleName e Type

Idou ArnName, e Type

AWS::Serverless::HttpApi

AWS::Lambda::Function

Write

Idou QualifierResourceId, e Type

Idou Arn e Type

AWS::Serverless::HttpApi

AWS::Serverless::Function

Write

Idou QualifierResourceId, e Type

Idou Arn e Type

AWS::Serverless::SimpleTable

AWS::Lambda::Function

Read

Idou Arn e Type

Idou RoleName e Type

AWS::Serverless::SimpleTable

AWS::Serverless::Function

Read

Idou Arn e Type

Idou RoleName e Type

AWS::Serverless::StateMachine

AWS::DynamoDB::Table

Read, Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::StateMachine

AWS::Events::EventBus

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::StateMachine

AWS::Lambda::Function

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::StateMachine

AWS::S3::Bucket

Read, Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::StateMachine

AWS::Serverless::Function

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::StateMachine

AWS::Serverless::SimpleTable

Read, Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::StateMachine

AWS::Serverless::StateMachine

Read, Write

Idou RoleName e Type

Idou ArnName, e Type

AWS::Serverless::StateMachine

AWS::SNS::Topic

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::StateMachine

AWS::SQS::Queue

Write

Idou RoleName e Type

Idou Arn e Type

AWS::Serverless::StateMachine

AWS::StepFunctions::StateMachine

Read, Write

Idou RoleName e Type

Idou ArnName, e Type

AWS::SNS::Topic

AWS::Lambda::Function

Write

Idou Arn e Type

Idou Arn e Type

AWS::SNS::Topic

AWS::Serverless::Function

Write

Idou Arn e Type

Idou Arn e Type

AWS::SNS::Topic

AWS::SQS::Queue

Write

Idou Arn e Type

Idou ArnQueueUrl, e Type

AWS::SQS::Queue

AWS::Lambda::Function

Read, Write

Idou Arn e Type

Idou RoleName e Type

AWS::SQS::Queue

AWS::Serverless::Function

Read, Write

Idou Arn e Type

Idou RoleName e Type

AWS::StepFunctions::StateMachine

AWS::DynamoDB::Table

Read, Write

Idou RoleName e Type

Idou Arn e Type

AWS::StepFunctions::StateMachine

AWS::Events::EventBus

Write

Idou RoleName e Type

Idou Arn e Type

AWS::StepFunctions::StateMachine

AWS::Lambda::Function

Write

Idou RoleName e Type

Idou Arn e Type

AWS::StepFunctions::StateMachine

AWS::S3::Bucket

Read, Write

Idou RoleName e Type

Idou Arn e Type

AWS::StepFunctions::StateMachine

AWS::Serverless::Function

Write

Idou RoleName e Type

Idou Arn e Type

AWS::StepFunctions::StateMachine

AWS::Serverless::SimpleTable

Read, Write

Idou RoleName e Type

Idou Arn e Type

AWS::StepFunctions::StateMachine

AWS::Serverless::StateMachine

Read, Write

Idou RoleName e Type

Idou ArnName, e Type

AWS::StepFunctions::StateMachine

AWS::SNS::Topic

Write

Idou RoleName e Type

Idou Arn e Type

AWS::StepFunctions::StateMachine

AWS::SQS::Queue

Write

Idou RoleName e Type

Idou Arn e Type

AWS::StepFunctions::StateMachine

AWS::StepFunctions::StateMachine

Read, Write

Idou RoleName e Type

Id ou Arn, Name e Type

Políticas do IAM criadas por conectores

Esta seção documenta as políticas AWS Identity and Access Management (IAM) que são criadas AWS SAM ao usar conectores.

AWS::DynamoDB::Table para AWS::Lambda::Function

Tipo de política

Política gerenciada pelo cliente associada à função AWS::Lambda::Function.

Categorias de acesso

Read

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:DescribeStream",
        "dynamodb:GetRecords",
        "dynamodb:GetShardIterator",
        "dynamodb:ListStreams"
      ],
      "Resource": [
        "%{Source.Arn}/stream/*"
      ]
    }
  ]
}
AWS::Events::Rule para AWS::SNS::Topic

Tipo de política

AWS::SNS::TopicPolicy associado ao AWS::SNS::Topic.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Resource": "%{Destination.Arn}",
      "Action": "sns:Publish",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "%{Source.Arn}"
        }
      }
    }
  ]
}
AWS::Events::Rule para AWS::Events::EventBus

Tipo de política

Política gerenciada pelo cliente associada à função AWS::Events::Rule.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "events:PutEvents"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    }
  ]
}
AWS::Events::Rule para AWS::StepFunctions::StateMachine

Tipo de política

Política gerenciada pelo cliente associada à função AWS::Events::Rule.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "states:StartExecution"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    }
  ]
}
AWS::Events::Rule para AWS::Lambda::Function

Tipo de política

AWS::Lambda::Permission associado ao AWS::Lambda::Function.

Categorias de acesso

Write

{
  "Action": "lambda:InvokeFunction",
  "Principal": "events.amazonaws.com",
  "SourceArn": "%{Source.Arn}"
}
AWS::Events::Rule para AWS::SQS::Queue

Tipo de política

AWS::SQS::QueuePolicy associado ao AWS::SQS::Queue.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "events.amazonaws.com"
      },
      "Resource": "%{Destination.Arn}",
      "Action": "sqs:SendMessage",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "%{Source.Arn}"
        }
      }
    }
  ]
}
AWS::Lambda::Function para AWS::Lambda::Function

Tipo de política

Política gerenciada pelo cliente associada à função AWS::Lambda::Function.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "lambda:InvokeAsync",
        "lambda:InvokeFunction"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    }
  ]
}
AWS::Lambda::Function para AWS::S3::Bucket

Tipo de política

Política gerenciada pelo cliente associada à função AWS::Lambda::Function.

Categorias de acesso

Read

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:GetObjectAcl",
        "s3:GetObjectLegalHold",
        "s3:GetObjectRetention",
        "s3:GetObjectTorrent",
        "s3:GetObjectVersion",
        "s3:GetObjectVersionAcl",
        "s3:GetObjectVersionForReplication",
        "s3:GetObjectVersionTorrent",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:ListBucketVersions",
        "s3:ListMultipartUploadParts"
      ],
      "Resource": [
        "%{Destination.Arn}",
        "%{Destination.Arn}/*"
      ]
    }
  ]
}

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:PutObject",
        "s3:PutObjectLegalHold",
        "s3:PutObjectRetention",
        "s3:RestoreObject"
      ],
      "Resource": [
        "%{Destination.Arn}",
        "%{Destination.Arn}/*"
      ]
    }
  ]
}
AWS::Lambda::Function para AWS::DynamoDB::Table

Tipo de política

Política gerenciada pelo cliente associada à função AWS::Lambda::Function.

Categorias de acesso

Read

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:Query",
        "dynamodb:Scan",
        "dynamodb:BatchGetItem",
        "dynamodb:ConditionCheckItem",
        "dynamodb:PartiQLSelect"
      ],
      "Resource": [
        "%{Destination.Arn}",
        "%{Destination.Arn}/index/*"
      ]
    }
  ]
}

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:PutItem",
        "dynamodb:UpdateItem",
        "dynamodb:DeleteItem",
        "dynamodb:BatchWriteItem",
        "dynamodb:PartiQLDelete",
        "dynamodb:PartiQLInsert",
        "dynamodb:PartiQLUpdate"
      ],
      "Resource": [
        "%{Destination.Arn}",
        "%{Destination.Arn}/index/*"
      ]
    }
  ]
}
AWS::Lambda::Function para AWS::SQS::Queue

Tipo de política

Política gerenciada pelo cliente associada à função AWS::Lambda::Function.

Categorias de acesso

Read

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sqs:ReceiveMessage",
        "sqs:GetQueueAttributes"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    }
  ]
}

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sqs:DeleteMessage",
        "sqs:SendMessage",
        "sqs:ChangeMessageVisibility",
        "sqs:PurgeQueue"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    }
  ]
}
AWS::Lambda::Function para AWS::SNS::Topic

Tipo de política

Política gerenciada pelo cliente associada à função AWS::Lambda::Function.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sns:Publish"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    }
  ]
}
AWS::Lambda::Function para AWS::StepFunctions::StateMachine

Tipo de política

Política gerenciada pelo cliente associada à função AWS::Lambda::Function.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "states:StartExecution",
        "states:StartSyncExecution"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "states:StopExecution"
      ],
      "Resource": [
        "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:execution:%{Destination.Name}:*"
      ]
    }
  ]
}

Read

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "states:DescribeStateMachine",
        "states:ListExecutions"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "states:DescribeExecution",
        "states:DescribeStateMachineForExecution",
        "states:GetExecutionHistory"
      ],
      "Resource": [
        "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:execution:%{Destination.Name}:*"
      ]
    }
  ]
}
AWS::Lambda::Function para AWS::Events::EventBus

Tipo de política

Política gerenciada pelo cliente associada à função AWS::Lambda::Function.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "events:PutEvents"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    }
  ]
}
AWS::Lambda::Function para AWS::Location::PlaceIndex

Tipo de política

Política gerenciada pelo cliente associada à função AWS::Lambda::Function.

Categorias de acesso

Read

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "geo:DescribePlaceIndex",
        "geo:GetPlace",
        "geo:SearchPlaceIndexForPosition",
        "geo:SearchPlaceIndexForSuggestions",
        "geo:SearchPlaceIndexForText"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    }
  ]
}
AWS::ApiGatewayV2::Api para AWS::Lambda::Function

Tipo de política

AWS::Lambda::Permission associado ao AWS::Lambda::Function.

Categorias de acesso

Write

{
  "Action": "lambda:InvokeFunction",
  "Principal": "apigateway.amazonaws.com",
  "SourceArn": "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:%{Source.ResourceId}/%{Source.Qualifier}"
}
AWS::ApiGateway::RestApi para AWS::Lambda::Function

Tipo de política

AWS::Lambda::Permission associado ao AWS::Lambda::Function.

Categorias de acesso

Write

{
  "Action": "lambda:InvokeFunction",
  "Principal": "apigateway.amazonaws.com",
  "SourceArn": "arn:${AWS::Partition}:execute-api:${AWS::Region}:${AWS::AccountId}:%{Source.ResourceId}/%{Source.Qualifier}"
}
AWS::SNS::Topic para AWS::SQS::Queue

Tipo de política

AWS::SQS::QueuePolicy associado ao AWS::SQS::Queue.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Principal": {
        "Service": "sns.amazonaws.com"
      },
      "Resource": "%{Destination.Arn}",
      "Action": "sqs:SendMessage",
      "Condition": {
        "ArnEquals": {
          "aws:SourceArn": "%{Source.Arn}"
        }
      }
    }
  ]
}
AWS::SNS::Topic para AWS::Lambda::Function

Tipo de política

AWS::Lambda::Permission associado ao AWS::Lambda::Function.

Categorias de acesso

Write

{
  "Action": "lambda:InvokeFunction",
  "Principal": "sns.amazonaws.com",
  "SourceArn": "%{Source.Arn}"
}
AWS::SQS::Queue para AWS::Lambda::Function

Tipo de política

Política gerenciada pelo cliente associada à função AWS::Lambda::Function.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sqs:DeleteMessage"
      ],
      "Resource": [
        "%{Source.Arn}"
      ]
    }
  ]
}

Read

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sqs:ReceiveMessage",
        "sqs:GetQueueAttributes"
      ],
      "Resource": [
        "%{Source.Arn}"
      ]
    }
  ]
}
AWS::S3::Bucket para AWS::Lambda::Function

Tipo de política

AWS::Lambda::Permission associado ao AWS::Lambda::Function.

Categorias de acesso

Write

{
  "Action": "lambda:InvokeFunction",
  "Principal": "s3.amazonaws.com",
  "SourceArn": "%{Source.Arn}",
  "SourceAccount": "${AWS::AccountId}"
}
AWS::StepFunctions::StateMachine para AWS::Lambda::Function

Tipo de política

Política gerenciada pelo cliente associada à função AWS::StepFunctions::StateMachine.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "lambda:InvokeAsync",
        "lambda:InvokeFunction"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    }
  ]
}
AWS::StepFunctions::StateMachine para AWS::SNS::Topic

Tipo de política

Política gerenciada pelo cliente associada à função AWS::StepFunctions::StateMachine.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sns:Publish"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    }
  ]
}
AWS::StepFunctions::StateMachine para AWS::SQS::Queue

Tipo de política

Política gerenciada pelo cliente associada à função AWS::StepFunctions::StateMachine.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "sqs:SendMessage"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    }
  ]
}
AWS::StepFunctions::StateMachine para AWS::S3::Bucket

Tipo de política

Política gerenciada pelo cliente associada à função AWS::StepFunctions::StateMachine.

Categorias de acesso

Read

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:GetObject",
        "s3:GetObjectAcl",
        "s3:GetObjectLegalHold",
        "s3:GetObjectRetention",
        "s3:GetObjectTorrent",
        "s3:GetObjectVersion",
        "s3:GetObjectVersionAcl",
        "s3:GetObjectVersionForReplication",
        "s3:GetObjectVersionTorrent",
        "s3:ListBucket",
        "s3:ListBucketMultipartUploads",
        "s3:ListBucketVersions",
        "s3:ListMultipartUploadParts"
      ],
      "Resource": [
        "%{Destination.Arn}",
        "%{Destination.Arn}/*"
      ]
    }
  ]
}

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:AbortMultipartUpload",
        "s3:DeleteObject",
        "s3:DeleteObjectVersion",
        "s3:PutObject",
        "s3:PutObjectLegalHold",
        "s3:PutObjectRetention",
        "s3:RestoreObject"
      ],
      "Resource": [
        "%{Destination.Arn}",
        "%{Destination.Arn}/*"
      ]
    }
  ]
}
AWS::StepFunctions::StateMachine para AWS::DynamoDB::Table

Tipo de política

Política gerenciada pelo cliente associada à função AWS::StepFunctions::StateMachine.

Categorias de acesso

Read

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:Query",
        "dynamodb:Scan",
        "dynamodb:BatchGetItem",
        "dynamodb:ConditionCheckItem",
        "dynamodb:PartiQLSelect"
      ],
      "Resource": [
        "%{Destination.Arn}",
        "%{Destination.Arn}/index/*"
      ]
    }
  ]
}

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:PutItem",
        "dynamodb:UpdateItem",
        "dynamodb:DeleteItem",
        "dynamodb:BatchWriteItem",
        "dynamodb:PartiQLDelete",
        "dynamodb:PartiQLInsert",
        "dynamodb:PartiQLUpdate"
      ],
      "Resource": [
        "%{Destination.Arn}",
        "%{Destination.Arn}/index/*"
      ]
    }
  ]
}
AWS::StepFunctions::StateMachine para AWS::StepFunctions::StateMachine

Tipo de política

Política gerenciada pelo cliente associada à função AWS::StepFunctions::StateMachine.

Categorias de acesso

Read

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "states:DescribeExecution"
      ],
      "Resource": [
        "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:execution:%{Destination.Name}:*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "events:DescribeRule"
      ],
      "Resource": [
        "arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:rule/StepFunctionsGetEventsForStepFunctionsExecutionRule"
      ]
    }
  ]
}

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "states:StartExecution"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "states:StopExecution"
      ],
      "Resource": [
        "arn:${AWS::Partition}:states:${AWS::Region}:${AWS::AccountId}:execution:%{Destination.Name}:*"
      ]
    },
    {
      "Effect": "Allow",
      "Action": [
        "events:PutTargets",
        "events:PutRule"
      ],
      "Resource": [
        "arn:${AWS::Partition}:events:${AWS::Region}:${AWS::AccountId}:rule/StepFunctionsGetEventsForStepFunctionsExecutionRule"
      ]
    }
  ]
}
AWS::StepFunctions::StateMachine para AWS::Events::EventBus

Tipo de política

Política gerenciada pelo cliente associada à função AWS::StepFunctions::StateMachine.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "events:PutEvents"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    }
  ]
}
AWS::AppSync::DataSource para AWS::DynamoDB::Table

Tipo de política

Política gerenciada pelo cliente associada à função AWS::AppSync::DataSource.

Categorias de acesso

Read

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:GetItem",
        "dynamodb:Query",
        "dynamodb:Scan",
        "dynamodb:BatchGetItem",
        "dynamodb:ConditionCheckItem",
        "dynamodb:PartiQLSelect"
      ],
      "Resource": [
        "%{Destination.Arn}",
        "%{Destination.Arn}/index/*"
      ]
    }
  ]
}

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "dynamodb:PutItem",
        "dynamodb:UpdateItem",
        "dynamodb:DeleteItem",
        "dynamodb:BatchWriteItem",
        "dynamodb:PartiQLDelete",
        "dynamodb:PartiQLInsert",
        "dynamodb:PartiQLUpdate"
      ],
      "Resource": [
        "%{Destination.Arn}",
        "%{Destination.Arn}/index/*"
      ]
    }
  ]
}
AWS::AppSync::DataSource para AWS::Lambda::Function

Tipo de política

Política gerenciada pelo cliente associada à função AWS::AppSync::DataSource.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "lambda:InvokeAsync",
        "lambda:InvokeFunction"
      ],
      "Resource": [
        "%{Destination.Arn}",
        "%{Destination.Arn}:*"
      ]
    }
  ]
}
AWS::AppSync::DataSource para AWS::Events::EventBus

Tipo de política

Política gerenciada pelo cliente associada à função AWS::AppSync::DataSource.

Categorias de acesso

Write

{
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "events:PutEvents"
      ],
      "Resource": [
        "%{Destination.Arn}"
      ]
    }
  ]
}
AWS::AppSync::GraphQLApi para AWS::Lambda::Function

Tipo de política

AWS::Lambda::Permission associado ao AWS::Lambda::Function.

Categorias de acesso

Write

{
  "Action": "lambda:InvokeFunction",
  "Principal": "appsync.amazonaws.com",
  "SourceArn": "arn:${AWS::Partition}:appsync:${AWS::Region}:${AWS::AccountId}:apis/%{Source.ResourceId}"
}